Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was recently asked to help make a few modifications to an old ASP Classic website.

At one point I was looking at the page source while debugging some JavaScript and noticed a div full of links to a few spam-like sites selling knockoff handbags and shoes etc! This div was absolutely positioned over 900 pixels off the top left corner, so it was never visible, and it wasn't until I looked into the source code that I noticed it was there at all.

The div itself was in a header file located inside an include subfolder. As far as I can tell, having just taken the site over, no code modifies this file at all.

Does this mean the web server itself had to have been compromised in order for someone to insert these links?

It seems if that was the case, then whoever did it had to have had some knowledge of how the site worked? Or maybe they just searched for files called 'header'? Although, there is a separate header file for the admin side of the site and that was not modified.

I guess the other possibility is that the old webmaster inserted the links themselves for some personal gain but that seems unlikely.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

I agree that the most probable cause is a compromise from the outside - a classic case of link farming.

It may be out of scope for your contract, but after fixing the production site, you should go back through the backups until you can find the modification, and then see if you can figure out how the compromise occurred.

If you can't be sure how it occurred, consider rebuilding the server from known good sources, which is the only reasonably reliable way to close any backdoors that the intruders may have left behind.

share|improve this answer
    
Thanks for your answer. The previous server was owned/run by the previous webmaster. When I took over I moved the site to a shared hosting provider, so hopefully they will have decent security in place! –  user12199 Mar 1 '13 at 3:59
    
In regards to how/when it may have happened, I did not have access to any backups but I was able to go through archive.org and work out that it was inserted sometime towards the end of 2011. So it had been there for a while! I even (carefully) visited a couple of the links, only to find they'd been taken down due , with an official notice about selling counterfeit items. –  user12199 Mar 1 '13 at 4:03
add comment

This kind of attack where spam links are inserted into page content will usually target a particular technology whether that is the site platform eg. Wordpress or a plugin used on the site for instance an image gallery or file upload script. By targeting a specific vulnerability in a widely used script an attacker can compromise enough websites to make the attack worthwhile.

Rebuilding the site from a known clean backup is the only way you can really be sure that you have repaired all of the damage. Then you will need to identify how the site was compromised in the first place otherwise it will almost certainly happen again. The most likely culprit will be scripts that allow users to upload files as if these could potentially be exploited to allow a malicious script to be uploaded and run.

Another possibility, if the website has been hosted on a server with one or more other sites , is that one of those sites was compromised and that giving access to the server and therefore your site. Hosting the site with a shared hosting company isn't necessarily going to protect you from that vector. Even some of the really big shared hosting companies can be pretty sloppy when it comes from protecting your site from others hosted on the same server.

share|improve this answer
    
Thanks for your input. The site is using an ancient CMS that no longer appears to be supported by anyone. It looks like it had a few known vulnerabilities too! I'll probably end up re-writing the site from the ground up sometime in the future. –  user12199 Mar 7 '13 at 2:08
    
I believe the previous server was a shared setup also, but run by the previous webmaster for all of their customers so I'm sort of making the assumption that it probably wasn't looked after very well. That is why I'm guessing that even though the site is still in shared hosting, the fact that this provider is active in maintaining their servers should provide some extra protection. –  user12199 Mar 7 '13 at 2:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.