Riccardo Tempesta gave a presentation on data security and leakage prevention in Magento stores. He discussed how security threats have evolved over time from phreaking and viruses to today's focus on stealing users' personal information. He then provided two examples of real security issues: (1) a SQL injection vulnerability in a third-party module that allowed unauthorized access, and (2) an XSS vulnerability that could allow malicious JavaScript to be run on a site. Throughout the presentation, he emphasized the importance of vetting third-party extensions and properly validating and escaping user input to prevent these types of attacks.

1. #mm18nl | @RicTempesta
Riccardo Tempesta - CTO @ MageSpecialist
Magento addicted developer
Magento 1 Certified Developer Plus
Magento 2 Certified Professional Developer
In the top Magento2 contributors list of 2017
Magento Stack Exchange 4% topmost
Proud NERD and GEEK
Something about me…

2. #mm18nl | @RicTempesta
Magento2
under siege

3. Data Security and Leakage prevention
#mm18nl | @RicTempesta
70s
Phreaking
80s
Worms / Viruses
(network)
Big companies
EU/US governments
public authorities
Security threats timeline

4. Data Security and Leakage prevention
#mm18nl | @RicTempesta
70s
Phreaking
80s
Worms / Viruses
(network)
First 90s
Worms / Viruses
(floppy)
Late 90s
Email viruses
Big companies
EU/US governments
public authorities
Small business companies
and final users
Security threats timeline

5. Data Security and Leakage prevention
#mm18nl | @RicTempesta
70s
Phreaking
80s
Worms / Viruses
(network)
First 90s
Worms / Viruses
(floppy)
Late 90s
Email viruses
Big companies
EU/US governments
public authorities
Small business companies
and final users
Security threats timeline
2000s
Spywares
2010s
Websites
Malwares
Users personal
information

6. Data Security and Leakage prevention
Users information
and
personal data
are the main
targets today
#mm18nl | @RicTempesta

7. Data Security and Leakage prevention
And the number of hackers and
“hackers wannabe” has drastically
increased…
#mm18nl | @RicTempesta

8. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Are you asking why?

9. Data Security and Leakage prevention
The hacker cliché in 80s-90s
#mm18nl | @RicTempesta
No social life
Few friends
«Genious»
NOT so cool

10. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Only few movies had
cool hackers

11. #mm18nl | @RicTempesta
Data Security and Leakage prevention
«War Games»
If you do not remeber
this movie you are too
young or not enough
NERD to be here!

12. Data Security and Leakage prevention
The hacker cliché in 2010s
#mm18nl | @RicTempesta
Still no social life
Still few friends
Still genious
But cool!

13. Data Security and Leakage prevention
#mm18nl | @RicTempesta
And this is why,
today everybody
wants
to be a hacker

14. Data Security and Leakage prevention
#mm18nl | @RicTempesta
A considerable amount
of hacking tools are
available today.

15. Data Security and Leakage prevention
#mm18nl | @RicTempesta
It is incredible,
but they are
user friendly!

16. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Security issues are
only happening to
other people…

17. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Even if Magento 2 is one of the
MOST SECURE E-COMMERCE SOLUTIONS
We must be aware that we could
accidentally introduce security holes with:
• Unsecure 3rd party modules
• Bad programming
• Misconfigurations
Using Magento is not enough…

18. Data Security and Leakage prevention
#mm18nl | @RicTempesta
I will try to scare
you for the next 10
minutes with “real
examples”

19. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Example #1: Data leakage
Beware of unverified 3rd party modules

20. Data Security and Leakage prevention
#mm18nl | @RicTempesta
A Magento merchant
Installed a 3rd party extension from a famous
company providing e-commerce services.
After few days he experienced multiple
unauthorized backend accesses.

21. Data Security and Leakage prevention
#mm18nl | @RicTempesta
<?php
namespace SomeVendorModel;
...
class SomeClass implements SomeClassInterface
{
...
public function getSomething()
{
$connection = $this->getConnection();
$filter = $this->request->getParam('filter’);
$qry = "select body from some_table where=" . $filter;
return $connection->fetchAll($qry);
}
...
}
What we found:

22. Data Security and Leakage prevention
#mm18nl | @RicTempesta
<?php
namespace SomeVendorModel;
...
class SomeClass implements SomeClassInterface
{
...
public function getSomething()
{
$connection = $this->getConnection();
$filter = $this->request->getParam('filter’);
$qry = "select body from some_table where=" . $filter;
return $connection->fetchAll($qry);
}
...
}
What we found:
Blind SQL injection

23. Data Security and Leakage prevention
#mm18nl | @RicTempesta
http://mysite/my/awesome/module?filter=title%3da+story
Everything is fine if we use it in the expected way:

24. Data Security and Leakage prevention
#mm18nl | @RicTempesta
…?filter=title%3da+story;+drop+database+magento;
This will NOT work:
Because PHP does not allow multiple queries in one time

25. Data Security and Leakage prevention
#mm18nl | @RicTempesta

26. Data Security and Leakage prevention
#mm18nl | @RicTempesta

27. Data Security and Leakage prevention
#mm18nl | @RicTempesta
…?filter=1+union+select+something+from+somewhere
But this will work:
This is called «union select attack»

28. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Let’s see what a malicious
user can do with SQLMap:

29. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Video #1

30. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Passwords are protected
Magento2 uses a SHA-256 hashing salt + pwd
algorithm to protect passwords.
But a malicious user can always run
a brute force off-line attack.

31. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Let’s see what can happen with “HashCat”
A tool able to run brute force attacks using the
Graphical Card GPU.
Up to 500MH/s with a standard video card

32. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Video #2

33. Data Security and Leakage prevention
#mm18nl | @RicTempesta
In 2015
56% of apps included at least one SQL injection
Source: https://thehackernews.com/2015/12/programming-language-security.html

34. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Most of the people will use the
same password both for PayPal
and your Magento store.

35. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Protecting passwords with BlindHash
Clear password SHA-256 hashed password
Fully encrypted password
https://www.blindhash.com/
Offline attacks complete protection

36. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Example #2: Full control
A common pitfall

37. Data Security and Leakage prevention
#mm18nl | @RicTempesta
A Magento merchant
Discovered something strange on his website.
Someone was able to change the pages content.
But no database/filesystem changes
were detected.

38. Data Security and Leakage prevention
#mm18nl | @RicTempesta
<?php
namespace SomeVendorBlock;
...
class SomeClass extends Template
{
...
public function getWelcomeText()
{
$name = $this->request->getParam(‘name’);
return __(‘Hello %1’, $name);
}
...
}
What we found:

39. Data Security and Leakage prevention
#mm18nl | @RicTempesta
<?php
/** @var SomeBlockClass $block */
?>
...
<?= $block->getWelcomeText() ?>
...
What we found:

40. Data Security and Leakage prevention
#mm18nl | @RicTempesta
http://mysite/my/awesome/module?name=Riccardo
Everything is fine if we use it in the expected way:

41. Data Security and Leakage prevention
#mm18nl | @RicTempesta
http://mysite/my/awesome/module?name=%3Cscript%3Eale
rt%28%27hello%20world%27%29%3C%2Fscript%3E
But, what if we replace it with a JavaScript code?
<script>alert('hello world')</script>
This code will run in your HTML document:

42. Data Security and Leakage prevention
#mm18nl | @RicTempesta
XSS injection:
Request containing the JavaScript
Response containing the Javascript

43. Data Security and Leakage prevention
#mm18nl | @RicTempesta
XSS injection (example):
Response containing the Javascript
Email with a link containing
the malicious JavaScript code
Click on the link

44. Data Security and Leakage prevention
#mm18nl | @RicTempesta

45. Data Security and Leakage prevention
#mm18nl | @RicTempesta

46. Data Security and Leakage prevention
#mm18nl | @RicTempesta
One of your customers receives an email like this one:

47. Data Security and Leakage prevention
#mm18nl | @RicTempesta

48. Data Security and Leakage prevention
#mm18nl | @RicTempesta
https://bit.ly/mm18demo

49. Data Security and Leakage prevention
#mm18nl | @RicTempesta
https://bit.ly/mm18demo-xss

50. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Video #3

51. Data Security and Leakage prevention
#mm18nl | @RicTempesta
In 2015
86% of apps included at least
one XSS vulnerability
Source: https://thehackernews.com/2015/12/programming-language-security.html

52. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Prevent and protect…

53. Data Security and Leakage prevention
#mm18nl | @RicTempesta
When you say «Magento», you
are not talking about a
software, you are talking about
a community.
No community can exist
without contributions.
When you say “Magento”:

54. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Detecting malwares
If you think you have been hacked:
https://github.com/gwillem/magento-malware-scanner
by Willem de Groot
ClamAV can be helpful for known PHP/JS malwares:
:~$ clamscan -r --bell -i /my/magento/path

55. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Our company’s contribution
to Magento 2 security:
● Two Factor Authentication
● Google reCaptcha
● Malicious IP filter
● Malware upload filter
● Admin IP restriction
● Magento IPS/IDS Shield
Our free contribution to security

56. Data Security and Leakage prevention
#mm18nl | @RicTempesta
Our company’s contribution
to Magento 2 security:
● Two Factor Authentication
● Google reCaptcha
● Malicious IP filter
● Malware upload filter
● Admin IP restriction
● Magento IPS/IDS Shield
Our free contribution to security
I can proudly say:
“They will be part of Magento 2.3”

57. Data Security and Leakage prevention
#mm18nl | @RicTempesta
MSP Notifier framework:
● Real Time notifications on:
● Telegram
● E-Mail
● Slack
● …
● Events based notifications
Another free contribution to security

58. Data Security and Leakage prevention
#mm18nl | @RicTempesta
MSP Notifier framework:
● Real Time notifications on:
● Telegram
● E-Mail
● Slack
● …
● Events based notifications
Another free contribution to security

59. Data Security and Leakage prevention
#mm18nl | @RicTempesta
I hope you enjoyed my speech
THANK YOU!

60. Data Security and Leakage prevention
#mm18nl | @RicTempesta
THANK YOU!
KEEP CALM
AND
KEEP HACKING
Github:
MageSpecialist
Twitter:
@RicTempesta
Please do not hack my accounts...