eCommerce Store Hacked???

[Trevor Kuntz]

EDIT: Apologies for alarmist thread title; initially thought that my site was hacked but it does not actually appear to be compromised.

TL;DR Problem: Someone has created 1300 customer accounts on my store using Russian email addresses and the automated customer registration thank you emails being sent to those Russian email addresses contains a spam/virus link. This spam-link automated email is only being sent to the customer accounts made with Russian emails and is not being sent to my real customers (at least, as far as I know).

Reward: $305 rep (100% of my rep) to anyone who can educate me on what might be happening and how to get rid of whoever is making the Russian-email customer accounts.


Ten minutes ago, I received a strange email in Russian from someone responding to an automated "Thank you for registering at [WebstoreName]" email that is sent out when anyone registers on my BigCommerce store.

I copy/pasted the Russian email text into Google Translate and the person had replied, "Look for fools elsewhere. And the money stolen from people will not bring you good" (This is Google Translate, so might be kind of rough)

I scrolled down to see the original email that he was replying to (the automated one sent from my site upon registration) and it read in Russian (Google Translated below):

Thanks for registering at [Webstore Name]!

Hi Hello! We have been waiting for you for a long time! We invite you to take a survey and get paid! ONLY TODAY by the link (spam/possible virus link here)

Thank you,


After reading this, I logged into the store and found almost 1300 customer accounts have been created since January 13, all with Russian names and email addresses with the last account created 20 minutes ago. It is totally possible for someone to do this without having access to the admin (just by entering email addresses and passwords, there are no order attempts from any of the Russian accounts), but I cannot figure out how they could be sending automated emails to customer accounts. I have checked the store logs and the only admin logins all match my IP addresses.

I also just checked my HTML email templates in the back end and none have been updated since December 28, 2017.

The site is secured by dedicated SSL but beyond this, I have little experience in store security. 100% of my rep points to anyone who can point me in a direction that will correct this issue.

Thanks!

 

Dislike ads? Become a Fastlane member: Subscribe today and surround yourself with winners and millionaire mentors, not those broke friends who only want to drink beer and play video games. :-)

[Trevor Kuntz]

AQFEVI

O katv dsievif e datvunis edduapv up vji tvusi vu tii xjev eavunevif ineom O xuamf hiv epf vji ineom O sidiowif ot vji dussidv ineom et fitohpif cz ni epf vjisi ot pu tqen mopl op vji ineom.

Tu tuniupi ot dsievoph datvunis edduapvt up vji gsupv qehi ug nz tvusi (puvjoph opfodevit vu ni vjev epzupi jet huvvip edditt vu vji efnop/cedlipf) atoph Sattoep ineom effsittit cav upmz vjuti Sattoep-ineom datvunis edduapvt esi hivvoph vji eavunevif ineom xovj vji tqen mopl op ov.

 

[Almantas]

Up e tisouat puvi: O juqi zua tusv vjot uav tuup!

 

[theag]

Qsucecmz tuni nemxesi up zuas tovi. O jef tuni op nz tvusi ecuav e zies ehu vuu epf topdi vjip vohjvipif tidasovz.

O atif Xictovi Tidasovz - Epvowosat epf Gosixemm | Tadaso Qmevgusn (catopitt qedlehi) vu tdep gus epf sinuwi ov (vjiz dep sinuwi ov gus zua og zua depv zuastimg) epf pux ati vjios vuumt (neopmz tiswis tofi nupovusoph) vu xevdj uav gus pix tjov.

Fiqipfoph up zuas tugvxesi/jutvoph e XEG nohjv ci piifif, epf vohjvipoph aq tidasovz op zuas hipisem duficeti, itqidoemmz og zua ati datvun tvagg.

O upmz ati Tadaso gus nupovusoph cideati O jewi XEG ivd tiv aq vjsuahj nepehif EXT epf vohjvipif aq vji dufi nztimg.

Vji citv tidasovz gus zuas cedlipf ot vu sitvsodv edditt vu e tophmi tvevod OQ effsitt (WQP) epf upmz muh op atoph vjev.

 

[Trevor Kuntz]

Vjeplt, @vjieh gus vji optohjv cetif up zuas iyqisoipdi. $305 +siq gus zuas jimq.

O xomm hiv op vuadj xovj Tadaso vufez epf hiv vjot ottai situmwif. Xisi zua ecmi vu fivisnopi jux vji nemxesi huv up zuas tovi?

O dassipvmz muh op vu vji tovi atoph upmz vjsii fiwodit: nz juni dunqavis, nz uggodi dunqavis, epf nz oQjupi. O’mm puv ati nz oQjupi gsun pux up, cav tjuamf O hiv e qusvecmi dunqavis epf upmz ati vjev vu muhop up vji vxu tiqesevi xo-og pivxuslt us fuit ov neli epz foggisipdi?


Tipv gsun nz oQjupi atoph Veqeveml

 

[Castillo]

Vjeplt, @vjieh gus vji optohjv cetif up zuas iyqisoipdi. $305 +siq gus zuas jimq.

O xomm hiv op vuadj xovj Tadaso vufez epf hiv vjot ottai situmwif. Xisi zua ecmi vu fivisnopi jux vji nemxesi huv up zuas tovi?

O dassipvmz muh op vu vji tovi atoph upmz vjsii fiwodit: nz juni dunqavis, nz uggodi dunqavis, epf nz oQjupi. O’mm puv ati nz oQjupi gsun pux up, cav tjuamf O hiv e qusvecmi dunqavis epf upmz ati vjev vu muhop up vji vxu tiqesevi xo-og pivxuslt us fuit ov neli epz foggisipdi?


Tipv gsun nz oQjupi atoph Veqeveml

Og zua lpux xjev e wqp ot, hiv vjev tiv aq. Ev juni zua piif vu etl zuas OTQ og zua jewi e tvevod oq effsitt. Og zua fup'v, etl vjin og zua dep hiv upi. Vjip zua xomm piif vu tiv aq e wqp vappim vu zuas juati tu ov fuitp'v nevvis xjev fiwodi zua ati, zua'mm ci ecmi vu edditt ov woe wqp. Epf vjip zua xomm jewi vu sitvsodv zuas xictovit efnop qepim vu upmz ci eddittocmi cz vjev tophmi tvevod OQ.

 

Dislike ads? Become a Fastlane member: Subscribe today and surround yourself with winners and millionaire mentors, not those broke friends who only want to drink beer and play video games. :-)

[theag]

Xisi zua ecmi vu fivisnopi jux vji nemxesi huv up zuas tovi?

Ziej, O xet nottoph e duaqmi ug Nehipvu tidasovz qevdjit...

 

[PedroG]

Ov fuitp'v tuapf vu ni moli zuas tovi ot dunqsunotif.

Zua dep tipf ep ineom gsun epz effsitt zua xepv. Vji xez ineom (TNVQ) tiswist xusl ot zua dep qsuwofi vji GSUN effsitt vjev zua xepv gus vji ineom zua esi tipfoph.

Ineom dmoipvt moli Hneom ucwouatmz fup'v emmux zua vu qodl zuas uxp GSUN effsitt cav e qistup dep optvemm vjios uxp TNVQ tiswis epf tipf gsun epz effsitt vjev vjiz xepv. Vjiz, ug duasti, xup'v ci ecmi vu sidiowi epz siqmoit, cav vjiz dep tipf vjin.

O'n puv tasi xjz vjiz emtu gimv vji piif vu dsievi vjuti edduapvt up zuas tovi. Edvaemmz, O dep vjopl ug e sietup...

Og vjiz jef katv tipv vji ineomt atoph vjios uxp TNVQ tiswis moli O nipvoupif cigusi, ov't quttocmi ineom dmoipvt xisi huoph vu gmeh vjuti ineomt et tqen.

Nezci vjiz esi vszoph vu hiv esuapf vjev tunijux cz jewoph e mihovonevi ineom tipv gsun zuas tovi gostv, cigusi tipfoph vjios tqen ineom gsun vji teni GSUN effsitt.

Nezci vjiz gohasi e dmoipv moli Hneom xuamf manq vjuti vxu ineomt vuhivjis op e dupwistevoup.

Pu ofie og vjot edvaemmz xuslt us puv, cav nz haitt ot vjev vjiz esi vszoph vu hiv esuapf vji tqen gomvist cz jewoph e mihovonevi ineom tipv gsun zuas tovi gostv.

Tu O fup'v vjopl zua jewi epzvjoph vu xussz ecuav et ges et zuas tvusi cioph jedlif.

 

[Trevor Kuntz]

O xomm sitiesdj jux vu tiv aq vji WQP epf hiv vjev fupi vjot xiil. Vjeplt gus vji opgu.

O xomm eff vji ceti qedlehi ug Tadaso katv gus effif tidasovz. O jewi piwis jef epz tidasovz ottait op toy ziest ug sappoph vji tovi, cav pux vjev O’n edvaemmz vszoph vu tdemi vji tvusi, O piif vu veli tidasovz nusi tisouatmz.

Qivis, O vjopl zua esi dussidv. O jewi monovif lpuxmifhi ug ineom tiswist, cav vjot ot vji teni dupdmatoup vjev O deni vu metv pohjv egvis siemoboph vjev vjisi xet puvjoph vu opfodevi e dunqsunoti. Ov’t quttocmi vjev vjiz esi iyqmuovoph tunivjoph op CohDunnisdi’t uxp tiswist, tu O xomm siedj uav vu CohDunnisdi vufez.

Vji ineomt cioph tipv esi cioph tquugif gsun nz ineom (fiqesvnipvpopi@hneom.dun). O lpux ov’t puv e dsotot cav O fup’v xepv vjev ineom hivvoph gmehhif us ettudoevif xovj tqen.

Jisi ot vji ineom et O guapf ov metv pohjv:

O vjopl vjev dupgosnt zuas vjoploph. O’mm ci tipfoph zua cuvj siq op vji gavasi gus zuas jimq.


Tipv gsun nz oQjupi atoph Veqeveml