Scripts(iframes and javascript) being added to site

Question

My website is being hacked. iframes and JS is being added even after I have been manually searching for and removing them for the past couple of days. Why is this happening and what can I do to prevent it?

I have set all index files to permission 444 and most other files to 644. There are a few pages that have flash content being added to them and these files seem to need a more relaxed permission setting(755).

The files are mostly PHP files. I am reviewing the PHP code right now for any vulnerabilities. Is there anything specific I should be looking for and what should I be doing on the permissions front?

Answer 1

did you upgrade version on your server ? like if u have debian ...(mysql ,php ,apache)

a lot of security update need to done automaticly.

did you use only your code or use other framework or code that maybe have bugs.

Answer 2

Do you allow user submitted content (such as comments to a blog)? Check to make sure the data submitted is properly cleaned of dangerous content such as script tags and the like. Ideally, you will use a format like MarkDown that is converted to HTML for display but contains no dangerous tags itself.

Answer 3

We recently came across a problem like this where someone had uploaded some code to a shared server which was resulting in our client's web site being infected. We moved their web site to our servers and this problem was fixed.

Answer 4

There are so many things that could have happened. Someone somehow sneaked in something that was eval()ed via a parameter, an external script that was executed. Maybe while transferring something to your site via ftp someone sniffed your password and this list goes on forever... I would suggest taking the website offline, checking the logs and compare them with the timestamp of the files that were changed/last created. If he had access to your php files, most certainly he took a mysql dump with him. I think you need to change all user passwords and maybe inform the users. In a shared environment with bad security checks he could have even used a security hole in another site. In any case you should check with your sysadmin.

By the way changing permissions will often not alter anything. The attacker can simply change them back, if he has already snaked in something.

Which software are you using, something self made?