2

We have a client that does business with this company and recently we noticed our Barracuda blocking their e-mails based on Intent Analysis. Further investigation showed that it was because of a URL embedded on their home page. (Their home page is linked in their signature.) I couldn't find the URL anywhere on the site, so I inspected the HTML code. This is what I found.

Sketchy Javascript and HTML

Here's what I gathered with the limited knowledge I have on Javascript and HTML.

  • This code was appended to the end of the html file.
  • It's not google ads, it's a static hyperlink.
  • There is JavaScript calling the HTML element by gluing together a string along with a little addition. Red flag.
  • The JavaScript is telling it to be hidden from the client by gluing "no"+"ne" together. Red flag.

To me, this looks like a persistent XSS attack. Maybe a ploy to generate Ad Revenue? I'm thinking the string fun is to avoid pattern detection.

I sent it to their IT department. (Not sure if they will be able to fix this.)

Any insights on this?

EDIT: Found some more scripting at the beginning of the file. This actually changed the title of the domain in search engines.

enter image description here

Improve this question
2
  • It'd be nice if you could include code snippets as text instead of screenshots.
    – Arminius
    Commented Feb 11, 2017 at 2:07
  • Sorry, I wasn't too sure on the policy for posting questionable code. I'll be sure to include that next time. Thanks!
    – w21froster
    Commented Feb 13, 2017 at 15:38

1 Answer 1

Reset to default
1

The first bit of code shows a spam link and then some JS to conceal it, so it will give the spam site a SEO boost while remaining invisible to the admin (as far as I know search engines still don't interpret JS, so to their eyes this link is always visible).

The second link completely redirects the user to a spam website in the event that they are coming from a search engine, based on their referer. An user reaching the page directly (like the admin) will not get redirected and won't notice this. They seem to be targeting the Japanese versions of those search engines which gives a clue as to where the malware originated from (or who paid for those spam links to be placed there).

I would bet good money they are using an awful CMS and got compromised. Simple as that.

Improve this answer
2
  • I was wondering how the code could get there and I kept thinking of a compromised web server, but a compromised CMS seems more likely. Thanks for the insight!
    – w21froster
    Commented Feb 11, 2017 at 0:57
  • aside: google has run js on its robots/spiders for a long time, principally to crawl js-based navigation, but it has to run all code to "boot up" those navs...
    – dandavis
    Commented Feb 14, 2017 at 7:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .