5

Today I find out my website is infected with Trojan:JS/BlacoleRef.BV. The server is a shared server from a hosting company.

How does a trojan like this get on the webserver?

5

In your case it is likely the recent Plesk credentials leakage vulnerability, which has been mass-exploited to install Blackhole.

Plesk is always the first of the unwanted packages I uninstall on a new server. Trust my administration to a sack of random PHP? Don't think so...

  • I'm pretty certain this was the case. I haven't touched the website for weeks, and Plesk is installed. I couldn't even reach the provider by telephone, probably too busy answering calls from other clients... – Corne Beukes Jul 14 '12 at 21:09
3

There are a whole bunch of ways:

  • Vulnerability in a webapp, allowing:
    • Upload and execute arbitrary binaries / code on the system.
    • Extraction of credentials that can be used to access other services.
  • Vulnerability in the server software (e.g. Apache / IIS / PHP), allowing the malware to execute arbitrary code on the server.
  • Vulnerability in the system software (e.g. Linux kernel), allowing remote code execution.
  • Cracking passwords for FTP / SSH / webapps.
  • Using default passwords on unconfigured / misconfigured servers.
  • Accessing openly available configuration files from misconfigured servers.
  • Malware on sysadmin's machine, stealing credentials.
  • Social engineering / phishing attacks being used to steal credentials.

All are equally possible.

2

As it was mentioned above, a lot of bots are trying to find vulnerabilities in your code or in your server services, which will be used to place malware code on your server.

However, this is not the only way. Very common practice is - malware on your computer. There are tons of FTP clients malwares which steal your credentials. In some cases, FTP passwords are stored as plain-text in configuration files - very easy stuff for malware.

So check your logs, check every files on your server, but also don't forget to run AV scan on your PC.

0

Mostly the Virus is placed there by some bots. They are always using other security holes like buggy web-applications to place the malware on a website.

You should check the whole site for backdoors and exploitable code if you find a virus on it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.