WooCommerce - How to identify data leakage in website.

A

abhishekkjain

Member

Oct 7, 2019

81

44

18

• Nov 6, 2020

• #1

Hi,

I am running a woo commerce based shop and recently was reported that the new order placed at store were spammed. Interestingly I happen to use only official plugins or plugins from Babiato. I have SSH key added to my server and have some security in place within Wordpress. I am not seeing any suspicious admin activity. How can I investigate this? What can be done to mitigate the risk in future?

My concerns:

1. Some details are shared with payment gateways.
2. Shipping partner has access to read my store's data.
3. Having so many nulled plugin makes it difficult to track. Sorry for doubting Babiato.

Please suggest how to find the point of data leakage.

 

A

abhishekkjain

Member

Oct 7, 2019

81

44

18

• Nov 6, 2020

• #2

BTW by spammed, I meant people who placed order on my store got an email from a competitor's having same theme. They captured:

1. Name.
2. Email.
3. Address.
4. Some random order amount.

They had other details like product, cost and phone number missing. My concern is how someone got the sensitive data. I asked my friend also doing QA for site to check for spam emails and 2 of them got the same mail.

 

MrSam_1

Well-known member

Administrative

Trusted Seller

Dec 1, 2018

24,090

27,353

120

• Nov 6, 2020

• #3

abhishekkjain said:

was reported that the new order placed at store were spammed

Click to expand...

What do you mean by spammed?

 

MrSam_1

Well-known member

Administrative

Trusted Seller

Dec 1, 2018

24,090

27,353

120

• Nov 6, 2020

• #4

It doesn't seem like an issue of using nulled plugins but more like a programming issue for one of the plugins. As long as they don't intercept the full database.
My advice is to manually check all the plugins used related to ordering/newsletter/shipping and see which data is sent/available for each. Tho I might think is the shipping plugin as it have the name/email/address combo.

 

A

AaronLUFC

New member

Dec 12, 2019

9

12

3

• Nov 7, 2020

• #5

abhishekkjain said:

What can be done to mitigate the risk in future?

Click to expand...

Don't use nulled plugins on websites that process sensitive information, you're asking for trouble.

 

A

abhishekkjain

Member

Oct 7, 2019

81

44

18

• Nov 7, 2020

• #6

slvrsteele said:

What do you mean by spammed?

Click to expand...

Clients are getting fake emails for orders placed on another site that they don't recall signup up to. I did a forgot password request to that site and there was no user registered on the customer's mail id. This happened with 3 customer emails...

I am checking all the plugins one by one...

 

A

abhishekkjain

Member

Oct 7, 2019

81

44

18

• Nov 7, 2020

• #7

AaronLUFC said:

Don't use nulled plugins on websites that process sensitive information, you're asking for trouble.

Click to expand...

Hmm, that would cost me 10x of Shopify! So want to avoid till I start making good profits.

 

M

mercyyou

Active member

Jul 19, 2020

153

67

28

• Nov 7, 2020

• #8

There's no issue with nulled plugins, as long it does not contain malicious codes. VirusTotal is pretty good at identifying this.

I heavily recommend Wordfence "Live Traffic" feature for log capture, it the best application firewall I've seen, for this. Now, you would have to manually block bad IPs traffic in "Live Traffic" and again permanently under it "Blocking" menu. Use abuseipdb.com for reviewing IP reputations. Cloudflare offers $20 month WAF (web application firewall), which I would recommend as a second layer. If you have the means, you can forgo the application firewall (if it not required for compliance in the industry you serve (such as PCI) for a firewall in front of the server that host your wordpress. Some enterprise hosting and cloud platform providers (AWS/GCP/Azure) offer them.

Feel free to ask any questions.

 

frizzel

Well-known member

Trusted Uploader

Jun 13, 2019

485

253

63

Wherever my imagination takes me

• Nov 8, 2020

• #9

It's not exactly what you reported happening on your site, but WooCommerce has patched a vulnerability that allowed bots to create fake accounts and place fake orders. The bug has been patched in version 4.6.2 which was released last Thursday.

More info and how to deal with already created fake accounts is here: https://wptavern.com/woocommerce-pa...owed-spam-bots-to-create-accounts-at-checkout

 

K

KoolPal

Member

Apr 15, 2019

82

37

18

• Jan 30, 2021

• #10

I saw this randomly too and I suspect shipping data is getting leaked by vendors. Do continue to investigate though.