Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

At this moment I am being hacked and I do not know to stop it. Let me explain...

My website is hosted in a VPS where I am the only person who has access to it. The page is builtwith Codeigniter(updated), and Doctrine (updated too). Once I browse to at index.php I see this code in source:

<!--
    top.location="http://pagesinxt.com/?dn=eqtisad.u13.biz&fp=uG6gKivovi4x8JjEAROV%2FTKBtIWD%2Blle7UNutYwxGdAyGVrZoBm5Bekjw2z7vZmvYE9r56BxR%2FdwKJnOW1e8aQ%3D%3D&prvtof=3um92iAJbFQD4ie3mqlX9yNOXQElLxUpPsdwROXtIXk%3D&poru=8V8ohaa543uO%2BrtgyMrGBIAkgU2lu1ckclS6TcL72%2BnBM2%2BYG73v%2FyLI9ZhKVjCGL2w0E5BxYal2xKLR2ERsB3mlhGebCpkQgGj4df%2BIkrc%3D&cifr=1&flrdr=yes&nxte=gif";
    /*
-->
<script type="text/javascript">
    <!--
    dimensionUpdated = 0;
    function applyFrameKiller()
    {
        if(window.top != self)
        {
            cHeight = 0;
            if( typeof( window.innerHeight ) != 'undefined' ) {
            //Non-IE
            cHeight = window.innerHeight;
            dimensionUpdated = 1;
            } else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight )  ) {
            //IE 6+ in 'standards compliant mode'
            cHeight = document.documentElement.clientHeight;
            dimensionUpdated = 1;
            } else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {
            //IE 4 compatible
            cHeight = document.body.clientHeight;
            dimensionUpdated = 1;
            }
            if( cHeight <= 250 && dimensionUpdated == 1)
            {
                window.top.location = "http://pagesinxt.com/?dn=eqtisad.u13.biz&fp=uG6gKivovi4x8JjEAROV%2FTKBtIWD%2Blle7UNutYwxGdAyGVrZoBm5Bekjw2z7vZmvYE9r56BxR%2FdwKJnOW1e8aQ%3D%3D&prvtof=H4TY0TTX3NzJR65BWTqd5iL%2FuG%2FrWNlJRpGGD7lLlAI%3D&poru=VPQxzhVHETonB83RBOqqTOJMW1rvUm850o6RD0TzdI6oyXwlzAeOG%2FK17FifSzcxHolUxHDNgpTE%2BnRQSwqPDCIL8FKABEYRdUxAEcBGi8s%3D&cifr=1&flrdr=yes&nxte=gif";
            }
        }
    }

    applyFrameKiller();
    // -->
</script><frameset rows="100%,*" frameborder="no" border="0" framespacing="0">
    <frame src="http://pagesinxt.com/?dn=eqtisad.u13.biz&fp=uG6gKivovi4x8JjEAROV%2FTKBtIWD%2Blle7UNutYwxGdAyGVrZoBm5Bekjw2z7vZmvYE9r56BxR%2FdwKJnOW1e8aQ%3D%3D&prvtof=QNdLHvfpmQDcCjmfkLp0UoTOm9%2FlbsSY5zwRjXbMEDs%3D&poru=ZFDh3zFdBl8oLoFKYzmbIrndO0AsgI5yGs9la3B3DvUnOwJwZj4aeWo5bo5PRkvlGhqLFIwXyhV4DxStH7tHRS%2FbB902y5I8kPm7LLxSgJ0%3D&flrdr=yes&nxte=gif">
</frameset>
<noframes>
    <body bgcolor="#ffffff" text="#000000">
    <a href="http://pagesinxt.com/?dn=eqtisad.u13.biz&fp=uG6gKivovi4x8JjEAROV%2FTKBtIWD%2Blle7UNutYwxGdAyGVrZoBm5Bekjw2z7vZmvYE9r56BxR%2FdwKJnOW1e8aQ%3D%3D&prvtof=DFirIGqMqM7SgRb4jbom9x%2FWLKk2BsDoNNUAtuffLcM%3D&poru=h4Hln0ENUyIUaYgUi37Z6zIj6%2FYWgvyln3NWEddNbSBI1tQexg46ZMAGiZ0lsT6C4pkl6AcLCw9x0J6hZhJcNgm04ONcuO4STG69vF4Nue8%3D&flrdr=yes&nxte=gif">Click here to proceed</a>.
    </body>
</noframes><!--
*/
-->

Somethings that I do not understand

  • If a open the index.php the code is correct (original code), so.. how is possible to see the code above in the browser, but by ftp the file is ok?

  • I have never been attacked before, so, what should be the first guidelines to review? what should be a correct troubleshooting in order to find/minimize the hole security?

  • (Here I am getting most confused). This hack is intermittent, because when I press F5 the hack disappear for 2 or 3 minutes, but it comes back again! I am very scared :(

share|improve this question

1 Answer

up vote 4 down vote accepted

If the script appears in the source for the page, but when you look at the source for the page on the server you aren't seeing it, one of several things could be happening.

1) It could be your computer that is infected with malware, and not the server, and the injection is coming from something running on your computer.

2) The injection is coming from an external file referenced by the page, such as a server side include, or an external JavaScript file that is writing the malicious code.

3) The injection could be coming from somewhere else in the response process, like a response filter that modifies all response streams before returning them to the client.

A quick search tells me that others have seen similar malware being delivered via an external JavaScript reference, so that is the first place I'd look. See if you page is referencing any JavaScript files that contain any code you don't recognize or understand. It likely will be obfuscated, and so will not look like what you see in the page source.

share|improve this answer
Other search results seem to indicate that this may be ad-ware, so it may well be on your machine, and not your server at all. – Xander Mar 10 at 0:04
Yes, recent search has showed that could be virus. But the most import thing here is your description letting me know that in scenarios as mine the injection is comming outsite of my server! Good point! – manix Mar 10 at 0:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.