Magento security: before the break-in, and after.
Online shops are not singled out. They are scanned automatically, all of them, on the day a flaw becomes known.
Short answer
Magento security has four layers: current patches, a shielded admin, a server that only does what is needed and checks on changes to the code. If a shop has already been hacked, Jevana finds out how the attacker got in, removes what was left behind, closes the hole and helps with the notification the GDPR requires.
If the shop has been hacked
- 01
Secure
A copy of the server and database as they are now. The evidence is in there.
- 02
Find the way in
A patch not installed, a vulnerable module or a stolen password. Without this the attacker comes back.
- 03
Clean up
Remove left-behind files, extra admin accounts and scripts in the database.
- 04
Close it
Patch, replace all passwords and keys, shield the admin.
- 05
Report
Establish which data was affected. If needed, notify the Dutch Data Protection Authority and your payment provider.
The four layers
Patches
- Security patches from Adobe as they appear
- Third-party modules updated, unused ones removed
- A PHP version that is still maintained
The admin
- Its own address instead of the default one
- Two-step verification for every administrator
- Reachable only from known networks
The server
- Write permission only where Magento needs it
- A filter that blocks known attack patterns
- No development tools on production
Checks
- An alert when a file in the code changes
- A scan for scripts that read payment details
- Logs kept outside the server
The script that reads along
The most common attack on an online shop is invisible. A few lines of JavaScript in the checkout page send every card number entered to a server of the attacker. The shop works as normal, orders come in, nobody notices.
Such a script gets in through a flaw that could have been patched months ago. The owner hears about it from the payment provider, or from a customer. That is why we look beyond whether patches are installed, and check that the code is what it should be.
Questions
My Magento shop has been hacked: what do I do first?
Put the shop in maintenance mode and change nothing in the files. Every change wipes traces that are needed to find the way in. Contact whoever manages the shop, and your payment provider if payment details may have been affected. We first make a copy of the situation, then look for the flaw, and only then clean up.
How do you know whether payment details have leaked?
By searching for code that does not belong: scripts in the checkout page, in the database settings for the header and footer, and in changed Magento files. The dates of those changes show since when data was read. If you process payments entirely on the payment provider's page, the risk is smaller, but not zero.
Must a hack of the online shop be reported?
If personal data was viewed or stolen, it is a data breach and you must report it to the Dutch Data Protection Authority no later than 72 hours after you discover it. That is a legal deadline under the GDPR. If the consequences for customers are serious, you also inform them. We supply the technical facts for the notification; you make the notification yourself.
How do you prevent a Magento shop from being hacked?
By installing patches when they are released, shielding the admin with two-step verification and its own address, removing unused modules and watching for changes to the code. None of these measures is complicated. It goes wrong when nobody feels responsible and a patch sits for three months.
Goes well with
-
Magento maintenance and support
Patches, updates, monitoring and a contact for outages, for a fixed monthly amount.
-
Magento upgrade
To the latest Magento 2.4 release: modules checked, tested on staging, live at a quiet moment.
-
Magento audit
An independent review of code, modules, server and security, with a list of what comes first.
-
Cybersecurity for SMEs
The measures that stop most attacks, in an order a small business can follow.
From the knowledge base
-
How long will Magento 2 still be supported?
Which versions of Magento 2 still get patches, when that stops and how to tell whether your shop is falling behind.
-
Website hacked: what do you do now?
Strange pages, a Google warning or a site that redirects. What to do first, how to clean up and how to keep it from coming back.
Tell us what you run.
An introduction costs nothing. You talk straight away to one of the two people who will actually do the work.
or email info@jevana.systems