Hello,
We recently engaged a third-party company to do some needed customizations on our account. Unfortunately, the engagement did not proceed as expected.
As a precaution, we have already revoked their access to our Odoo environment and all related systems, changed all passwords, and reviewed user permissions. However, we remain concerned about the possibility that they may have implemented unauthorized modifications, hidden administrative accounts, backdoors, custom code, scheduled jobs, API integrations, or other mechanisms that could allow future access or negatively impact our operations.
We would appreciate your guidance on the following:
1. What risks should we realistically be concerned about in this situation?
2. What steps can we take to verify that our Odoo environment is secure and free from any unauthorized access mechanisms?
3. Are there specific audits, logs, security reviews, or code inspections that you would recommend?
4. Would creating a completely new Odoo instance and migrating all data and customizations to it eliminate these risks, or could vulnerabilities be transferred as part of the migration?
5. Are there any additional best practices we should follow to ensure the integrity and security of our system going forward?
Hello
This is a serious situation, and your proactive steps—revoking access, rotating credentials, and reviewing permissions—were exactly the right first moves to contain the immediate risk.
Realistic Risks to Consider:
-> Hidden lines of code (in custom modules) that create new administrator users or allow remote command execution.
-> Malicious automated tasks that periodically exfiltrate data, delete logs, or create new unauthorized users.(schedule actions)
-> New endpoints created to transmit data to an external server.
-> Users created with low-privilege names that have hidden "Superuser" or "Administrator" access rights.
-> Code designed to subtly alter accounting entries, inventory counts, or pricing at a future date.
Let me know if you need any help on this
I'm happy to help you in this situation.
Thanks