Magento hacked even after applied patch

Question

Some days before my Magento community edition 1.8.1 site is hacked, because we are late to apply the patch. we found certain files were changed those are

1. index.php [hackers added some code to it].
2. get.php
3. js/index.php
4. js/lib/ccard.js
5. lib/Varien/Autoload.php

And they also installed module called Magpleasure file system

But after applying the patch, and removing all the stuff what hackers added in our application problem is not solved.

hackers eventually changing 3 files

1. get.php
2. js/index.php
3. js/lib/ccard.js

Is there anything that we are missing?

How to prevent them by attacking our files?

Is patch is working or not? How should I check that?

Answer 1

It seems your Magento setup is still compromised at some point so you should carefully check Magento + Webserver settings.

You cannot trust your installation if it was compromised. The ultimate way to go would be a new & clean setup of all files on a new host with the latest backup before you shop was compromised.

If this is not possible due to various reasons, you might check/do these things related to this issue:

Remove all detected changed/hacked files plus installed extensions

Even better: Do a clean (git) checkout from your development system with the lastest version. This will be the safest unless your dev/staging system hasn't been compromised also (which is not the case if you develop locally or in a protected environment).

Remove created backend admin accounts

Especially for SUPEE-5344, there will also be an admin account created in the backend. Remove all new/unnecessarry admin accounts.

Backup plan

Depending on your backup plan and strategy, you could maybe think about a rollback of your complete database.

Check file/folder permissions

Did you check your file/folder permissions? There's no need to run everything with 777 or as root user. Depending on your server configuration 400/500 can be enough. See documentation here.

Check server logs

Check your webservers access/error log to trace accessed sites and suspicious URLs. Maybe you find suspicious IP's to block on firewall level.

Answer 2

This is pretty usual I think. Patches come after Magento's security team discovers the vulnerability or someone reports it to them. But until then Magento stores remain a hackers' playground.

A few files to check which could have been modified too:

1. app/code/core/Mage/XmlConnect/Block/Checkout/Payment/Method/Ccsave.php

2. app/code/core/Mage/Customer/controllers/AccountController.php

3. app/code/core/Mage/Payment/Model/Method/Cc.php

4. app/code/core/Mage/Checkout/Model/Type/Onepage.php

Also, the following command comes handy in finding malware/backdoors/shell once you're SSH's in your server:

find /var/www -name "*.php" -exec grep -l "$_FILES[" {} \;

I took the above info from https://www.getastra.com/blog/911/how-to-remove-fix-magento-opencart-credit-card-malware-hack/

Might be useful to check directly.