Security

One of my clients have recently seen a surge in TOR traffic with zero conversion from them. And has requested for them to be blocked, since its no point in autoscaling the infrastructure, leading to increased cost, for non converting anonymous traffic. We have a few different ways to block TOR/Onion traffic, firstly we can just click some buttons in cloudflare and problem solved. But thats boring, and does not protect us if we move away from Cloudflare in the future (maybe they’ll deem we are a ’enterprise’ at some point 🙃)....

A simple two line Nginx config update can remove any reference of the polyfill Malware from coming out of your store. What is the Polyfill.io Malware? As you likely have already heard, the polyfill.io domain has been serving malware. And there is still a concerning number of sites that still are including scripts from that domain. Cloudflare and Fastly have both released alternative services that only require a change of domain....

I’ve been sat on this post and POC for CosmicSting (CVE-2024-34102) for a little while, giving time for stores to patch the vulnerability. Chances are, if you still have not applied the patch your store will have been probed and compromised by now since there are a handful of POCs out in the wild. So I highly encourage you to make sure the patch is applied (its simple, a single file diff)....

Overview Recently I came across a Magento 2.3.4 store with a stripe specific credit card scraper embedded into the checkout page. The Malware had been injected into the core_config_data table, and was being saved against the shipping/shipping_policy/shipping_policy_content key. The updated_at time of the entry was 2024-04-10 13:27:32 although its worth noting, whilst this may be the time of the initial infection. Since the original entry point has not been patched, an attacker could have simply changed the payload on that date....

It is very important whilst running a Magento 2 store, to perform regular malware scans. Although, it seems that most stores decide not to which is alarming. The current gold standard for scanning Magento 2 stores is Ecomscan by Sansec.io. They provide one of, if not the best, Magento specific scanning tools. You can trigger one off scans very easily from the server CLI by running the following command and following the prompts....

Recently I onboarded a new client, who was looking for a new development partner. The site was running 2.3.4, so I was expecting we would need to perform a few updates and for there to be some security holes to patch. I ran Ecomscan, as always, during my initial audit of the site. And that highlighted 4 samples of malware on the store! Much to the surprise of the client, who had zero clue of the site being infected....