3

I'm running Opencart, an ecommerce CMS on a public website.

About a week ago I noticed a decent spike in direct traffic in Google Analytics (meaning these users input my URL directly rather than being referred organically or through social media) on a single day. The next day traffic was back to normal. This was quite strange, and I found that most of these users were from the USA and some were from France/Germany. My site services customers in another country, so this traffic struck me as odd, but I didn't think too much of it.

However, more recently a bunch of new customers have signed up under the exact same name using different email addresses and different IP addresses. There were 5 in a row, each 1-3 hours apart. Again, this is unusual - it's never happened before on this site. At the time I thought OK, maybe I'm being spammed, although site performance has been fine since this started.

What freaked me out was the most recent signup. This person set their name to "DbLks Trackr" and had a similar email address. I then looked at the IPs of all of these signups - this most recent one and the ones with the same name. Most are proxies, two are Ukrainian and one is American.

I'm thinking my URL has been posted on some forum or IRC and people are planning to try and take the database, which is why they're signing up.

It's not a very big ecommerce store at all so I didn't think it'd be much of a target really. I'm pretty sure my own PC isn't infected, but my Opencart version hasn't been updated in a while.

What's going on here? Is it likely they could access my database through an SQL injection or other means? Or is it likely to be harmless trolling?

UPDATE: proxy traffic is probing my site, looking at js and image files. Seems like a bot or bots looking for a vulnerability or the admin page.

Improve this question
19
  • 2
    Why don't you do the logical thing... and update your Opencart version to the most recent available? Surely prevention is better than... not... Also, I'd like to know the name of your store, so I know not to purchase from there, since it seems you're not concerned enough about the security of your customers payment details to keep your system up-to-date!
    – autistic
    Feb 3, 2018 at 8:42
  • Trolling or probing? I don't know... I suspect only your attacker knows their true intentions, right? Why don't you ask them?
    – autistic
    Feb 3, 2018 at 8:48
  • @Sebivor - there are a multitude of reasons why someone may not have updated. If recent releases of the system didn't make any improvements to security why would they?
    – user81147
    Feb 3, 2018 at 10:05
  • @JᴀʏMᴇᴇ In the absence of further information (such as version number, or confirmation that there have been no such improvements to security), it seems silly to indulge upon that line of reasoning. As a general rule of thumb, we should keep all software, including operating system software, server software and the hosted packages, up-to-date, as you can't be sure that vulnerabilities patched will be documented in the changelog; after all, many vulns are patched without even being known about, as demonstrated by the OpenBSD team.
    – autistic
    Feb 3, 2018 at 10:14
  • @Serbivor I'm using an old version because updating it would completely change the layout of the frontend. It's not as simple as updating WP - I think I'd have to manually update all VQMod plugins too. AFAIK there's no pressing security vulnerabilities with this old version, so I don't want to update (especially without spending a few days to prepare in a dev environment). Because the site is so small I wasn't preparing for an attack which is obviously a mistake on my part. Now I'm just trying to figure out how likely one is and whether I need to update (if it would help or not).
    – user16421
    Feb 3, 2018 at 10:38

2 Answers 2

Reset to default
2

The answer to the title question is: maybe.

Not to come across too “jaded”, but all websites are nearly constantly in that state. Anyone who argues otherwise just isn’t being realistic :)

However, based on your thorough analysis along with some comments here, it appears that there may be some recent discovery of a new vulnerability, or perhaps a recent post on some forum has piqued peoples interest in OpenCart again.

From a quick 30 second search, it seems that OpenCart 2.2.n through 2.3.n have suffered from both SQLI and XSS vulnerabilities: https://www.cvedetails.com/vulnerability-list/vendor_id-9599/Opencart.html

You can see a few bugs listed on that page that were updated within the last 12 months. I also saw a github repo where an OpenCart maintainer seemed very... careless (?) about some potential vulnerability.

As such, I would recommend following the sound advice of other posters here, get your site updated ASAP! Even if it means taking it offline for a few minutes.

Then, if you’re still worried about those accounts and email addresses, you can always drop them from your db!

Improve this answer
1

From your question and Rolf's answer, I think this is a person/system adding themselves to your database, so in the event that someone 'leaks' your DB in the future, they'll be able to verify the details.

But really. Unless you want to end up on that list, update your site.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .