16

Some days before my Magento community edition 1.8.1 site is hacked, because we are late to apply the patch. we found certain files were changed those are

  1. index.php [hackers added some code to it].
  2. get.php
  3. js/index.php
  4. js/lib/ccard.js
  5. lib/Varien/Autoload.php

And they also installed module called Magpleasure file system

But after applying the patch, and removing all the stuff what hackers added in our application problem is not solved.

hackers eventually changing 3 files

  1. get.php
  2. js/index.php
  3. js/lib/ccard.js

Is there anything that we are missing?

How to prevent them by attacking our files?

Is patch is working or not? How should I check that?

  • first check if the vulnerability is not on the hosting side (I don't know how to do that). Maybe you got hacked through other means other than Magento. – Marius May 13 '15 at 7:21
  • Yeah, We checked it by asking hosting team. they informed only we have ssh permission to it, we changed all the password too. but no use. – Charlie May 13 '15 at 7:26
  • 1
    Are there any other applications on the same domain? Like WordPress or something? Maybe these were also compromised or they got in through these apps? – 7ochem May 13 '15 at 7:54
  • @7ochem, No, there are no other applications – Charlie May 13 '15 at 8:55
  • 1
    Anna's suggestions are spot-on and you appear to have identified a few of the most common files modified. We've documented all the ones we'v uncovered in our remediation efforts at github.com/comitdevelopers/magento-security-toolkit - please consider adding your own hard-won knowledge to the project by forking and submitting a pull request. – Bryan 'BJ' Hoffpauir Jr. Jul 3 '15 at 10:05
16

It seems your Magento setup is still compromised at some point so you should carefully check Magento + Webserver settings.

You cannot trust your installation if it was compromised. The ultimate way to go would be a new & clean setup of all files on a new host with the latest backup before you shop was compromised.

If this is not possible due to various reasons, you might check/do these things related to this issue:

Remove all detected changed/hacked files plus installed extensions

Even better: Do a clean (git) checkout from your development system with the lastest version. This will be the safest unless your dev/staging system hasn't been compromised also (which is not the case if you develop locally or in a protected environment).

Remove created backend admin accounts

Especially for SUPEE-5344, there will also be an admin account created in the backend. Remove all new/unnecessarry admin accounts.

Backup plan

Depending on your backup plan and strategy, you could maybe think about a rollback of your complete database.

Check file/folder permissions

Did you check your file/folder permissions? There's no need to run everything with 777 or as root user. Depending on your server configuration 400/500 can be enough. See documentation here.

Check server logs

Check your webservers access/error log to trace accessed sites and suspicious URLs. Maybe you find suspicious IP's to block on firewall level.

1

This is pretty usual I think. Patches come after Magento's security team discovers the vulnerability or someone reports it to them. But until then Magento stores remain a hackers' playground.

A few files to check which could have been modified too:

  1. app/code/core/Mage/XmlConnect/Block/Checkout/Payment/Method/Ccsave.php

  2. app/code/core/Mage/Customer/controllers/AccountController.php

  3. app/code/core/Mage/Payment/Model/Method/Cc.php

  4. app/code/core/Mage/Checkout/Model/Type/Onepage.php

Also, the following command comes handy in finding malware/backdoors/shell once you're SSH's in your server:

find /var/www -name "*.php" -exec grep -l "$_FILES[" {} \;

I took the above info from https://www.getastra.com/blog/911/how-to-remove-fix-magento-opencart-credit-card-malware-hack/

Might be useful to check directly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.