Upgrading compromised Magento from 1.7 to 1.9

Question

I've been doing some research but there appears to be multiple solutions, and I want to get it right. I need to upgrade my Magento from 1.7.0.2 to the latest (1.9) being that our server was compromised and outgoing mail has been spammed.

I was told by out hosting provider to make sure the latest version of Magento is installed to help stop this.

My question though, is what's the best way to get this upgraded? I'm trying to avoid storing anything on my local machine since I don't want that to get harmed with the malicious files.

I was thinking of creating a folder titled 'OLD' on the server and moving all my magento files there and then install a fresh install of Magento 1.9. Once done, I can move over only the necessary files (themes etc) and then delete the 'OLD' folder.

Is this the best way to go about this? Do I need to do anything with my Database, other than amend the local.xml information?

Answer 1

First, the obvious: updating/patching Magento will only prevent future attacks but does not make an already compromised installation secure.

Copying the files to your local machine is not dangerous as long as you just do it to analyze the files and don't set up a local web server. Back up the files on the server itself is an option, but since the server is still compromised, be aware that the files might still get messed with. Also, it is likely that there are malicious scripts hidden in your "necessary files", for example in your theme.

What should you do with the hacked installation?

1. Take it offline. That is, not just put the store into "maintenance mode", but disable the virtual host or block all access.
2. Find and delete the malicious files. A common pattern is that PHP files are placed on the server that execute arbitrary code if accessed by a certain IP range and get the code passed as URL parameter. It might also be a modified existing file. Also, those tend to recreate themselves (for example, modified core file A creates backdoor file B everytime it is loaded). Searching for base64 and eval in all PHP files on the server is a good start. Don't forget media and var directories, those are popular to hide backdoors because they are usually less monitored. There are also tools that might help you. But in doubt, find a security expert to review the code.
3. Find malicious extensions: A possible attack is to gain access to the Magento admin panel and install a "file manager" extension. Check if any extensions have been installed recently that you don't know. Also check the admin_user database table for additional admin accounts and remove them.
4. Change all passwords (Magento admin, database, ...).
5. Install all security patches for your Magento version (a fully patched Magento 1.7 is as secure as Magento 1.9, so I'd save the hassle of updating for later)
6. Update your extensions and theme, as they are also a potential source of exploits
7. If other applications are running on the same environment (for example Wordpress), check and update them as well
8. Go online again. Or even better: back up your database and the files that you need, wipe the server and set it up from scratch.

Answer 2

The best way to de-compromise a website is to restore a backup from before the hack. Then upgrade that version.

If the hack is weeks old and using a bakcup is not an option, then i would advice a complete reinstall and transfer your products.

transferring users and their ordes is possible but very difficult and therefore expensive.

in future stay tuned to security updates,

Answer 3

Fabian's answer is solid, at least as far as a technically focused response should be handled. That said, a security incident like this one is a challenge that must be addressed with responses from both the technical and business perspectives and given that the business implications include potential regulatory and contractual requirements that specifically impact the technical actions you may be required to perform, I thought I would outline them together in this answer.

Before performing any of Fabian's recommended technical activities, review the following and determine which, if any, are allowed given the regulations you are subject to in your location and the contracts you have entered into with your issuing banks, gateway providers and processing service partners.

1. You should first take some time to review the Official Magento Security Best Practices Guide. It contains a wealth of information to help you deal with a compromised installation as well as how to prevent it from happening in the future.

   It's based on the work of the Magento Security Team as well as knowledge shared by several Magento Security Experts both here on Magento Stack Exchange and the Magento Community Forums.

2. If this site generates any real volume of transactions, you should probably not attempt to resolve the issue completely on your own.

   Contact a Magento Security Expert who is familiar with all of the following:

   • The specific Magento version you are running
   • The laws covering Data Breaches, Privacy Protections, and Customer Notification Requirements that govern Merchants operating in and/or located in your geographical region.
   • Reviewing contracts and business partner agreements with your Merchant's Gateway Provider, Processing Services, and Credit Card Companies

Depending on your location, you may be subject to local, regional, and / or national laws that require you to either perform very specific actions in response to a security event or to engage the assistance of someone (or a company) that is specifically licensed as a forensic information security specialist.

In addition, the fine print of the credit card processing agreements signed with the store's Credit Card Merchant Gateway, Financial Institution, Issuing Bank, and the Credit Companies themselves may require other specific actions be performed and that law enforcement be engaged or the store may be held responsible for any charges incurred by the attacker(s).

Finally, again, depending on your location, your store may be required by law to notify the customers of the data breach in very specific ways and the Nation / States in which your customers reside may impose additional requirements on notifying affected customers. Failure to comply with these requirements might make the store subject liable for fines and penalties outside of any costs imposed by your processing company or gateway provider.

These laws & contractual requirements vary greatly across different geographical regions and also across different financial institution and businesses that offer clearing and gateway services to merchants so it is important to engage the services of someone who is both a Magento Security Expert and also familiar with the laws specific to your geographic location and who can assist you with both the technical effort in remediating your hacked site as well as the business activities required by any contracts that have been entered into by the Merchant.

Once you have identified a suitably experienced partner to assist you in your remediation effort, ask them to confirm the next technical steps to take, including actions such as imaging the compromised system, contacting law enforcement, disconnecting the system from the network and investigating the affected systems.

REMEMBER: You are no longer in possession of JUST a hacked system!. Your compromised Magento installation is now also an ACTIVE crime scene, and in many jurisdictions, the crime is a severe one. In the US, it's almost universally a felony (severe crime) with specific prohibitions against tampering with evidence left behind by the perpetuators of the criminal act without proper supervision of licensed personnel and/or law enforcement professionals.

It would be unwise to bring the system back to a working state only to find out that you YOURSELF had just committed a crime punishable by fine and/or jail time. Standard Disclaimer: I am not a lawyer and this does not constitute legal advice.

See Also:

1. What should you do with the hacked installation? - related question here on Magento Stack Exchange.
2. Visa Data Security Resources for Small Businesses
3. MasterCard Rules and Compliance Programs for Processors & Merchants
4. American Express US Merchant Security Policies
   • Fraud Prevention at American Express
   • Data Security Operating Policy & Resources at American Express
   • Fraud & Chargeback Knowledge Center at American Express
5. Discover Card Fraud & Security Resources for Merchants
6. Experian Data Breach and Notification Resources

Note: Most of the links above point to resources specifically written for US Merchants, but they all also contain links for merchants in other regions as well as contact information to engage the specific security support teams to assist you in your own location.

Answer 4

You can also run a diff between your code and the original code to find suspicious files.

Dont forget to secure your shop by installing the security patches afterwards. Otherwise you will likely be kacked again.