6

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse proxy as the web server set up. I'm hosted on an Azure-powered virtual machine, with the Debian-based Ubuntu 14.04 lts as the OS. Lastly, note that the web application and the server sit on two separate virtual machine instances.

I suspect my servers might be compromised - I'm at the data-gathering stage where I'm ascertaining whether (i) indeed my servers are compromised (ii) whether my data is compromised too (iii) how did the compromise happen, so that I don't get hacked again.

In Django applications, there's a base.html file that all other .html files inherit (or extend in Django). This base.html file contains the <head> tag with required meta tags etcetra, so one doesn't have to replicate it in every template file.

My base.html file has some javascript code in it that I did not write. In fact, I don't use javascript in my code at all. This malicious javascript snippet redirects my users to adverts (it's a money making hack). If I log into my web application's production server and nano to the base.html file (i.e. open it in a text editor), the offending snippets of javascript do not appear there.

Secondly, when I inspect element on my live website (browser: Firefox), I see an ev button next to the collapsed tag of my website:

enter image description here

This is apparently an events button to debug JS in Mozilla's code inspector. If I press it, I see:

enter image description here

I'm unsure what's :37 (port 37?). Moreover, if I press the pause (debug) button in front of click, I am taken to one of the JS snippets residing in my base.html code:

enter image description here

My confusion is regarding how can these JS snippets be part of my live website when the files in my production server appear to be without them?

I'm guessing finding the source of the hack would require going deeper into this. I haven't installed SSL yet, but I suspect my problem can't be helped by that. This is a two-person project - and the other person is a non-techie, cultural anthropology major specializing in South Asian studies, so I'm sure she has nothing to do with it.


I have set rules.v4 for iptables to:

*filter
# Allow all outgoing, but drop incoming and forwarding packets by default
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Custom per-protocol chains
:UDP - [0:0]
:TCP - [0:0]
:ICMP - [0:0]

# Acceptable UDP traffic

# Acceptable TCP traffic
-A TCP -p tcp --dport 22 -j ACCEPT
-A TCP -p tcp --dport 80 -j ACCEPT

# Acceptable ICMP traffic

# Boilerplate acceptance policy
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT

# Drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP

# Pass traffic to protocol-specific chains
## Only allow new connections (established and related should already be handled)
## For TCP, additionally only allow new SYN packets since that is the only valid
## method for establishing a new TCP connection
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
-A INPUT -p icmp -m conntrack --ctstate NEW -j ICMP

# Reject anything that's fallen through to this point
## Try to be protocol-specific w/ rejection message
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable

# Commit the changes
COMMIT

*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
1COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*security
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
  • 2
    And the adverts are not placed there by the hosting company? – schroeder Feb 16 '16 at 15:38
  • It depends how the attack, if an attack, is being performed, this could be django I have never used it so cannot be sure. though it is waiting for you to press a key? by the looks of it... if this is an attack then SSL could stop it depending on the type of attack.... though as said previously this could be ads. I would need to see your site. The way SSL would stop an attack like that is by not allowing interception and modification. though its starting to look more and more like ads – TheHidden Feb 16 '16 at 15:40
  • Are there any <script tags at all in your header file? – That1Guy Feb 16 '16 at 16:12
  • @schroeder: yes, the hosting company never placed ads there. @That1Guy: I never put any script tags, but I see a ton of them in my header file now. A few are legit (new relic, google analytics), but most are some kind of ad-related script tags that I never put. @silverpenguin: Yes, I'm just trying to get as much information right now as possible. It was flagged in my previous ques that my servers might be compromised. So I'm now quite confused about why my files on the production server aren't defaced, but those being served are. Your SSL theory does make sense to me. – Sarah Micj Feb 16 '16 at 16:42
  • Do you see those snippets when looking at the originally-sent html source? That is, what's sent by the server, before javascript has had a chance to muck with the dom? I think Firefox's view source will show that, but curl certainly will. – Xiong Chiamiov Feb 17 '16 at 2:15
1

The code you have pulled out of their page is New Relic Browser monitoring. This is Javascript which lets the website track the performance of pages for their live sites and for the customers using it.

It provides performance data back for how long the page took to load, where in the world you are from and time each element loading to show where any degraded performance may be.

You can find out more information about this product at http://newrelic.com/browser-monitoring

  • Google Analytics and New Relic snippets are indeed there. But also snippets referring to adperformancenetwork, visadd, etc. – Sarah Micj Feb 17 '16 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.