Magento: Hacked Websites Have Not Installed Update

Monday warned security for thousands of hacked Magento sites used to distribute malware. According Magento websites are not adopted by an unknown vulnerability, but the administrators have not installed an important update.

This update was published in February this year and fixed the so-called "Shop Elevator Bug". Through this vulnerability, attackers execute arbitrary code remotely and gain administrator access. In February Magento warned that webmasters should install the update immediately, but eight months later turn out thousands of merchants to have given no answer to this.

In addition, some merchants have been taken over possible because administrators used a weak password. Owners get a Magento site advised to check their website for the presence of malicious code and malware, rename all administrators in the system and install all available updates immediately.

Thousands Hacked Magento Sites Spread Malware

In recent days, thousands of Magento sites are hacked and include malicious scripts that attempt to infect visitors with malware. How websites are hacked exactly is still unknown, so let security firm Sucuri in an analysis know.

According to the company, Google has been hacked 7000 Magento sites blocked. Magento is a popular open source content management system for web shops. Anti-malware company Malwarebytes reports that the attackers script on the hacked websites sites visitors unnoticed to a page with the Neutrino-exploitkit. This exploitkit uses a known vulnerability in Adobe Flash Player to put the Andromeda malware on the system. This malware can steal login details for internet banking and make your computer part of a large botnet.