Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm not sure where to ask this Question - here, SO, Webmasters.SE, somewhere else? Please migrate if appropriate.

tl;dr:

The following rule in my .htaccess is causing Sucuri's free online scanner to report my site as infected with:

"Known javascript malware" - Location: http://my-subdomain.cu.cc/404testpage4525d2fdc/ ("my-subdomain" is not my real sub-domain).

Here's the rule:

RewriteRule ^([^\.]+[^/])$ http://%{HTTP_HOST}/$1/ [L]


Question

Is there anything inherently wrong with my RewriteRule, am I somehow "doing it wrong"? Or, is this just much ado about nothing?


Background

I'm using that RewriteRule to add a slash to any URL's that don't have a trailing slash - except URL's pointing to a file, e.g., index.php, myfile.html, etc.

It's very consistent and reproducible...if I comment out that rule and rescan, it's clean; re-enable, flagged again...ad nauseum. I can think of three possibilities (though I'm sure there are more):

  • a flaw in their scanning process;
  • something inherently wrong with that RewriteRule;
  • Sucuri is trying to drum up business from the unsuspecting; (Author edit)

In my .htaccess I also have:

RewriteCond %{HTTP_HOST} ^(www.)?mydomain.com$ [NC]
RewriteRule ^(.*)$ /mydomain/$1 [L]

That rewrites any requests to mydomain.com to a sub-directory of my public root (which I'll just call root, for brevity's sake). This is needed because I have a shared hosting account that allows unlimited domain addons, but they all must point to root. Those two lines are replicated 7 other times, all rewriting different domains to different sub-directories.

Finally, I have:

#block access to .inc files sitewide
<Files ~ "\.inc$">
  Order allow,deny
  Deny from all
</Files>

That one should be self-explanatory. Prior to my scan, I had only one file in root - .htaccess. Everything else is in sub-directories - each sub-directory is dedicated to a different domain, hence my RewriteRules.

After reading some threads re: WordPress malware problems, I decided to run their scanner and check my site. So I created a dummy index.php in root, shown here in its entirety:

<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Untitled Document</title>
</head>
<body>
Root!
</body>
</html>

I used one of my unused freebie CU.CC sub-domains to use with their scanner. That sub-domain is not in my .htaccess, so it automatically points to root.


Edit

This is the error page for http://my-subdomain.cu.cc/404testpage4525d2fdc/

Not Found

The requested URL /404testpage4525d2fdc was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Apache Server at anchorage.cu.cc Port 80

share|improve this question
add comment

4 Answers 4

Interesting, just read the background. I assure you has nothing to do with drumming up business. We have no need to do that. If you send us your info at info@sucuri.net we'll see if we can't better understand what is going on.

The 404testpage is a test page we emulate to see output of a page when we can't pinpoint the issue but we can see the payload.

I am more interested on what is below the testpage. Do you have more information you can share? I wonder, the 404test page, below it, does it say 500 error or website disabled? Or something equivalent?

It might be that the scanner is being blocked.

Thanks

share|improve this answer
    
Thank you, Tony. I'd already sent an email to support@sucuri.net, but I just forwarded a copy to @info. It's nearly identical to My Question, except with a screenshot of your infection warning. I've edited my Question with Apache's 404 error message. And please don't take my statement about "drumming up business" personally, I just included it as a possibility, since I know almost nothing re: Sucuri. No offense intended. :) Also, the test finishes instantaneously - I assume since my index.php has no links for your test to spider. –  akTed Jan 24 '13 at 7:09
add comment

What do you get when you go to the "infected" URL? Is it an empty page or error page or something like that? Served with a "200 OK" response?

If so I would imagine that the scanner is expecting a "404 Not Found" error status code in the response, and complains about any other status. You could write that up as a false positive, or consider returning 404 for whatever the resource is. If you're not returning real content for the URL "/404testpage4525d2fdc/" then, yes, it should probably be 404.

I don't see any interaction with your RewriteRule. The scanner is complaining about the path that already has the "/" at the end, so that's not going to get rewritten.

Is there anything inherently wrong with my RewriteRule

For taking match groups from paths you might use the [B] flag, so that any special characters included as %xx sequences decoded in matching the rule come back out re-encoded instead of mangled.

And I'm not sure why you need the rewrite - the trailing slash redirect issue is usually handled automatically by mod_dir.

But I don't think it's anything to do with this problem.

share|improve this answer
    
Thanks, bobince. I edited my Question with the 404 error page output by Apache. Re: the RewriteRule, see my Question posted in Webmasters.SE for the reason it's necessary. –  akTed Jan 24 '13 at 7:02
add comment

We are reporting that site because something is redirecting your traffic to the domain when its visited. Has nothing to do with the htaccess file rule you referenced. Something is hijacking your traffic.

Cheers

Tony w/ Sucuri

share|improve this answer
    
I forgot to welcome you to SE...welcome. :) Just an FYI, you can edit your Answers (or anyone else's, for that matter), so instead of creating multiple Answers, you can amend your existing one as needed. BTW, thanks for your attention to this, very much appreciated! –  akTed Jan 24 '13 at 7:16
add comment

This is definitely a cheap trick by Sucuri to create fake insecurity threat and drum-up business. This is exactly the case and error with same http://mydomain.com/404testpage4525d2fdc security warning for a page which does not exist on my website. Also, what makes things more suspicious is the fact that unlike EVERY other such service they do not have a "False Alarm" reporting form/webpage.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.