SecuritySmash Security: File Integrity Monitoring (Pro)

Detect Unauthorized File Changes

File Integrity Monitoring (FIM) tracks changes to critical files in your OpenCart installation. This Pro feature helps detect malware injections, unauthorized modifications, and security breaches.

Why File Monitoring Matters

Hackers often inject malicious code into:

• Checkout pages (to steal payment data)
• Controller files (to create backdoors)
• System files (to gain persistent access)

FIM alerts you when any monitored file is changed, added, or deleted.

Enabling File Integrity Monitoring

1. Ensure you have an active Pro license
2. Go to Extensions > Extensions > Modules
3. Edit "Smash Security + Admin Protection"
4. Navigate to the File Integrity (Pro) tab
5. Enable "Integrity Monitoring"

Configuration

Directories to Monitor

Specify which directories to track (one per line):

catalog/controller
admin/controller
system

Recommended Directories:

• catalog/controller - Frontend logic including checkout
• admin/controller - Admin panel functionality
• system - Core OpenCart files
• extension - All extensions (optional, creates many entries)

Running Scans

Initial Baseline Scan

Click "Scan Now" to create an initial baseline of all files. This records:

• File path
• SHA-256 hash (content fingerprint)
• File size
• Modification time

Subsequent Scans

Future scans compare current files against the baseline and report:

• New files: Files that didn't exist before
• Modified files: Files with changed content
• Deleted files: Files that no longer exist

Understanding Scan Results

Expected Changes

Not all changes are malicious:

• After installing/updating extensions
• After OpenCart updates
• After making legitimate customizations

Re-run the scan to update the baseline after legitimate changes.

Suspicious Changes

Investigate immediately if:

• Changes appear when no updates were made
• Checkout or payment files are modified
• New .php files appear in upload directories
• System files are changed

Alert Integration

When combined with Security Alerts (Pro), you'll receive notifications when file changes are detected:

• Email alerts
• Webhook notifications (Slack, Discord)

Best Practices

• Run an initial scan right after installation
• Schedule weekly or daily scans (via cron)
• Always re-scan after legitimate updates
• Investigate unexpected changes immediately
• Keep backup of clean files for comparison