A$CE message (hack?) after opening connect manager

[MarioAAP]

Hi peepz,

I have this message shown when I want to connect to the update server of Magento, via the connect manager. Anyone familiar with this? And how to resolve. Any tips or suggestions are welcome.

[Mukesh Tiwari]

Hi @MarioAAP

Which version of Magento are you using? Have you applied all the security patches released by Magento?

[MarioAAP]

Oh, indeed. Some background details.

I've upgraded this shop (for a client) just a few weeks ago from 1.8.* to
1.9.4. All patches till that version number are applied.
Directly after the upgrade there was nothing wrong, beside some fixes I had
to do because the upgrade introduced some minor issues. But at least
nothing with the Connect Manager, till last week.

[Mukesh Tiwari]

Hi @MarioAAP

It seems some kind of suspicious activity. Was your 1.8 installation fully patched before upgrade?

You should disable the downloader on production site. Inform your you hosting provider also to check for any suspicious access to your site setup.

Check for any unknown user account in admin.

Please go through this link SECURITY BEST PRACTICES

[Pronto]

Also, Magento is not the only way to get in. Perhaps your system haven't been updated for a while? Has tons of ports open? Runs unpatched WordPress on another virtual server?