How can someone physically change a javascript file? It's completely locked down and i've no idea how someone would be able to do this through a web browser.
Rob
+2
A:
Phished / Hacked your ftp credentials..
Obtained root credentials by exploiting database vulnerabilities etc etc..
Do not focus on the actual altered file (that is the payload distributor, if the changes were malicious) but focus on how the gained access on the server..
Gaby
2010-09-27 14:32:54
Thats can't be it. It's on a webserver thats got about 100 sites and only one sites got the javascript code in it. The site hasn't been updated in over 6 months but the hack happened Friday.
Robert
2010-09-27 14:35:14
A lot of trojans these days mine passwords from popular FTP apps like filezilla (which store your passwords in a flat text file). Passwords that can be linked to a domain name will be explioted to spread the trojan further.
Powertieke
2010-09-27 14:36:58
+1 Powertieke. This is the most common source of compromise today. You need to check any machine that has accessed your FTP with multiple anti-virus scanners. And if they find infections or AV has done in the past you need to reinstall that box, because AV is not reliable at removing today's trojans. Also, move to SFTP, it's the 21st Century after all.
bobince
2010-09-27 14:43:48
+1, extending on @Powertieke comment, do not use FTP clients that store passwords in plain text.. Either turn filezilla to kiosk mode, so that it does not store passwords, or use another client like WinSCP (for windows)
Gaby
2010-09-27 15:07:24
@Robert, in regards to your comment, it could very well be that the FTP credentials to this specific domain where compomised by the reasons stated in the comments or otherwise..
Gaby
2010-09-27 15:08:45
+1
A:
(1) With shared hosting, it could be from anyone's account (if you don't have security set correctly, or if any of them are administrators).
(2) Anyone who has access to the server (hardware admins, software admins, server owner etc, if you're renting)
(3) Any compromised script you're using - including your own, or pre-made ones. Form-mailer scripts are often cracked (usually due to lack of escaping on inputs). Anything that calls system commands or inserts into SQL without escaping input can be susceptible.
(4) If your credentials have been compromised - email and ftp are sent plain-text, it's easy enough to sniff the username/password if it's the same one as you use to access the server (especially if you log in from shared networks - computer labs, school or work networks).
(5) Trojan or malicious software on your machine logging keystrokes or decoding passwords decoded from internal storage.
Someone with knowledge of the JS file, and some guesses at where it's stored can easily start messing around with it through a cracked script (#3). The other ones are pretty self explanatory :)
Rudu
2010-09-27 14:33:29