We are currently running 9.0.5 (we plan to upgrade soon). In the last month, we have received 12 fake orders that all originated from the same IP address. I have now blocked that IP address. The orders were submitted using 5 different, already existing accounts. We found out about the issue because the real users got email notifications of orders they did not place and contacted us about them.

So, it seems someone has figured out how to place fake orders using other people's accounts. Is this a known issue with 9.0.5? I browsed all the release notes for the later releases and didn't see anything that appeared to address it. Anyone else seen this? Has it been fixed in the later releases?

Thanks,
David

We block our admin login using Cloudflare, only specific IP's can access the back-end.

This might be a good feature to implement in a future update, where you can specify specific IP's to restrict users to the back-end.

I hope this helps,
-Ray


PS: also another idea in addition to blocking the IP would be to have the ability to modify the URL of the back end; in other words, change the default from "https://www.yoursite.com/Login" to a user specific URL that's harder to guess like "https://www.yoursite.com/xx-234568/Login" Magento uses this approach.

Edited by user Tuesday, May 9, 2023 12:14:30 PM(UTC)  | Reason: Not specified

You could also implement 2-step verification on the back-end, this could also benefit users.

Can this be done today on a per-user level?

Hi David,

I'm relieved that you were able to find the breach and take care of it before anything else was compromised on the server. I'm also relieved that there isn't a security issue in the AbleCommerce code.

Thank you for giving us an update.

Is your database and website located on the same server?

If your database connection string is encrypted, I don't see how they could have gotten your password to log in to your system.

I never run any type of password manager on the server, and, in fact, you shouldn't be running any desktop applications on the server at all. Since we have a static IP at the office, we also limit remote login to specific IP's. I know this is a little more difficult if you have a dynamic IP.

Either way, I'm glad you got your problem fixed, and hopefully, it will never happen again, I strongly suggest that you turn on two-step verification for all your admin users. I'm uncertain if this feature is included in version 9.0.5.

Hope some of this helps, and best of luck.

-Ray

It seems this hacker was specifically targeting AbleCommerce and they are trying to capture credit card information. Something is intercepting or blocking requests to \Validation\ValidateCreditCardNumber but we haven't found it yet. We upgraded from 9.0.5 to 9.0.6 and went through the code very carefully but the problem is still there. So, it isn't in the AbleCommerce code directly. We searched for service workers, iis modules, handlers, iis redirects, url rewrites. No luck. Windows Defender found Meterpreter.8 Malware today. Likely related so we are running more extensive Anti-virus tests.

We've turned off orders on the live site until we track this down.

I'm hopeful we have now removed the root source of this hack. Today, we found an IIS Module, HTTPCacheLog, that was causing our problems. The DLL for that module had a very recent Timestamp and the path didn't match any of the other IIS Modules. Once we removed that DLL, the problems below went away.

The ongoing issues we noticed were:

1.) Any URL that contained the words "Credit" and "Card" in the path wasn't reaching the intended end-point.
This included: https://[ourAbleCommerceSite]/Checkout/_CreditCardPaymentForm and
https://[ourAbleCommerceSite]/Validation/ValidateCreditCardNumber

2.) The was another Category page on the site that was displaying a blank page.

3.) Malware was popping up on the server on a nightly basis in odd places. The malware was being caught by anti-virus software on the server but it was clear we hadn't found the root source of the malware as it kept appearing and we had URLs that were being intercepted.