35
Reverting the changes every 30 minutes is not a solution. You absolutely need to find out the root cause and stop this from happening by removing the vulnerability or the persistence. This may include monitoring the logs and other forensics, but also a fresh installation of WordPress (or in worst case the entire server) might be required.
3
There are an enormous number of options. In no particular order:
You can enlarge the file, adding the malicious code and either making it the main entry point or adding a call to it from the exiting entry point.
You can remove part of the file and replace it with your own code, if there's something you expect isn't needed (this is easier if you know the ...
3
Buggy firmware.
There's an old saying in IT:
Never attribute to malice what can be sufficiently explained by incompetence.
This can be fully explained by a buggy firmware that somehow re-enables it automatically after reboot, or never disables it in the first place, or resets that part of the configuration due to some other random event.
Consumer router/AP ...
1
The only thing I've come across is that there must be malware inside the network.
The attack (if any) could come from outside your network.
This could be the result of a CSRF or DNS rebinding attack on your router configuration UI. This assumes that your router is vulnerable to either of them.
This could be the result of a reflected XSS as well.
Note that ...
1
An IP address is simply like having your home address on a letter. They can know the area where you live but not more.
A malicious user could try to hack your network but usually, home routers are pretty safe and will prevent any intrusion by default (if you haven’t modified port forwarding and settings like that).
Anyway, random people online are already ...
1
The technique that you are asking for is called Data Exfiltration and yes. There are ways of detecting DE.
Depending on the level of maturity of the threat this exfiltration could be more or less sophisticated. For example, the malware could grab sensitive information, cipher it and send it to the attacker. Or it could use a way easier method of ...
Only top voted, non community-wiki answers of a minimum length are eligible
