15

Recently I took over the management of a Magento store. Yesterday we recieved an email from an IT company stating our store wasn't secure. Eventhough I doubt the legitimacy of the email, it did show the last order in the store, the amount of registered customers and the last added product.

Since I recently became admin, after the realisation, I don't exactly know what security measures has been taken. The following things I know for sure:

  • There's a custom path for the admin panel
  • The data is send over https
  • The admin password is a string of random lower or uppercase letters

If this mail is legit, how can I fix this problem?

  • 1
    add to the list : the admin loggin is not "admin' or 'administrator" – nicolallias Jun 25 '15 at 8:31
  • 1
    If you're not patched to the latest patch levels, changing the admin path was a laughable waste of time as it was quite easy to get Magento to expose the obfuscated path. Make sure your installation has had all the security patches applied. – Fiasco Labs Jul 1 '15 at 4:32
7

Did you install all the patches? https://www.magentocommerce.com/download#cat_1735_files

After applying the patches, change all admin passwords.

And whatever third party modules are installed, can do whatever they want, e.g. make big security holes in magento.

4

Check your shop-security at https://shoplift.byte.nl/

Check your backend account, remove right they don't need

Install all patches. At http://de.nr-apps.com/blog/2015/05/11/magento-security-patches/ you can see, which patch for which version you will need.

Review third party modules if you can.

3

Based on the OP's description, it's difficult to determine the current state of the system with respect to a compromised Magento. Unfortunately, as I discuss below, installing the fixes will not resolve your problem if you are already compromised. They only stop future attacks, They DO NOT DO ANYTHING TO FIX A SYSTEM THAT IS ALREADY COMPROMISED.

We've documented our research to provide a list of known attack signatures so that you can check your systems for evidence of them and respond accordingly. Keep in mind we've never seen two compromises that are exactly the same, so there's a chance your particular system might be slightly different - if you discover anything on your system that we don't already have documented, please share that with us so we can update the attack signature guide or just fork, update and submit a pull request.

We're working on a toolkit to automate the remediation of these item but it may be a week or two until it's ready for distribution. In the meantime, we're sharing the knowledge we've acquired working through these compromises with everyone in the community in an effort to make sure everyone is as safe as can be expected.

I'm including a 3-Step Security Analysis & Response Process below that we've worked over and over again to get consistent results. The key assumption you're going to have to make is that you can't know what has or hasn't been compromised until you diff the files in your system against the default source code provided by Magento or a copy you have made in your (Git / Mercurial / SVN) repository. YOU SHOULD ASSUME that your database and logins have been compromised and go change them all.

CRITICAL NOTE: Installing the patches from Magento WILL NOT help you if you have already been compromised. At best, it will stop ADDITIONAL compromises of the known types, but if you are already compromised then you'll have to BOTH install the patches and remediate your system as we highlight below.

Phase 1: Identify the scope of your compromise. Each and every one of the items I list below are signatures we've discovered on compromised Magento sites specifically relating to the SUPEE-5344 and SUPEE-5994 vulnerability announcements. After you've installed the most recent patches (and any others you may need to install from Magento), you need to go through each one and check to see if you find any evidence of the signature on your system. Many of them are enough by themselves to allow an attacker to re-enter your system after you patch it, so you'll have to be diligent and make sure you don't skip anything or fail to remediate it.

You can also use the online scanner from Magento, but by and large these only will tell you if you've installed the patches and prevented future compromises. If you've already been compromised, these won't scan for other back doors or attacks that may have been installed when you were first attacked. at least none of the ones we tested found the signatures we discovered. Defense in depth is the way to go, which means multiple scans and reviews from multiple tools and perspectives if you want to be confident in the results.

Phase 2: Delete what you must, and replace what you can : use the original files from your repository or the Magento source files. If you're not running one of the latest versions, you can still use the Magento download page to grab older version sources from their site.

Phase 3: RESET Credentials: Inventory every use of a login name and password remotely related to your deployment and reset them all, including

  • Merchant Account Logins and API Keys
  • Magento Admin Logins & Passwords
  • Email account credentials
  • LDAP / AD / Primary Authentication System
  • Passwords
  • EVERYTHING
  • You can be reasonably sure that the preceding steps will help you purge infected fies but you can not know if passwords have been sniffed or key logged or the victim of some other attack, so resetting all related credentials is the safest option if you are going to attempt to remediate a compromised system.

The guide is too long to post in this response but the signature list can be downloaded immediately at our Magento Security Toolkit GitHub repository.

2

The things you have listed are good first steps but they are by no means the only things you need to do to make your site secure.

Exactly what is insecure about your site no one will be able to answer, at least without looking at your site. It really depends on your setup, e.g if you are using apache or nginx, are they configured correctly? Have you installed all the latest magento security patches?

If they were able to tell you about the last order and number of registered customers, I would take it seriously...

0

Eventhough I doubt the legitimacy of the email, it did show the last order in the store, the amount of registered customers and the last added product.

That sounds legit...

I don't think this has been mentioned, but some of these fishing emails can be from ok companies, and it can be worth at least seeing what they would charge to fix the problem. (It sounds like they would have a good idea where to start) If the company seems shady then yes, avoid.

There's some good points above; if you're going to do this yourself, you either need to diff the files against known start points, or, maybe easier (depending on your setup) is to install a fresh Magento on another server, and go from there (install fresh versions of any extensions you have, import the products (can be fast using a tool like Magmi), and finally export your orders/customers from the current site, and then import into the new setup).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.