2

I worked on a Magento install where I found database dumps lying in the root index / i.e. the same directory as the magento base url. Like:

mystore.com/databasename.datethedumpwasmade.sql mystore.com/databasename.datethedumpwasmade.sql

The database name can not be guessed easily, now my question is how worried should I be about this. The possibilities that I see here for first finding out the filename of the dumps:

  1. There are bots roaming the internet searching for these dumps, for them to be effective they would need to have some way of figuring out the database name and then running through each possible date extension. Is this plausible
  2. At the time of creation, I'm assuming the developer has downloaded the dump via a browser and then not deleted it. Risk of the filepath having stuck in some log somewhere and hence automated bots being able to find it
  3. Other way of guessing/knowing such a file exist and downloading it

Assuming someone did obtain the database, even though MD5 hashed, I'd assume the reasonable thing would be to e-mail customers asking them to change their passwords. What computing power and determination is required to crack 80 000 passwords (of which 60 000 is not actually user accounts and mean nothing).

The files as such has been deleted of course.

Improve this question
4
  • 2
    customer passwords is not so important as emails , physical addresses, and orders history, for some shops it will be a fatal...
    – user2857
    Commented Aug 22, 2015 at 14:59
  • 1
    This true, I guess the better formulation would be if an index.html is placed within the public_html, what ways are there to snoop out what other files that are in that dir. That someone has been able to download the database is obviously the main concern.
    – palmik
    Commented Aug 22, 2015 at 18:48
  • 1
    Was directory listing turned on? They don't have to know the file name to find it.
    – Fiasco Labs
    Commented Aug 23, 2015 at 5:00
  • The folder has a index.php and index.html in it, directory listing was not turned on no
    – palmik
    Commented Aug 24, 2015 at 4:34

1 Answer 1

Reset to default
3

Consider your site as compromised.

It is simple, the DBs where available and you have to assume the worst.

Tell your customers to change the password and tell them their information might have been compromised.

This is a terrible practice and you should be aware that there are high chances that the information stored in the DB is in the wrong hands now. You should be able to see if someone downloaded the DBs by checking the access.log file if you are using apache.

Improve this answer
1
  • Yeap, roaming through the access logs is what I did. So far nothing.
    – palmik
    Commented Aug 24, 2015 at 4:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.