3

I'm almost certain my (new) client's wordpress site is hacked. The home page is fine, but every subdirectory on the page loads with very sketchy content seemingly injected into the page. But here's the kicker - it ONLY happens for users on AT&T LTE networks. All other network connections are completely unaffected and receive a completely non-hacked site. I have triple checked this. Even Sucuri is seemingly fooled by this (returning completely clean).

Some Details

  1. It happens on every known device, Android, iPhone, iPad, even laptops, so long as they are tethered to an AT&T LTE connection.
  2. If I take the SAME device and connect to WiFi and reload the hacked page, the original, non-hacked content returns.
  3. If I then get off Wifi (and onto AT&T LTE) and reload, and the entire page changes and I receive the hacked page again. All the while the URL stays the same. Verizon is unaffected.

I have access to the site registrar and host and everything seems a-ok in both places. DNS hasn't been changed. Additionally, the index page is fine, so I don't think it's a DNS issue. As I said, I've run sucuri checks (completely clean).

It's hard for me to understand what motivation a hacker would have to only target users on AT&T LTE, let alone how that would be pulled off. I realize that's broad and out of scope, but hopefully this question isn't: Assuming anything is possible, is this a probable hack? How can I determine if this is actually a hack, or something like a sneaky DNS Hijacking or caching issue? If it is hacked, what steps can I take to sniff this out and clean it up?

I'm happy to send the URL to anyone if you want to see for yourself, but not posting here for obvious reasons. I appreciate your help!

UPDATE: I marked an answer below since the answer covered both possibilities well, but for those wondering, this WAS a hack. I cleaned up the entire site systematically (everything but the DB) and the problem went away. Very interesting that the hack fooled Sucuri and all other scanners and only targeted AT&T mobile users.

Improve this question
2
  • 1
    This might be something similar to this (using cookies, not content though) eff.org/de/deeplinks/2014/11/verizon-x-uidh. Can you elaborate about the injected content?
    – nulldev
    Dec 11, 2017 at 8:33
  • This turned out to be a hack - cleaning up the site (installing newer versions of everything, cleaning everything out) made the problem go away. I have the hacked files still (on my machine) because I'm still curious. Somehow the hacker WAS targeting only AT&T mobile users. The hacked content was porn - seemingly injected right into the site itself (not a redirect, although not ruling out an iFrame). I don't have access to an AT&T device so I could never test on my machine.
    – timshutes
    Dec 12, 2017 at 0:50

1 Answer 1

Reset to default
7

Is the page server over https? If not it could be AT&T intercepting and injecting ads. See https://www.pcworld.com/article/2976298/websites/att-wi-fi-hotspot-caught-injecting-ads-into-web-pages.html where they are doing it on WiFi hotspots for http and https

As for the scenario were a hacker did this, a number of hackers try and restrict the set of people who see the malicious content to extend the time they are un-detected for. Targeting specific mobile carriers seems like it would not be worth the effort unless the attacker has a grudge against AT&T.

Improve this answer
3
  • 1
    A test one could do, is to connect to a VPN, using the AT&T LTE link. That could discriminate whether it is the site that targets AT&T IP numbers (which it won't know if it is connected from a VPN), or whether the mess is introduced by AT&T (willingly, or because they are hacked).
    – entrop-x
    Dec 6, 2017 at 4:56
  • I don't see anybody singling out every subnet of AT&T's mobile networks as a practical way of remaining undetected-- it's more straightforward to just randomly display it to 1 in 50 visitors. My money's on ISP injection; Comcast started doing this in the last few months as well. Enable HTTPS and be done with it.
    – Ivan
    Dec 11, 2017 at 19:38
  • weird though - this indeed DID turn out to be what happened. Perhaps the grudge idea David mentioned above? Or just chaotic evil (i.e. no particular motive other than to mess stuff up)
    – timshutes
    Dec 15, 2017 at 1:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .