Sherrie, that's not bad advice, but the scanner you link to in your post doesn't actually scan to see if your site is compromised - it scans to see if you've installed the patches provided by Magento.
That's a small, but important difference. If you were compromised BEFORE you installed the patch, you are still compromised because the patches DO NOT DO ANYTHING TO FIX A SYSTEM THAT IS ALREADY COMPROMISED. At best, they prevent additional compromises from OTHER attackers, but whoever already compromised your system will still have access to it after you install the patch, at least based on the compromises I've worked on so far...
It may have been updated in the last few weeks, but I had previously verified this behavior by taking a known-compromised site, installing the patches, and testing it via the link you provide. It came up clean, but within 24 horus the operator of the site was having credit card data stolen after members completed purchases. Please do let us know if the scanner has been updated to actually check for the existence of cormpromised files on a web site - that would be an amazing resource for the community and one that would save my firm and our clients a lot of time and worry.
We've remediated many sites since these exploits were released and to assist the community in responding to them we've documented our research to provide a list of 18 known attack signatures so that you can check your systems for evidence of them and respond accordingly. Keep in mind we've never seen two compromises that are exactly the same, so there's a chance your particular system might be slightly different - if you discover anything on your system that we don't already have documeted, please share that with us so we can update the attack signature guide.
We're working on a toolkit to automate the remediation of these item but it may be a week or two until it's ready for distribution. In the meantime, we're sharing the knowledge we've acquired working through these compromises with everyone in the community in an effort to make sure everyone is as safe as can be expected.
I'm including a 3-Step Compromise Response Process below that we've worked over and over again to get consistent results. The key assumption you're going to have to make is that you can't know what has or hasn't been compromised until you diff the files in your system against the default source code provided by Magento or a copy you have made in your (Git / Mercurial / SVN) repository. YOU SHOULD ASSUME that your database and logins have been compromised and go change them all.
We provide a link to a guide we've uploaded to our GitHub repo that is tracking the 18 signatures we have been able to clearly identify in the wild that relate to these most recent security announcements. You should go through each and every one of them to see if you can find anything that matches. If so, you can follow the instructions to either delete or replace the compromised file or delete or update your database to replace the affected data. It's in PDF format now, but we should have it converted to Markdown by tomorrow.
CRITICAL NOTE: Installing the patches from Magento WILL NOT help you if you have already been compromised. At best, it will stop ADDITIONAL compromises of the known types, but if you are already compromised then you'll have to BOTH install the patches and remediate your system as we highlight below.
Let me know if you discover anything not included already in that guide - we're trying our best ot keep up with the latest developments on this topic and happily welcome any contributions from the community.
Phase 1: Identify the scope of your compromise. Each and every one of the items I list below are signatures we've discovered on compromised Magento sites specicifally relating to the SUPEE-5344 and SUPEE-5994 vulnerability announcenments. You need to go through each one and check to see if you find any evidence on it on your system. Many of them are enough by themselves to allow an attacker to re-enter your systen after you patch it, so you'll have to be dilligent and make sure you don't skip anything or fail to remediate it.
Phase 2: Delete what you must, and replace what you can : use the original files from your repository or the Magento source files. If you're not running one of the latest versions, you can still use the Magento download page to grab older version sources from their site.
Phase 3: RESET Credentials: Inventory every use of a login name and password remotely related to your deployment and reset them all, including
- Merchant Account Loigins and API Keys
- Magento Admin Logins & Passwords
- Email account credentials
- LDAP / AD / Primary Authentication System Passwords
- EVERYTHING
- You can be reasonably sure that the preceding steps will help you purge infected fies but you can not know if passwords have been sniffed or key logged or the victim of some other attack, so resetting all related credentials is the safest option if you are going to attempt to remediate a compromised system.
The guide is too long to post in this response but the PDF can be downloaded immediately at our GitHub reopsitiory.
Sincerely,
Bryan “BJ” Hoffpauir
<< Signature to be setup in your profile >>
