Slashdot Mirror
Year-Old Critical Magento Flaw Still Exploited, Payment Info Stolen
Orome1 writes: A whole year has passed since a critical e-shop hijacking flaw in the Magento CMS has been patched, but the vulnerability is still being exploited in attacks in the wild, warns Sucuri researcher Denis Sinegubko. At the time, the Magento development team pushed out a patch (SUPEE-5344) but after two whole months, 98,000 online merchants still hadn't implemented it. This forced the team to send out email alerts directly to the users, urging them to apply the patch immediately. Obviously, even that was not enough. Attackers are still actively deploying malware that exploits the vulnerability to inject malicious code into the Magento core file.
We all know by now. Just take off his helmet and Professor X can get in his mind.
So, the oh-so-predictable "assume random e-commerce sites are security risks and don't use them"?
Now I'm shocked that everyone who hoists a storefront on the web shouldn't be trusted. No, wait, the other one.
This seems like it should have been expected, that's an awful lot of sites to assume they'd all keep up with security updates.
Lost at C:>. Found at C.
Are they on the internet? Then they're probably putting you at risk.
If big players like Amazon can get security breeches, that mom and pop shop which had a college student build them an e-commerce site hasn't got a chance.
Plan accordingly. Small security holes on the internet tend to get magnified into big, giant, widespread security holes.
Lost at C:>. Found at C.
Headline Translation: "Users Don't Update Stuff, Film at 11"
Just cruising through this digital world at 33 1/3 rpm...
For crying out loud, did you even read the *summary*?
This is exactly why sites should never handle credit card or other financial info. Decent mom-n-pop sites just use Paypal or Square or whatever, where all they do is implement a shopping cart, send the total over to the payment processor's website and redirect the user there, and then the user pays the processor (so the mom-n-pop shop never sees the CC#), then gets returned to the merchant website for confirmation.
It's easy to write the code for this, and security just isn't a big concern because the mom-n-pop site isn't handling any critical data. There's not even a need for HTTPS encryption (until they get forwarded to the payment processor). Why sites would do it any other way is beyond me; the main reason seems to be something stupid like "so the customer has a consistent experience".
Let the payment processor handle the critical data and deal with PCI compliance and all that. Don't try to do it yourself.
-1 Stupid. Read the fucking summary, open-source-hating moron.
There *is* a fix, the problem is the users haven't applied it.
And Magento is only barely "open source". There's not a single comment anywhere in their source code; it's not made to be easy for others to work with, it's only "open" so they can sell it as such, and then get customers to send them $$$ for customizations because it's too much of a PITA to do it yourself when the code is so intentionally obtuse.
So everybody knows not to use those merchants and they find themselves with their foolish SEO navel gazing efforts.
I had my own run in with this bug. I'd patched my production servers, but had an unpatched development server that was publicly exposed to the Internet for testing some things with outside vendors. I didn't realize it was unpatched--just happened to install that from a backup that predated installing SUPEE-5344. It was fun to go through the system in a virtualbox after it got hacked and mess around with the "Linux.Encoder.1" ransomware they uploaded to the server. http://daviddeppner.com/blog/magento-ransomware is a Blog post I wrote about the experience.
So basically they do it because customers are so stupid they want a "frictionless" experience on the website rather than the security of only trusting their credit card details to a large organization that is more likely to have proper security than some random mom-n-pop website?
Too bad its update mechanism sucks balls. You can apply "patches", which I find often require fuzzy matches to work, but you can't actually UPGRADE to a newer version, you have to install that on a separate folder and database, then schedule a time to take it all down and export/import the whole database, orders, themes and all. It's crazy complex compared to Wordpress' simply Upgrade Now button.
. Define sqrt(x) as something really evil like (x / rand()), and bury it deep. Watch your coworkers go nuts.
Maybe I'm missing something, but what the heck are you talking about? This is about Magento, which is a PHP-based e-commerce system that runs on smallish websites. This has nothing to do with smartphone-based in-person payment systems (like you'd see at a small brick-and-mortar shop), or with Windows in any way (no one runs PHP on Windows, and you're talking about Windows-based POS, we're not talking about POS here, we're talking about web shops).
For a small mom-n-pop web shop, I don't think you're going to find a payment processor with better rates than Paypal/Square. Bigger sites with a lot of volume can find better rates, but when you're small they're generally not worth it because of the fees.