1

I have seen the updates requesting that we install these updates on Magento and seen questions here on how to do so and some difficulty in doing so.

However I'm still unclear as to why I should do so and what will happen if I don't.

Also (I'm quite new to Magento) these updates take a couple of hours to implement, how often do they come along?

Many thanks Ed

Deadmonger
  • 13
  • 2
  • 1
    http://magento.stackexchange.com/questions/63858/critical-reminder-download-and-install-magento-security-patches-ftp-with-no-s ....... that prevent an attacker from remotely executing code on Magento software. – zhartaunik Apr 27 '15 at 11:26
  • Because bad things will happen. 5344 effectively bypasses login authentication in the back end. – Fiasco Labs Apr 28 '15 at 00:34

2 Answers2

0

The 5344 security patch fills a hole that allows for total bypass of authentication to get into your Magento website Admin backend.

http://magento.com/security-patch

At the top of the page is a fill-out form ShopLift detector.

At the bottom of the page is instructions on how to use their check api to test. It basically connects to your website and uses the same hole the hackers will be exploiting soon.

Check your server access logs for the following requests:

POST /index.php/admin/Cms_Wysiwyg/directive/index/
Fiasco Labs
  • 6,457
  • 3
  • 32
  • 43
0

Also, change your admin url.

And it is a good thing to add a Watchlog module and block some IP's in .httaccess:

############################################
## By default allow all access

Order allow,deny
Deny from 93.115.83.243
Deny from 95.110.207.164
Deny from 104.219.248.145
Deny from 108.61.122.9
Deny from 108.61.123.80
Allow from all

Those IP's are the IP's currently brute-forcing my store...

Watchlog extention: http://www.magentocommerce.com/magento-connect/watchlog.html

Daniel van der Garde
  • 234
  • 1
  • 5
  • Afternote from the future: Changing your admin URL until you apply SUPEE-6788 does nothing useful as an attacker can bypass the stock /admin/ or your changed admin URL to get an admin login page. After SUPEE-6788, your non-stock admin url helps keep out script kiddies if you're not able to add an IP access whitelist to severely limit admin backend access. – Fiasco Labs Nov 01 '15 at 20:03