Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today I find out my website is infected with Trojan:JS/BlacoleRef.BV. The server is a shared server from a hosting company.

How does a trojan like this get on the webserver?

share|improve this question

4 Answers 4

up vote 5 down vote accepted

In your case it is likely the recent Plesk credentials leakage vulnerability, which has been mass-exploited to install Blackhole.

Plesk is always the first of the unwanted packages I uninstall on a new server. Trust my administration to a sack of random PHP? Don't think so...

share|improve this answer
    
I'm pretty certain this was the case. I haven't touched the website for weeks, and Plesk is installed. I couldn't even reach the provider by telephone, probably too busy answering calls from other clients... –  Corne Beukes Jul 14 '12 at 21:09

There are a whole bunch of ways:

  • Vulnerability in a webapp, allowing:
    • Upload and execute arbitrary binaries / code on the system.
    • Extraction of credentials that can be used to access other services.
  • Vulnerability in the server software (e.g. Apache / IIS / PHP), allowing the malware to execute arbitrary code on the server.
  • Vulnerability in the system software (e.g. Linux kernel), allowing remote code execution.
  • Cracking passwords for FTP / SSH / webapps.
  • Using default passwords on unconfigured / misconfigured servers.
  • Accessing openly available configuration files from misconfigured servers.
  • Malware on sysadmin's machine, stealing credentials.
  • Social engineering / phishing attacks being used to steal credentials.

All are equally possible.

share|improve this answer

As it was mentioned above, a lot of bots are trying to find vulnerabilities in your code or in your server services, which will be used to place malware code on your server.

However, this is not the only way. Very common practice is - malware on your computer. There are tons of FTP clients malwares which steal your credentials. In some cases, FTP passwords are stored as plain-text in configuration files - very easy stuff for malware.

So check your logs, check every files on your server, but also don't forget to run AV scan on your PC.

share|improve this answer

Mostly the Virus is placed there by some bots. They are always using other security holes like buggy web-applications to place the malware on a website.

You should check the whole site for backdoors and exploitable code if you find a virus on it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.