1

Tonight I found by accident that someone had injected a bunch of crap links into the bottom of my personal site's index.html page. I thought it was a script at first, but after going into my FTP account and looking at the file on disk, the links are actually in the HTML. After further inspection of my hosting account, I noticed a few other files that didn't belong to me sitting there.

I get it. Someone figured out my not-very-secure password, modified my file, uploaded some other crap. My question is, why? What do they have to gain? Were people being hurt by this code? Have I been a zombie for the past month or two? I don't have a database or even any server-side code, so I have nothing worth stealing.

The following are pastebin links containing the contents of the hacker's code:

I'm in the process of getting the hosting access logs from my hosting provider. I could probably provide those too if anyone would be interested in seeing them. Also, I apologize if I've posted this on the wrong site; this seemed the most appropriate given my options.

Thanks.

closed as too broad by TildalWave, Mark, Jens Erat, Steve, Rory Alsop Nov 24 '14 at 10:49

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

6

You probably were hacked because you were an easy target. And even if there are no important data at your site it can be valuable to point people to a seemingly innocent and trusted host and get them infected by drive-by-downloads etc. In your case it looks more like your host was used for SEO optimizations, by linking typical phrases to external hosts and thus increase the search engine ranking of these hosts.

3

You ask:

why? What do they have to gain? Were people being hurt by this code?

The answer is simple, you are a resource. Attackers go after many sites because they're simply low hanging fruit, a means to an end. Because someone may visit your site, they did it to target your visitors. It is a means to an end. The more people that visit their links via way of you, the higher the likelihood of them making some form of money. Either via way of advertising, or malicious software.

Have I been a zombie for the past month or two?

No one here is going to be able to answer this question. Only an incident response analysis can give you a best guesstimate of how long you've been disaffected for provided the attackers didn't modify logging data.

I don't have a database or even any server-side code, so I have nothing worth stealing

You're missing the point. Imagine the following: You have a backyard, visible to anyone who drives by your home. Someone comes along and constructs a huge billboard for all to see when they drive by. On this billboard they advertise their product. At some point, even if they make $1.00 USD, it is free money. You don't see the billboard from the onset. As for the zip files, asp files, etc. you can run them through Anubis Malware Analysis to see what they do/did.

Your thoughts on databased, etc., is kind of a moot point, the analogy above should give you the best insight as to why attackers do this. It's merely a means to an end

Not the answer you're looking for? Browse other questions tagged or ask your own question.