A critical security flaw was identified in March, affecting Magento 2.x eCommerce stores. It is a new malicious script creating a buzz within the Magento community. “Magneto Killer” as coined by its creator(s) is a malicious PHP script targeting Magento websites, compromising the security of payment detail data, subsequently making this data highly susceptible to theft.
As suggested in the name the script does not kill or modify the Magento installation but rather allows modification to be made to the core_config_data table of the compromised Magento database.
How Attackers Get Access to Steal Payment Info:
They use $ConfKiller operation to steal payment info. During the initial stage of the attack, a special SQL query is encoded in base64 by the attacker.
Sucuri has decoded these strings under their respective lines in the sample below for your reference.
If you are a programmer, you can understand the code. If you are a merchant, you can always enlist help from Magento Maintenance experts to evaluate, and ensure your Magento website is safe from vulnerabilities and attack.
The following two objects within the $ConfKiller variable’s array are accountable for the following malicious operations.
- Update DB (Savecc): Configures the Magento website to save client credit card information on the server, instead of sending it to the typical destination — a payment processor (e.g authorize.net).
- Update PP (MailPP): Changes the PayPal merchant business account associated with the Magento site to whatever the hacker wants.
As stated by sucuri.net.
Of course, Magento encrypts the locally saved credit card information, but this encryption is not sufficient for this particular scenario, where attackers are able to steal and decrypt stored credit card info. Moreover, once this data is captured it can then be used egregiously as the attacker have direct access to the website’s filesystem.
Hackers Use SQL Queries to Sync the Data with Credit Card Info:
In order to use stolen credit card information, the hacker must capture and sync customers information from the Magento database. Once credit card data is captured, they hacker perform a data overlay matching customers name, email IDs, physical mailing address, essentially all billing information associated with the stolen credit card.
To steal this additional information, they create another variable array used in their SQL queries from the injected Magento database:
The array listing then pulls any customer info stored in the most common Magento database tables (e.g customer_entity, newsletter_subscriber).
After that, it trims the data, keeping only the information required for fraudulent purchases. Finally, it generates a *-shcMail.txt file in the directory containing relevant customer information.
Expert Magento Programmers can quickly identify malicious scripts, ensuring Magento websites are secure against this aggressive, malicious Magneto Killer code. Magento merchants are urged not to take this attack lightly and are advised to promptly have their store(s) evaluated for and secured against Magneto Killer, as once their site is infected their customers data will rapidly become compromised, tarnishing the trust customers have in their business, and transacting on their store!
If you are not updated to the latest version of Magento or believe your Magento store(s) may be at risk or are currently under attack. Contact our team of certified Magento experts to evaluate update and secure your website today!
