Andreas von Studnitz - Security in Magento Shops
28
Transcript of Andreas von Studnitz - Security in Magento Shops
What could possibly go wrong?Security in Magento Shops
• integer_net (Aken / Germany)• Consultant / Developer / Trainer / CEO• Specialist for Magento and Solr• @avstudnitz
PHOTO
Andreas von Studnitz
PHOTO
Real Life Example• One line of code added
• Reads all requests in admin and checkout areas
• Encodes and stores data in media/cache_6e0a32[…]d53ee065da
PHOTO
Real Life Example• Active for 6 months!• 5,628 datasets
(email address, name, telephone)• 1,612 passwords• All admin usernames and passwords
Overview
Consequences of Attacks
Types of Attack
Prevention
PHOTO
What can possibly go wrong?Consequences of Attacks
PHOTO
www.ibm.com/security/data-breach/
PHOTO
Stolen User Data
Consequences
PHOTO
Stolen Login Data
Consequences
PHOTO
Stolen Payment Data
Consequences
PHOTO
This guy lost more than 50,000 $ in a data breach
PHOTO
Server Attacks
Consequences
PHOTO
PHOTO
PHOTO
How can this happen with Magento?Vulnerabilities
PHOTO
Magento Unpatched• Neither installed the latest version
• Nor applied important security patches
• (Insecure PHP version)
Vulnerability
PHOTO
Example: Shoplift Bug
(patched February 2015)
Vulnerability
PHOTO
50,581
Vulnerability
Source: byte.nl, April 2016
Magento shops vulnerable to Shoplift:
(out of 255.558)
PHOTO
Weakly secured Admin Area• http://magento.site/admin/
• http://magento.site/downloader/
• Username “admin”
• Low security passwords
Vulnerability
PHOTO
What can an Attacker do with Admin Access? (1)1. Log in2. Upload a custom extension in the Magento
Connect Manager (downloader)
Vulnerability
PHOTO
What can an Attacker do with Admin Access? (2)1. Log in
2. Inject custom JavaScript in System => Configuration
Vulnerability
PHOTO
Vulnerability
PHOTO
Security issues in extensions• Custom or purchased extensions• SQL Injection, XSS, …• Backdoors• Installation service
Vulnerability
PHOTO
How can I prevent Attacks?
PHOTO
1. Follow basic Guidelines• Update Magento and PHP
• Secure the admin area
• Subscribe to the security mailing list
Prevention
PHOTO
Prevention2. Check your Site
PHOTO
3. Do security reviewsPrevention
Severe security issues found in more than 50% of my reviews
