I have a custom admin url, still I saw someone trying to login into admin.
I even changed it, and shortly after the next login was tried.
How could this happen, I thought its secure?
7
-
This is security through obscurity which is not a good practice. It doesn't matter if people try to login to your admin URL as long as they aren't successful.– JonCommented May 7, 2015 at 1:15
-
No matter how cleverly generic the custom Admin URL, it's probably been used before. A library of admin type URLs is readily available to scan a website. Try another tack. You don't need to be sitting in your local Starbucks working on your website backend. Use .htaccess to limit by IP address the access to /admin and /downloader.– Fiasco LabsCommented May 7, 2015 at 3:48
-
See also magehero.com/posts/886/…– WillemCommented May 7, 2015 at 5:49
-
2the funniest is that many users put this custom path to their robots.txt, as Disallow... and all the other links/files i always get from robots.txt, why they do this is beyond my imagination...– user2857Commented May 7, 2015 at 8:40
-
Another way. Ouch, what was the point? => magento.stackexchange.com/questions/68003/…– Fiasco LabsCommented May 17, 2015 at 0:43
|
Show 2 more comments
3 Answers
There are a handful of ways your admin url can be exposed. Some include
- Modules that incorrectly create admin controllers. Visiting a known, improper, admin frontname will redirect to the login screen. For instance, hitting
example.com/mymodule_admin/foo/bar. A "safe" admin controller will extend on top of yourcustomadminfrontname, likeexample.com/customadmin/mymodule/foo_bar.- There is a fix for this with SUPEE-6788, but it's a setting you have to change manually.
- The URL is visible in the XML response of
example.com/index.php/rss/order/NEW/new.- Fixed with SUPEE-6285
- Some web hosts create access logs in public areas, like
example.com/access_logs. An attacker could look through these logs and sniff out promising URLs. - Visiting an improperly secured admin controller (e.g.
example.com/downloadable/Adminhtml_Downloadable_File/upload)- Fixed with SUPEE-5994
- You probably haven't noticed the downloader url (
example.com/downloader). Though it's safe behind a login screen, if brute forced an attacker can navigate back to your admin url.
Security through obscurity isn't secure at all. To be safe you should protect your admin interface. This can be done with IP filtering, captchas, rate limits, etc. And, of course, use strong passwords. After all, seeing your admin login screen isn't actually a problem. It's only a problem is an unauthorized user gets in.
answered May 7, 2015 at 5:47
-
4Also worth mentioning: Use Magento Guest Audit to scan your site. You'd be surprised at how much you reveal to visitors. (web interface is new, needs work) Commented May 7, 2015 at 5:52
-
1Bullet point one is addressed finally by SUPEE-6788. Install it, upgrade any modules that won't work with it, disable Admin Routing Compatibility Mode. This => github.com/rhoerr/supee-6788-toolbox tells you which modules are likely to allow the bypass. Commented Nov 16, 2015 at 19:34
The reality is, security by obfuscation nearly never works. I assume it does not even protect you from script kiddies.
But to this case. There are admin modules using their own routes for the admin urls, not using your custom admin url. Payment modules are likely to do this for example(I found 4 of them at our shop).
You can finde some on github with https://github.com/search?p=1&q=AdminController+%22extends+Mage_Adminhtml_Controller_Action%22&ref=searchresults&type=Code&utf8=%E2%9C%93
I assume every controller class not containing _Adminhtml_ is usable for this.
side note, custom url for admin, but not for /downloader ? just brutforce an admin user there, and you get the admin url from there.
answered May 6, 2015 at 21:48
-
Really interesting. Thanks for the share. Which payment modules are you using out of interest?– ShaughnCommented May 6, 2015 at 22:16
-
2This is also currently possible on a vanilla Magento installation. Just hit a certain url and it takes you to the admin route (custom or not). Commented May 6, 2015 at 23:28
-
@JamesAnelay Care to share with the rest of the class? Commented May 7, 2015 at 5:18
-
@JamesAnelay Magento are currently working on this. They would probably appreciate not spreading the information. Commented May 7, 2015 at 8:49
-
1It's better to use a Web Application Firewall or .htaccess lockdown rules against admin, connect and downloader functions than to cross your fingers and obscure. Passive methods like SBO (Security by Obscurity) have no teeth, they take care of no security issue, just move its access in the hopes you get lucky. It's what I call the picket fence method of security, there are gaps between the slats and the attacks are always able to fit through the gaps. Commented Sep 5, 2015 at 20:38
A very nice one is when it appears on similarweb.com because you use a chatty browser-plugin ... (http://www.howtogeek.com/180175/warning-your-browser-extensions-are-spying-on-you/)
