home

หน้าแรก
 Computer >> บทช่วยสอนคอมพิวเตอร์ >  >> ระบบเครือข่าย >> ความปลอดภัยเครือข่าย

How to Remove Malware Targeting OpenCart and Magento Credit Card Payments

Credit Card Hijacking on Magento and OpenCart

Credit Card Malware or Hijacking occurs when malicious PHP/JavaScript code is injected into Magento and OpenCart stores allowing hackers to intercept credit card data. This new way of credit card fraud has gone undetected for 6 months. There are many cases where hackers have targeted Magento payment security.

What is a Credit Card Malware Hack? What are its symptoms?

With the growing popularity of e-commerce platforms like Magento and OpenCart, malware infection cases have also increased. Hackers and cybercriminals have modified core files of these CMS to steal store customers' credit card information. Some symptoms of such a hack are:

  • Customer credit cards have been used for fraudulent transactions
  • Errors when attempting to purchase items on the store
  • Checkout process is slow and gets stuck
  • Unknown popups and messages on the website
  • Login to admin area takes longer

Consequences of Payment Gateway Hack

This hack is highly targeted, primarily affecting Magento and OpenCart e-commerce stores. The malware captures the following sensitive information and sends it to hacker-controlled servers:

  1. Credit Card (CC) Information
    1. Credit Card Number
    2. Credit Card Security Code (CVV)
    3. Expiration Date
  2. Magento admin login activity sent to hackers
  3. User Personally Identifiable Information (PII)
    1. Account password
    2. Customer IP address
    3. Billing name
    4. Email
    5. Address
    6. Phone number
    7. Date of birth
  4. Your Magento/OpenCart store server information

A Web Application Firewall is a must for your e-commerce store. It will monitor all traffic from your website and only allow legitimate requests to your web server. Secure your e-commerce site now with Astra.

How to Fix Credit Card Malware Hack in Your Magento/OpenCart Store?

This can get tricky as most malware scanners lack this type of malware. The reason is these hacks are highly targeted and can vary from store to store.

Credit Card Hijack: Step 1: Check Core System Files That May Have Been Modified

We have compiled a list of files where we identified malicious code. Log into your server and check if the following files have been recently modified:

Magento 1.9.X

  • app/code/core/Mage/XmlConnect/Block/Checkout/Payment/Method/Ccsave.php
  • app/code/core/Mage/Client/controllers/AccountController.php
  • app/code/core/Mage/Payment/Model/Method/Cc.php
  • app/code/core/Mage/Checkout/Model/Type/Onepage.php

OpenCart 1.5 / 2.0

  • catalog/controller/extension/payment/pp_payflow.php
  • catalog/controller/extension/payment/pp_pro.php
  • catalog/controller/extension/payment/authorizenet_aim.php
  • catalog/controller/extension/payment/sagepay_us.php
  • catalog/controller/extension/credit_card/sagepay_direct.php

Credit Card Hijack: Step 2: Check Recently Modified Files

Log into your web server via SSH and run the following command to search for the most recently modified files:

find /path-of-www -type f -printf '%TY-%Tm-%Td %TT %p\n' | sort -r

This will return paths to recently modified files. Open them in your text editor and check if they look suspicious.

Credit Card Hijack: Step 3: Search for Web Shells, Backdoor Files on Server

To maintain persistent access to the server, a hacker may upload web-shells or backdoors that will allow them to upload new malicious files at a later stage. Same as above, log into the server via SSH and run:

find /var/www -name "*.php" -exec grep -l "$_FILES\[" {} \;

Open each file shown in the search above and try to find code that looks like a file uploader.

Steps to Prevent Credit Card Hacking and Identify the Cause

  1. Update your OpenCart/WordPress website to the latest version: to fix any known security issues in the CMS core
  2. Scan file uploads for malware: so malicious shell files are not uploaded to the server (Enable this module in your Astra dashboard)
  3. Change admin account usernames and passwords: so the hacker cannot continue to access the website after malware cleanup
  4. Change database password: so the hacker cannot connect directly to the database
  5. Scan server logs (access and error): you may find unknown errors or gibberish in logs that may indicate the source and time of the hack
  6. Prevent future attacks with a Website Firewall: Another option to prevent Magento Malware infections is to use a Website Firewall like Astra. Our security suite automatically secures your site and virtually patches software by preventing malicious requests from reaching your website.