Last October we wrote a post about strong circumstantial evidence pointing to the fact FTP credentials provided to the company Cart2Cart had compromised on their end. In the past few days we became aware of a security announcement they put out that either obliquely notifies their customers of that compromise of FTP credentials or indicates they really have no clue when it comes to security (while feeling it appropriate to be giving out security advice).
They are sending out the following email to customers:
We’re writing to inform you that our security audit has revealed an unpleasant vulnerability of certain Magento stores. Considering the fact that Magento shops are being attacked by hackers more often lately, we strongly recommend you to double-check the security of your e-store.
Please, contact your developer team, so that they could scan your Magento source code in order to ensure that your shop is not under the threat of being abused. Read more info here:
http://www.shopping-cart-migration.com/important-security-announcement-for-magento-store-ownersIf you need technical assistance regarding this, reply to this email and we will check your store from our side.
Following the link mentioned there, you get a page that starts out:
After performing an audit, we’ve revealed an unpleasant vulnerability of certain Magento stores that may have a negative impact on the security of your customers’ personal data.
To ensure the finest security of your Magento retailer, we strongly recommend you to contact your developer team and check the source code for the presence of any suspicious customizations.
The link to “an unpleasant vulnerability” discusses not a vulnerability, but the end result of a vulnerability being exploited, code added to one of Magento’s files that sends credit card information entered on the hacked website to a third-party. The distinction is quite important because when a website is hacked, if you don’t find and fix the vulnerability that allowed it to be hacked the website can remain vulnerable to being hacked again.
Cart2Cart’s email and page never mention what the code they are mentioning does, instead saying “First of all, there’s no need to panic. You can eliminate any possible risks simply by revealing and deleting the code, if there’s any.”.
The next thing they say leads us to believe this could be a reference to their being compromised (or it shows they have no idea what they are talking about) as it suggest doing two things if you have the code on your website:
- Delete the following code inside and save the changes:
- Change your FTP account credentials
Those steps would suggest that the hack happened through compromised FTP credentials, since they want to change those credentials. But the FTP credentials would have to have been compromised somehow, yet they don’t suggest doing anything to stop them from being compromised again. That could be because the compromised happened on their end and has now been fixed, or it could suggest they have no clue what they are talking about.
The last section of the page would certainly lend some credence to them not having much clue when it comes to the security of websites. They provide this list of security tips:
Useful Security Tips
-
Use up-to-date antivirus software
-
Don’t store your FTP account passwords in programs like Total Commander, Filezilla, etc.
-
Change your FTP account password periodically e.g. once a month, especially after granting access to any service providers
-
Limit the FTP access to specific IP addresses
-
Change the administration panel login “admin” to a custom one
-
Hire certified developers, designers or other staff you can trust to only
-
Use repository for a proper and secure workflow
Notable missing from their list of security tips is keeping the software on your website up to date. Not only is this a basic security measure, but it is particularly relevant with Magento based websites right now, since most of the hacked Magento based websites we are cleaning these days have been hacked due to the software not being kept up to date (or not having the security patches for older versions applied).
If you do find code added /app/code/core/Mage/Payment/Model/Method/cc.php, removing the code and changing the FTP credentials is not enough. You will want to also:
- review the rest of the websites files for malicious code and remove any found
- check for Magento extensions added by a hacker
- check for additional Magento admin users
- get Magento secured by either upgrading it to the latest version of 1.9, currently 1.9.2.3, or applying the security patches for older versions
- rename the Magento admin directory to something other than “admin”
- change the passwords for other logins associated with the website (database, Magento admin, etc), in case they were compromised
- try to determine how the website was hacked and make sure that is fixed