1

My subject says it all - I am clueless as to how a file with permissions 0644 can keep getting iframe injections. None of the posts on this site that I saw quite described what I am experiencing. Every two days or so, an iframe gets injected into some files with 0644 permissions. Just as I think we've got it covered, it happens again.

We have searched the database for stored XSS or SQL Injection attempts, and do not find anything that corresponds to putting an iframe in these files, unless it is heavily obfuscated.

My question is: How do I stop this?

Improve this question

1 Answer 1

Reset to default
1

what do you mean by "injected"; is the iframe within the file itself or just in the answer by your webserver?

if the former, attacks seem to have access to the server and are able to alter files -> your server is compromised

if the later, the attacker probably installed a kernel-based rootkit that injects this iframe into server-answers -> your server is rooted and compromised

Improve this answer
3
  • Thanks for your answer. The injection is actually in the file itself. I open the file, and I see the iframe HTML code inside the file. So, the file itself is edited. So I believe it is #1. So - when you say the server is compromised, does it mean the host has to fix it, or does it mean someone has root access even though we have changed all the passwords several times, and it is just me, another developer and the client who knows these passwords. We have all updated our antivirus scanners, and did complete scans of our computers, so there are no known trojans that could do this from our PCs.
    – Kobus Myburgh
    Commented Feb 18, 2014 at 14:20
  • all i can tell you is: someone is able to alter files on your server, sou you should get someone who's responsible for your servers maintainance and ask him to clean up. fast.
    – that guy from over there
    Commented Feb 18, 2014 at 23:28
  • Thanks - problem not solved yet, but you gave some valid insights. Thanks a lot.
    – Kobus Myburgh
    Commented Feb 20, 2014 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .