Magento Corediff
A forensic tool to quickly find unauthorized modifications in a Magento 1 or 2 code base. Corediff compares each line of code with a database of 1.7M legitimate code hashes and shows you the lines that have not been seen before. A bit like @NYT_first_said.
"Corediff saved us countless hours"
"Very useful to gauge foreign codebases"
Corediff was created by Sansec, specialists in Magento security and digital forensics since 2010. Corediff analysis helped us to uncover numerous cases of server side payment skimming that would otherwise have gone undetected.
Usage
Usage:
magento-corediff [OPTIONS] <path>...
Application Options:
-d, --database= Hash database path (default: download Sansec database)
-a, --add Add new hashes to DB, do not check
-m, --merge Merge databases
-i, --ignore-paths Scan everything, not just core paths.
--no-cms Don't check for CMS root when adding hashes. Do add file paths.
-v, --verbose Show what is going on
In the following example, Corediff reports a malicious backdoor in cron.php
:
In default mode, Corediff will only check official Magento paths. In order to find these, you should point Corediff to the root of a Magento installation.
Alternatively you can scan all files with the --ignore-paths
option. NB this will produce more output and requires more interpretation by a developer or forensic analyst.
Installation
Use our binary package:
curl https://mageintel.com/ecomscan/corediff -O
chmod 755 corediff
./corediff <magento_path> | less -SR
Or compile from source (requires Go 1.13+):
git clone https://github.com/sansecio/magento-corediff.git
cd magento-corediff
go run . <magento_path>
At the first run, corediff
will automatically download the Sansec hash database (~26MB).
Community contributed datasets
@fros_it has kindly contributed hashes for his collection of Magento Connect extensions, including all available historical copies. Download the extension hash database here (62MB) and use it like this:
Contributing
Adding or maintaining hashes?
# Create or update custom.db with all hashes from `<path>`.
corediff --database=custom.db --add <path>
# Merge databases for release
corediff --database=all.db --merge magento1.db magento2.db *.db
In some cases, it is better to not add file paths to the hash database. All paths found in the database will be examined and reported in default mode. Should many varieties exist for a particular file (such as in DI/compiled code), we would rather exclude its scanning from default output, until we can be reasonably certain to have coverage for 99%+ versions out there. So for volatile paths, use the --add --ignore-paths
options.
Contributions welcome! Naturally, we only accept hashes from trusted sources. Contact us to discuss your contribution.
About Sansec
Sansec's flagship software eComscan is used by ecommerce agencies, law enforcement and PCI forensic investigators. We are proud to open source many of our internal tools and hope that it will benefit our partners and customers. Malware contributions welcome.
(C) 2020 Sansec BV // info@sansec.io