Cleaning up a hacked online shop, then keeping it patched automatically

The problem

The script was disguised as ordinary Google tracking code. In fact it loaded a second script from the attacker’s server, and the attacker could change what that script did at any time.

The site ran a lot of plugins, and security warnings about them were arriving almost every week. Each one meant a manual update, and the store’s team were spending their own time chasing them. The hosting account was still set up through a previous agency, which made it hard to lock down.

What we did

• Took the site offline the same day. A maintenance page went up straight away, so no more visitors were served the script.
• Removed the script and checked everything else. We cleaned the site and took out plugins it didn’t need.
• Moved it to a clean server. While the clean-up was going on, we built new hosting for the shop, then moved the clean site across before switching it back on, with no extra downtime.
• Locked the doors. Two-factor login for admins, and security alerts now come to us instead of the store’s team.
• Patched the server the day the fix came out. A serious security flaw in common server software was announced the same week, and the shop’s server was updated as soon as the fix was released.

Keeping it patched automatically

The real fix isn’t the clean-up. It’s making sure the shop never sits on a known vulnerability for weeks again. So we set up a system on the new hosting that does the updating for them:

• Security patches applied automatically, within 30 minutes of being released.
• Updates tested in a staging environment first. If an update breaks something, we fix it there before it goes live.
• Monitoring, backups and a monthly report, so the store knows what was updated and when, without having to check.

It’s now live. The store’s team no longer chase update warnings: security fixes go on within half an hour, and each month they get a short report of what was updated.