Comments on: Magento sites hacked

By: meph137

meph137 — Thu, 15 Oct 2009 21:52:15 +0000

Nice job for letting everyone know about this. That is one nasty bug, especially being as it attempted to send personal data elsewhere without being detected, ouch!

@colin – we have also seen an iframe-injecting nasty before. As you metioned, it broke Magento which was great, however it was nowhere near as serious as sending card data – it just attempted to spread itself.

It also sniffed FTP passwords from what we could gather. It was contracted due to a vulnerability in Adobe PDF reader on one of our machines and then it spread to others who visited any sites.

If magento is vulnerable to anything, it certainly seems wise to not 777 everything, something I have personally decided not to do. Glad I did

By: meph137

meph137 — Thu, 15 Oct 2009 21:52:00 +0000

Nice job for letting everyone know about this. That is one nasty bug, especially being as it attempted to send personal data elsewhere without being detected, ouch!

It also sniffed FTP passwords from what we could gather. It was contracted due to a vulnerability in Adobe PDF reader on one of our machines and then it spread to others who visited any sites.

If magento is vulnerable to anything, it certainly seems wise to not 777 everything, something I have personally decided not to do. Glad I did

By: James

James — Sat, 10 Oct 2009 11:16:24 +0000

Hello Branko,

You mentioned mentioned in your comments a manual patch… do you have any further information on this?

Reason I ask is that I have a magento website still on 1.3.0.0, I’m hesitent to upgrade due to past issues I have had with the auto upgrading process… any information or instructions on manual patching would be fantastic – maybe another blog post for it?

Many thanks
James

By: James

James — Sat, 10 Oct 2009 11:16:00 +0000

Hello Branko,

You mentioned mentioned in your comments a manual patch… do you have any further information on this?

Many thanks
James

By: branko

branko — Fri, 09 Oct 2009 06:33:11 +0000

@jonathan

By: branko

branko — Fri, 09 Oct 2009 06:33:00 +0000

@jonathan

By: jonathan

jonathan — Thu, 08 Oct 2009 23:06:19 +0000

Thanks for telling everyone Branko, this is not cool.

@Colin – What mask should we be using – 755?

Thanks,
Jonathan

By: jonathan

jonathan — Thu, 08 Oct 2009 23:06:00 +0000

Thanks for telling everyone Branko, this is not cool.

@Colin – What mask should we be using – 755?

Thanks,
Jonathan

By: Lloyd

Lloyd — Mon, 05 Oct 2009 16:58:18 +0000

I’m just wondering why Varien does not tell anyone about this? Especially for people running community version on production servers…

By: Lloyd

Lloyd — Mon, 05 Oct 2009 16:58:00 +0000

I’m just wondering why Varien does not tell anyone about this? Especially for people running community version on production servers…