0

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my own VPS. Yay! Now I have no one to blame but myself for any problems relating to availability, performance, and security.

Regarding security, I was auditing 'netstat' output on this Linux-based VPS today and noticed that I had an established connection to port 443 (HTTPS) on a different server. I figured out what DNS name this IP address resolves to and hit the googles. This domain is only associated with monetary scams and fraud.

So this HTTPS connection is just hanging around. I visit the site and the root page is a small bit of JavaScript that collects some basic info about the user's browser and screen size and then redirects to a second page on the site that plants a cookie.

I ran lsof -i and determined that one of the Apache processes on my server has established the connection to the secure server.

Any idea what might be going on here? It seems pretty clear that something shady is happening. My best theory is that an attacker is hijacking an Apache process which, in turn, is dynamically requesting JavaScript via an encrypted connection and injecting it into outgoing pages.

Other data points: I have searched through all my files and can't find any trace of this DNS name or its IP address; however, I know that's not conclusive evidence because I've seen JS-based malware that can obfuscate URLs pretty easily. Also, I have checked all of my computers which have been accessing my various sites and I can't find any trace of the cookie that the JS would be planting (which could just mean I hadn't hit the suspect Apache process yet).

Always the programmer, I wanted to try to reproduce the problem, so I rebooted the server and I haven't seen the connection get established again.

I have some ideas about mitigation or tracking (block connections to the bad server, either via firewall or the /etc/hosts file; redirect HTTPS requests to my own system with a spoofed cert just to investigate the network transaction if the same circumstances arise again). It seems really odd that the connection was left open (when it could just fetch the page once and be done), but maybe this was an errant condition and it wasn't supposed to remain open.

Sorry if this is a lot of detail, or if I'm overthinking something simple. I'm just being paranoid about taking care of my little slice of the internet. I was hoping to see if these details set off any familiarity alarms.

Improve this question
1
  • Do you have XMLRPC enabled?
    – ndrix
    Jul 13, 2015 at 11:10

2 Answers 2

Reset to default
1

I hate those kind of problems. There are so many places something could have happened.

I think I would just double check my config files - always a good idea to have a copy of valid config files. I use a GIT based tool to version all of mine. Then you can easily spot any unknown changes and back them out.

Then I would add the domain to IPTABLES and block it totally.

Improve this answer
-3

Do you use the hybridauth lib in any of your php applications?

There is a vulnerability in this library, if you do not follow the installation instructions and remove the install.php file, then you will have left your system open to attack.

more details on this:

https://github.com/hybridauth/hybridauth/issues/241

http://seclists.org/fulldisclosure/2014/Aug/10

Improve this answer
1
  • Link only answers are not useful here - they are vulnerable to link rot. If you can edit this to provide a summary of what lies at those links you may get some upvotes back.
    – Rory Alsop ♦
    Sep 26, 2014 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .