1

Recently helped a friend after their website was hijacked via a compromised (and very simple) hosting and cPanel password.

The site was just static html and css, showing business hours etc and contact details. No accounts, personal data or anything really to target. The entire contents of the site remained, just with .old appended to everything, and a new index.php was inserted. For a few hours, this .php file (very obfuscated) appeared to redirect to a scam looking online shoe store. Within the two hours it was present, this consumed the entire 20Gb bandwith allocation, and the hosting was disabled.

Aside from simple denial of service due to the bandwidth being used, what is the purpose of such an attack? I could understand if a legitimate shoe store was replaced with a scam equivalent, but in this case there was absolutely no relation to the original site contents.

1
  • 1
    The fact that such a large amount of bandwidth was used makes me think that there could be more to this than you realize. It's unlikely that a simple redirect would consume this much bandwidth. Often sites are hacked so that they can be used to host large files (such as videos) which might contain illicit/illegal content. You might want to dig deeper to see what consumed so much bandwidth.
    – mti2935
    Sep 30, 2022 at 10:58

2 Answers 2

1

Things don't add up. A simple redirection php script is pretty straight forward and does not need obfuscation. Something else was going on and the redirection is probably either put there to mislead the postmortem analysis or is just a step to the whole thing that the script does.

There are four main reasons why computers (workstations/servers) are targeted:

  • Espionage: stealing critical info from the computer owner

  • Sabotage: disabling the computer, partially or on the whole, causing damage to the computer owner

  • Impersonation: using the computer as a steping stone to connect to another computer or device (pivoting or lateral movement)

  • Computer resources: they genuinely want to use the computer resources for their own purposes:

    (1) CPU: they need processing power e.g. for cryptomining or password cracking

    (2) Storage: they want to store data that they cannot (e.g. too big) or don't want to (e.g. illegal) store somewhere in their own computers

    (3) Network: they want to serve content that requires more bandwindth that they can provide (e.g. torrent site, DDoS zombie or - in the old times - an irc server)

As you can see, there's a lot more to consider in this case - especially if you realize that the server may have participated in illegal activities.

0

There is too much unknown about what the replaced site actually did. But hijacking an established domain with good reputation is a common way to bypass URL filtering. Such URL filtering in browsers and security product is often based on a) known bad URLs and domains and b) reputation for the others. Bypassing reputation based filtering thus allows delivery of malware, phishing etc to the user until the compromise is detected and reputation adjusted or site blocked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .