Protecting osCommerce Sites Against Malware
The following is a guest article by Anirban Banerjee, CTO & co-founder of StopTheHacker. StopTheHacker is a StopBadware Partner, and Dr. Banerjee is a regular contributor to StopBadware's community forum, BadwareBusters.org.
When it comes to starting an online store, osCommerce is a popular choice of e-commerce software. Like many other content management systems, osCommerce offers users free tools to set up and host online stores. osCommerce’s popularity can also make it attractive to hackers and malware authors. When your livelihood depends upon your website, it’s up to you to protect it from malware.
What Malware Does to Your Online Retail Store
If a hacker plants malware on your website, the upload may result in several unfortunate issues for you and your customers, including:
- Opening pop-up ads whenever a user opens your page.
- Receipt of multiple spam emails by customers that appear to come from you.
- Slowing of the user's Internet connection or crashing of the user's computer.
- Redirection to pages with viruses or malware.
- Stealing of personal information.
As an online retailer, it’s easy to understand how badly a malware attack can affect your relationship with your customers. Customers can potentially suffer long-term consequences from a malware attack on your site, and your reputation will suffer, too.
Taking Care of Business
If you had a brick and mortar storefront, you would have insurance in case of an emergency, but you would also have locks on the doors. Having an online retail store is no excuse to skip this basic level of protection. Your store is a source of income, and you need to protect that income source against potential invaders. With a few simple steps, you can “lock up" your osCommerce store.
- Upgrade to the latest osCommerce online merchant package as soon as it’s available. Each update of the osCommerce package includes the latest security measures.
- Avoid third-party add-ons. osCommerce provides plenty of add-ons to enhance your site. Third-party add-ons can increase your risk of hosting vulnerable code on your site; if you do use code from third parties, you should always know where it comes from and how it's maintained.
- Don’t wait for an attack to happen. Keep an eye out for any unauthorized changes or users. You can also scan your website regularly with an online malware scanner or other security tool to make sure hackers have not breached your site’s security.
- Consider signing up for website security. Website security companies can have trained experts monitor your site for suspicious activity, increasing the chances you’ll catch malware before it becomes an issue.
-
Be proactive. This might include steps like:
- Changing the name of the osCommerce “admin” folder before launching your site.
- Choosing a difficult password that contains both numbers and characters to reduce the chance of a hacker figuring out your password.
- Not using the same password with osCommerce that you use on any other website.
- Deleting the “file_manager.php” and “define_language.php” files from osCommerce admin. According to osCommerce users, these files have known vulnerabilities.
If your site does get infected with malware, take it offline as soon as something bad is detected and clean it up. Detection tools and webmaster forums (such as BadwareBusters.org) can help you do this; if you subscribe to a malware protection service, they can help you clean up quickly.
If you are looking to try your hand at online sales, osCommerce and other e-commerce management systems can be good options. Your osCommerce site is only as good as its security; by keeping it secure, you protect both your revenue stream and your customers.
StopTheHacker is a security company whose suite of technologies are designed to keep websites safe. They are also a StopBadware Sponsoring Partner. For more information, visit www.stopthehacker.com.