3

My apologies this may sound like a paranoid question...

Recently my friend's website was infected by malware.

With her permission, I FTP into her account to have a look and found some malicious PHP files with Base64 (i think?) strings as well as TXT files that seem like Bash/Perl scripts calling "wget" on some server.

Question:

  1. I won't get infected by viewing/editing those PHP and TXT files right? (I use FTP to download them and Aptana Studio 3 to view them).

  2. I tried decoding the supposedly Base64 string using an online decoder. The operation failed (i.e. nothing was decoded). Nothing was also downloaded. Doing this won't cause my PC to be infected right?

Thanks guys.

6

Not so paranoid, Opening files in a text editor should be safe. Opening other file types is more risky, PDF's, images, office documents, have all had vulnerabilities where opening the file in certain viewers. Most text editors are simple enough that they have few vulnerabilities.

Ensure you never run the .php files, I would recommend changing the file extensions to .txt as soon as you download them.

Extra step for the paranoid, I would also recommend opening the files in a simple text editor, like notepad, editpad pro, sublime text or similar. The more complex and the more the editor understands the format the more likely it is that there is a bug which could be exploitable. This is much more a problem with complex formats like .doc or .pdf.


Further Response

There is the academic answer and the pragmatic answer and they are different.

The academic answer is that it is possible that opening any file in any editor could compromise your box. It is possible that copying the encode text into your paste buffer compromised your box. It is possible that pasting the encoded text into a website compromised your web browser which compromised your box.

The academic answer is not very helpful.

The pragmatic answer is, you'll be fine as long as you did not execute the files. Though the academic answer is factually correct, it is highly improbable the attacker the compromised the server either had access to or was willing to use zero-day attacks against desktop software.

For next time you are doing incident response or malware examination you should consider doing the work in a virtual machine, and discard any changes to the virtual machine once you are done with a piece of work.

  • Thanks @David Waters. So the answer to Q1 and Q2 is "No, there is no risk of infection"? – Honey Badger Dec 22 '14 at 6:34
  • 2
    Honey - no, it's never a 'no risk' - it's just unlikely. – Rory Alsop Dec 22 '14 at 9:01
  • @HoneyBadger : I have expanded my answer – David Waters Dec 22 '14 at 22:49
1

As the data is embeded in a PHP script file, it is perfectly safe to download the file and edit in a script editor.

If you do manage to decode the obscured data, you do, of course, need to be careful how you handle that.

There is no danger to you or anyone else as long as you are not trying to interpret the data automatically. Even trying to interpret the obscured data by unencoding it will not present a particular danger though the resulting file might itself be dangerous depending on the file type resulting. PDF files can be dangerous if loaded into Adobe reader (use Ghost script or another simple reader if not sure, preferably in a throw-away VM), Image files can be dangerous due to possible bugs in the OS handling of images. Script files (PHP, PERL, etc.) are never dangerous unless executed.

  • Thanks Julian. I pasted the obscured data in an online decoder (I use Chrome browser), but the decoding failed. And no file was created or downloaded by Chrome. So I guess there's nothing to worry, right? – Honey Badger Dec 22 '14 at 13:41
  • 1
    Well someone did it for a reason so it will be a payload of some kind. Probably best just to tidy it up along with changing passwords, checking running progs, and other tightening of security on the server. To make sure they don't come back. – Julian Knight Dec 22 '14 at 23:26
  • 1
    Oh, and put the PHP code under source control so that you can wind back to previous versions or keep the master code offline and push it from time to time. That way you can be totally sure of having clean code. – Julian Knight Dec 22 '14 at 23:27
  • Just to clarify: As long as when you're decoding a Base64 string using an online decoder, and if no file was downloaded as a result of that decoding, then it is fine correct? – Honey Badger Dec 23 '14 at 0:07
  • 1
    Yes, that is correct. – Julian Knight Dec 23 '14 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.