Hackers Using Insecure Magento Extensions to Access Magento Admin Login Page Without Knowing Normal Address

While reviewing the log files while cleaning up a hacked Magento website recently we ran across a reminder that a common security practice isn’t full proof. With the Magento software and some other software the software has a built in capability to use a non-standard address for the login page for the admin portion of the website. With other software that is commonly promoted security feature to be implemented with an add-on.

The value of that is limited as while there are widespread claims that there are frequent brute force attacks against admin passwords, in truth what is going on are dictionary attacks, which involved trying to log in using common passwords and that can easily be prevented from being successful by using a strong password. There is the possibility of some value of doing this in a far more limited situation where the hacker has access to valid login credentials for the website, but it turns out that there can be various ways to get access to login page without knowing that address.

In the logs of this hacked website we were seeing many POST requests to this address:

/index.php/magenotification/adminhtml_feedback/index/

When visiting the page we saw that the Magento admin login page was showing. In looking into if that all there was that we found that this is something that hackers are looking around with pages like that generated by various extensions.

Magento added protection against this issue with SUPEE-6788, which was part of Magento 1.9.2.2, but by default the protection is not enabled.

Hacker Using SQL Injection Vulnerability to Add “magentoupdate” Admin Account to Magento Websites

As is a common occurrence, we were recently hired to re-clean a hacked website that the security company Sucuri, which is owned by GoDaddy, had repeatedly failed to properly clean. This time it was a Magento based ecommerce website we were cleaning. As is standard issue in those situations they had missed malicious code that should have been easy to find. What we also found was that the hacker had been able to add an additional admin account, unfortunately that had occurred prior to the time period logging was still available, so we didn’t have evidence of how that had been done.

In a situation where we haven’t been able to determine how the hacker has gotten access, part of our cleanup process is to recheck things for a couple of weeks to see if the hacker tries to get back in. In this case the admin account returned a couple of days later.

For others dealing with the admin account in this situation had these details:

  • User Name: magentoupdate
  • Email: support@media.com
  • First Name: support
  • Last Name: support:

With the logging available from when this occurred we found a log entry where one of the URL parameters was this:

');insert%20into%20%60admin_user%60%20(firstname,lastname,email,username,password,created,lognum,reload_acl_flag,is_active,extra,rp_token,rp_token_created_at)%20values%20('support','support','support@media.com','magentoupdate','8df1e8abd8ce4761633042eb8958db97:rp',NOW(),0,0,1,'N;',NULL,NOW());INSERT%20INTO%20%60admin_role%60%20(parent_id,tree_level,sort_order,role_type,user_id,role_name)%20VALUES%20(1,2,0,%22U%22,(SELECT%20user_id%20FROM%20admin_user%20WHERE%20username%20=%20'magentoupdate'),'support');

That is SQL code that generates that admin user, which would be exploited through a SQL injection vulnerability. In this case it involved exploiting a SQL injection vulnerability in an extension on the website, which we then patched up.

A Web Application Firewall (WAF) is Not the Way to Deal With the Reoccurrence of a Hack of a Website

These days quite a bit of our business dealing with the cleanup of hacked websites is re-cleaning websites after other security companies didn’t clean them up properly before us. Troublingly we recently noticed a company that offers to clean up websites, ASTRA Security, treating that as a normal result and using it to promote using web application firewall (WAF), which they also sell:

Even after clean up and restoring your site, the Magento admin hack may reoccur. The reasons could be a backdoor left by the attacker or simply a vulnerability that may be left unpatched. To avoid such scenarios it is highly recommended to use a WAF or security solution of some sort.

If there is still a backdoor on the website that means it hasn’t been cleaned up, since that would be something would be removed during the cleanup, which someone cleaning up hacked websites should understand.

Part of a proper cleanup is trying to figure out how the website was hacked, so if a vulnerability is left unpatched then things probably have not been done right either.

The providers of WAF’s don’t provide evidence that they provide effective protection against vulnerabilities, while we have seen plenty of evidence that they don’t provide it. It would be even more difficult for them to protect against exploitation of backdoors due to wide variety of their location and what is done through them, which someone cleaning up hacked websites should also understand.

The best way to handle a reoccurrence is to avoid one in the first place by hiring someone like us that will properly clean up the website. If you didn’t do that then the next best solution is to hire someone to re-clean it that will do things properly.

ASTRA Security is Promoting Cleaning Up Hacked Magento Websites Despite Not Knowing Basics of Dealing With Them

While looking around to see if others had already written blog posts about something we ran across while dealing with a hacked website we noticed something from a security company, ASTRA Security, that seems like worth noting, since the company appears to not have a basic understanding of what they are doing. In a post that seems to be built around promoting having that company clean up hacked Magento websites there were multiple glaringly strange claims.

There is this section:

Config.php is an important file of the Magento installation. This file basically facilitates connection between the file system and the database. Config.php contains the database connection credentials. Apart from this, it can also be used to:

  • Define the security keys.
  • To specify the database prefix.
  • To set the default language for your admin panel.

Magento 1

In the first version of Magento, app/etc/config.php contained the list of installed modules, themes and language packages apart from the shared configuration settings.

That file doesn’t exist in Magento 1 and in Magento 2, where the file does exist, it doesn’t contain what is mentioned there.

Things getting odder right after that as this written:

Magento 2

In the newer version which is Magento 2, the app/etc/config.php file is no longer an entry in the .gitignore file. This was done to facilitate better development of the software.

Multiple times, config.php has been infected with malicious code by the hackers to steal user credentials. Here is one such malware sample which was found inside /includes/config.php

The files /app/etc/config.php and /includes/config.php are different files, it seems that this company doesn’t understand that the two files can share a name without being the same.

All of that indicates this company shouldn’t be dealing with Magento websites since they lack a basic understanding of the software, but it appears they don’t have even a basic understanding of web development, as they also wrote this in their post:

Tools like phpMyAdmin are of great help in searching for multiple Magento admin hack infected files in one go. Search for malicious code using phpMyAdmin as shown in the image below.

phpMyAdmin is a database administration tool, so it can’t search files at all, much less search multiple at once. That is very common tool, so failure to understand that seems odd for someone dealing with websites, much less doing something more advanced, namely cleaning up hacked websites.

Unfortunately the security industry seems to be filled with companies that don’t seem to care about having the necessary skills to handle the work they offer and the results are not surprisingly often bad.

If you need someone to clean up a hacked Magento website that actually has years of experience of working with Magento websites and cleaning up hacked ones, we provide that.

index.php Files with the Comment “Silence is golden.” on a WordPress Website Are Not Malware

When it comes to dealing with hacked websites a lot of people would be best off leaving it to professionals (assuming you can find one, among all the unqualified companies), as it is easy for people to get very confused about what is going on. We recently had someone contact us about cleaning up a hacked WordPress website where they were saying that part of the malware was that index.php files had been corrupted with “Silence is golden.” and nothing else.

What they were referring to are files that come with WordPress that had the following contents:

<?php
// Silence is golden.

The purpose of those files is to make sure that a listing of files in the directory they are located is not shown in certain server configurations. So those files are harmless and not in any way malware.

MySQL 5.7 Upgrades By Web Hosts Can Lead to or Expose MySQL Table Issue That Causes Errors on Websites

We were recently brought in to provide support for a Moodle website where when submitting an answer to a quiz question the following error was shown:

Error reading from database

That error message doesn’t provide much to go on. Something like that should not happen randomly, so some change likely caused it, but the webmaster for the website wasn’t aware of any changes that had occurred shortly before that happened.

Turning Moodle’s debugging to its highest setting led to more details being shown about the error:

Debug info: Table ‘performance_schema.session_variables’ doesn’t exist
SHOW VARIABLES LIKE ‘max_allowed_packet’
[NULL]
Error code: errorprocessingresponses

That table isn’t a Moodle table, but instead one that is one of the tables for the MySQL database server.

When we did a search on part of that message we found a Stack Overflow conversation that seemed to match the situation, as the MySQL version in use, 5.7.26, had been out for less than week, so it must have been recently upgraded to and that conversation described the error occurring after an upgrade to a version of 5.7.

Based on the information in that conversation either something gets messed up with that table when doing the upgrade or there was a pre-existing issue that is now causing an error because MySQL 5.7 is relying on that table in a way it previously wasn’t.

If you have dealt with the tech support at a web host before you might not be surprised what came next. When they were contacted about the issue they at first didn’t address what was being mentioned and suggested unrelated solutions. When it came to the former, they stated they couldn’t downgrade MySQL, which was an odd response to the suggestion that the upgrade needs to be fixed. When it came to the latter, they were suggesting upgrading Moodle, claiming that it would resolve this and that the new version was compatible MySQL 5.7 (the version of Moodle in use was actually also compatible with that version of MySQL).

While it took several back and forths between them and our client, eventually they seem to come around that there really was an issue on their end and from there it took tens of minutes for it to be fixed, much to the relief of our client.

Sucuri’s 30 Day Refund Guarantee Scam Gets Worse

Back in May of last year someone contacting us about cleaning a hacked website mentioned that Sucuri had told them that they had 30 day refund guarantee, but when we went to look into that we found that in reality Sucuri didn’t provide refunds if someone had requested a cleanup, which is what that person had contacted them about having done.

Here is how the refund guarantee was advertised on their homepage at the time:

30-Day Guarantee

You have 30 days to request a refund according to our Terms of Service.

If you looked at the terms of service it turned out there was one exception for that refund guarantee, the aforementioned limit if you had requested a clean up to be done:

You will have thirty (30) days from the Service Commencement Date or any Renewal Commencement Date to cancel the Service (the “Cancellation Period”), in which case the Company will refund your Service Subscription Fee for the applicable Service Term provided that you have not submitted a Malware Removal Request during the Cancellation Period.

They could spelled that on the homepage in less than words than it took to mention the terms of service, which seems like a good indication they are tying to hide that.

Since then the terms of service haven’t changed, but as we noticed when we went to look at something on their website recently, the marketing of the refund guarantee has gotten worse. For example at the top of the page about their website malware removals they write this:

Repair and restore hacked websites before it damages your reputation. We offer a 30-day money-back guarantee because we know we can help. You can rely on our dedicated incident response team, state-of-the-art technology, and excellent customer service.

If you actually try to get help though, they won’t provide you a refund, even if they didn’t even do anything, seeing as there is no refund if you request help.

Similar on the Immediate Help page which has its own menu section at the top of all the website’s pages, the description of the second step in the process is:

We offer a 30-day money-back guarantee because we know we can help. After completing your billing information, you’ll get access to the Sucuri Dashboard.

Why Are Experienced Security Analysts Failing To Get Websites Clean?

If you look at the rest of their information on their website malware removal page it seems like they are providing a good warning they something is amiss.

They claim that their cleanups are done by “experienced security analysts” and that that “we aim to provide the best malware removal service”:

Experienced Security Analysts

Our dedicated researchers monitor active malware campaigns. With a trained team of analysts, we aim to provide the best malware removal service around.

They also claim that “[n]o hack is too complex for our incident response team”:

Automatic and Manual Cleanups

We use scripts and tools to quickly scan your website for malware. Our analysts check your site manually too. No hack is too complex for our incident response team.

That makes another section seem rather odd, since they highlight that they provide “unlimited cleanups”, which shouldn’t be needed if they properly cleaning and securing websites (they actually do neither of those things properly):

Unlimited Cleanups

We love complex malware infections, and you’ll never pay more for them. Each plan covers your website for a year, including unlimited cleanups, pages, and databases.

Another claim that stands out is this:

Consider us an extension of your team. With professional security analysts available 24/7/365, you never have to worry about dealing with a hacked site.

In reality what we have hearing over and over from people coming to us after having used their service, is that they can’t get in touch with anyone at Sucuri. That doesn’t seem to be isolated issue, as numerous recent reviews of Sucuri on the website Trustpilot include the same complaint.

Fixing Missing Sessions Database Table Error After Upgrading to Zen Cart 1.5.6

When doing a Zen Cart upgrade or any similar upgrade it is always a good idea to do a test of the upgrade first, since unexpected issues can come up and by doing a test first you can more easily work thorough those instead of trying to triage a broken production website. When we are hired to do Zen Cart upgrades we always do that.

That came in handy during a recent upgrade from Zen Cart 1.5.5a to 1.5.6a where we ran into what is an obscure enough issue we couldn’t find any mentions of it when we were troubleshooting it.

After we ran the database updater we found that the instead of being served the website we got an error message, “An Error occurred, please refresh the page and try again.”.Looking at the related error log file in the “logs” directory it was indicated that the sessions table didn’t exist in the database:

PHP Fatal error: 1146:Table ‘[databasebprefix]_sessions’ doesn’t exist :: select value

Looking at the databases for the production website and the test we found that the table existed prior to the database update, but not after.

Looking at the database changes made during the 1.5.6 update we found that the table is dropped and recreated, so for some reason the recreation was failing.

In looking at the debug log for the database updater we found that there were multiple errors like this:

MySQL error 1273 encountered during zc_install:
Unknown collation: ‘utf8mb4_general_ci’
) ENGINE=InnoDB;

After looking at various things we found that in the configuration file, configure.php, for the frontend of the website the “DB_CHARSET” was undefined. Defining that as “utf8”, re-importing the database, and starting the database update process over resolved the errors and the table was properly recreated.

Further in the process we found the apparent reason for the “DB_CHARSET” being missing , it was causing characters to be improperly encoded, which we were able to resolve by simply changing the charset to proper one for those characters.

Wix Doesn’t Currently Support Importing WordPress Websites or Blogs

One of the services we offer is to do transfers of websites from one web host to another, though we often have people that contact us about this service looking to transfer the content of a website to or from a website design platform, like Weebly or Squarespace. We recently had someone contact us about moving a WordPress based website to one of those platforms, Wix. We did a quick to see if it was possible to do that, so we could at least let them know if that is possible, even though we don’t offer that. After we did that we tried to email them that information, but it turned out they hadn’t provided a valid email address, but we can at least share this information with others.

Currently Wix doesn’t support importing websites in to their service:

Currently, importing a site created outside of Wix is not supported.

They also don’t currently support importing blog content in to their service either:

Currently, importing blog content or data from an external source or blog is not supported.
So either you would need to do the transfer manually or look for a third-party solution for that.

These Security Rules Are Not an Indication Your WordPress Website is Hacked

Recently we mentioned the importance of security companies checking to make sure that websites they are being contacted about cleaning are in fact hacked. The reason for that is often problems unrelated to a hack are believed to beloved to be caused one, leading to people looking for unnecessary cleanups.

In one reason situation the person who contacted us was sure that their WordPress website was hacked due to rules (or code) in the web.config, which is a configuration for websites being hosted on IIS web servers, for the website that actually were there to protect the website.

As an example of what was at issue, the following rule would restrict accessing .php files in the WordPress uploads directory, which would prevent a hacker from running code if they could upload .php files through some vulnerability:

<rule name="Deny scripts from wp-content/uploads for WordPress instance #6" enabled="true" stopProcessing="true">
	<match url="^wp-content/uploads/.+\.php" />
	<conditions />
	<serverVariables />
	<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
</rule>

The rules may have been generated by the Plesk control panel.

Here are all the rules in question in case someone else is searching for information on this:

<rule name="Block wp-config.php for WordPress instances" enabled="true" stopProcessing="true">
	<match url="wp-config.php" />
	<conditions />
	<serverVariables />
	<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
</rule>
<rule name="Deny scripts from wp-includes for WordPress instance #6" enabled="true" stopProcessing="true">
	<match url="^wp-includes/.+\.php" />
	<conditions>
		<add input="{REQUEST_URI}" pattern="^/wp-includes/js/tinymce/wp-tinymce\.php$" ignoreCase="false" negate="true" />
	</conditions>
	<serverVariables />
	<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
</rule>
<rule name="Deny scripts from wp-content/uploads for WordPress instance #6" enabled="true" stopProcessing="true">
	<match url="^wp-content/uploads/.+\.php" />
	<conditions />
	<serverVariables />
	<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
</rule>