Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this community
After the news came out a few days ago, I haven't heard much - and no official statement - about the newest vulnerability. Sucuri says that it is possible to receive credit card information, or even all $_POST-data including admin-passwords and the like.
I have not had yet a case where a client was hacked, but don't want to wait until this happens to take action. Has anyone seen a patch yet?
What kind of patch or official statement do you expect? The blog post only says that a web application can be compromised once the attacker has access to the code. That applies to each and every web application. The term Magento is completely interchangeable there. Currently, they do not have a clue how the affected host was compromised. The open door in the given examples could be everything, ranging from server issues to "layer 8".
As long as they stay that vague and do not come up with valuable information, it is all pretty much marketing like spreading their company name, making waves, positioning themselves as security experts, etc. Combining buzzwords like "steal" "credit card" "Magento" makes a good story obviously.
What we still can learn from this post:
Update: There is an official statement by Ben Marks now.
As long as your Magento version is up to date, you've installed all latest patches and your server meets best practice regarding setup (file permissions, not another software/website running, firewall, etc.) this is all you can do for now.
I think it's important to mention that there is no specific attack vector yet:
So how does attack work? We’re still investigating the attack vectors. It seems though that the attacker is exploiting a vulnerability in Magento core or some widely used module/extension.
Edit:
As mentioned in my comment above, you can also check out Ben Lessani's detailed answer to another related question that provides some background-information: https://magento.stackexchange.com/a/72697/231
I've seen many other websites hacked this way, inserting malicious code into the code base, and not only in Magento. And there are many variants: scripts stealing POST data, scripts adding XSS, scripts trying to steal root passwords, scripts allowing incoming calls to process data (for Bitcoin mining, to send spam emails from that server), etc...
In some cases the cause was stolen FTP credentials (by viruses/malware) from a client computer in other cases it used an exploit in the application.
There are many other applications that can provide access to the server via exploits, for example WordPress.
There is only one case where Magento would be to blame and an action from Magento is to be expected and that is: if the exploited application were to be Magento of the latest version and fully patched.
So there's only a slight chance this one highlighted case was caused by a fault in Magento in the first place. That's why you don't hear anything from Magento.
The new thing here is that the inserted code is very specifically targeting Magento and using Magento's code architecture and principles.
Now to give some answer to your question "What to do against it?"
Never run two different applications on the same server instance
Like WordPress + Magento. Sometime you see WordPress running on as in www.magentoshop.com/blog/ or Magento running on www.wordpresswebsite.com/shop/. Don't do that. Exploits in WordPress can give the attacker access to your Magento data.
Use a Version Control System
I'm using GIT and also have this on the server (read only access) to deploy the website. This also gives me a quick insight in changes on the system by running git status.
Never use FTP, only SFTP, never store passwords
I mentioned above that FTP passwords were stolen from a client computer. Also using FTP is not secure as it will send data unencrypted through the internet. So use SFTP and never store your passwords in your FTP application, just don't be lazy and type them every time when you connect to your server.
