3

I have a client that I developed a new site for, it's not live yet because he wanted me to backup the old site first. This was a completely custom "directory" type site and the company that built it (in 2003) I think, build every single module for it from scratch.

Naturally I start looking at the vast amount of folders located on the server, and what is inside of those folders. I noticed that there were some random character PHP files, and also random character files with the last part of the file name "php.jpg" and that struck me as odd.

Examining the PHP files it was very easy to figure out what kind of attach it was as the creator of the tool left his signature at the top and bottom of the files.

The image format files are what struck me as interesting, I assume they were put there as a fail-safe so if someone where to notice the infected PHP files, this attacker had a way to restore access by renaming the "image" format files.

So here's where I either got stupid, or just wanted to ensure that these image files might be legit and need to be backed up for the client. Big mistake. I opened one file, and Windows 10 Security Center instantly flagged it as an infection.

Here is the event log provided me regarding the threat.

Because it was a shared hosting account, with no Shell access, I wasn't able to install any linux based security tools, (clamav, rkhunter, etc).

What would you have done in this situation? Just back up the entire site, and leave the infections in the backup files, or go through and clean up the hacks?

4

With my developer hat on:

  • If the new site is "all new", including the OS, then I would not have investigated the hacked site. I would have chalked it up as a "past event".

  • If the new site was on the existing, unchanged server, after seeing the evidence of the hack, I would have rebuilt the server from scratch, and not bothered with understanding the details of the hack.

  • If the new site builds on top of the existing site, I would want to know the nature of the hack to determine how to proceed.

With my InfoSec hat on:

  • I would want to investigate the hack to see just how far it went and how much sensitive data may have been exposed and what on-going threat exists for the client. But that threat is informed by what data and what impact there would be if this server was hacked.

Short answer: you investigate to understand the scope of the threat and impact. If the scope doesn't matter, then there is no need to investigate (moldy bread is only a problem if you hoped to eat it, not if it is in the compost bin). But I imagine that there are things to be learned about the threats to your client, and I would investigate.

As for "cleaning up the hacks", I'm not sure of the value of doing that, but that depends on what you hope to do with the backup file. I would back up the site and tag it as having malicious files. If you hope to go into the backup files regularly, I might remove the obviously infected files.

  • Well, the new site is on totally new hosting built on a Wordpress. I didn't know what the client planned on doing with the old data and, well frankly, he didn't know either. He talked about giving the files to a partner of his to re-launch the directory site in another city. Obviously I billed the client for cleaning the site, and creating backups. – Chris Quinn Mar 2 '18 at 12:45
  • 1
    There was no data stolen, it appeared to be injecting ads into the site, and I think it was creating fake facebook profiles because there was directories on the site filled with "profile" pictures, and a lot of the code referenced facebook. I should also mention that most of the code was base64 encoded and I didn't spend any time decoding that. Thank you for your response, you answered my question perfectly and in two various roles that I am normally utilizing when dealing with a project like this. Most of what I did was out of curiosity. Had to add this 2nd comment. – Chris Quinn Mar 2 '18 at 12:45
  • 1
    2 things to note: 1) even hacks that "only" inject ads, they can also include persistence functions, which can dig into the OS to stay alive, 2) I hope the partner is sufficiently warned about the virus bomb the backup set is! – schroeder Mar 2 '18 at 12:54
  • The virus has been completely removed. There are no traces of it in the backup set. – Chris Quinn Mar 2 '18 at 13:45
  • Sounds like you found a basic web-shell - how are you certain no additional access has been added or code altered in the project to allow access. Have you addressed the vulnerability that allowed a web shell to be added? – McMatty Mar 3 '18 at 1:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.