0

Recently my Drupal site on a Linux server has been targeted by session hijacking attacks. I guess the attacks were originated from images containing malicious code which where uploaded to the web root because I have found some of the crafted images by looking at uploaded files. So I am wondering how best to find all those images?

  • Images or html tags to images? Look through your web data to find img tags with CSRF code. – schroeder Jan 21 '14 at 2:34
  • I mean images (.jpg, .gif, etc) – hnn Jan 21 '14 at 2:50
  • How can an image compromise a system (except exploiting bugs in the rendering software)? What is an image with malicious code exactly for you? – Samuel Jan 21 '14 at 8:11
  • When an uploaded image was able to compromise security, then there certainly was another bug which contributed to the attack by causing the image to be interpreted as something different (like a PHP script). You should rather look into fixing that vulnerability. Is your Drupal version up-to-date? – Philipp Jan 21 '14 at 8:21
  • @Phillipp, In this question I am just trying to find the symptoms not the causes. – hnn Jan 21 '14 at 9:58
2

If you know what you're looking for, then you simply examine the data within the file to see if it matches the pattern you're looking for. How you do that depends on what sort of pattern it is; you could view the files in a text editor (for text-based patterns) a hex-viewer (for binary patterns) or you could write (or otherwise acquire) a program that will tease these patterns out of the files and present you with a report.

On the other hand, if you don't know what you're looking for, then you're obviously not going to find it.

  • I was hoping that there are some well-known patterns/functions that one can look for using find etc. – hnn Jan 21 '14 at 8:21
  • 3
    Not really. "Malicious image" could mean any number of things, not necessarily all related. – tylerl Jan 21 '14 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.