1

Somehow some javascript code got appended to the bottom of several of my index pages on my site. I know it's a trojan or iframe attack. However, I am wondering how is it even possible that someone was able to add code to my source?

Is it a security issue with IIS? Is it something they did through posting through one of my forms? Or something else that I don't even know about.

Any help in this regard is much appreciated.

4
  • 4
    It's hard to know without being able to see the page(s) in question... Jun 24, 2010 at 23:39
  • Is this a content managed site, like Joomla? Does it have any forms/user input at all? Need more info about the environment. Thanks. Jun 24, 2010 at 23:42
  • 2
    There are many ways a hacker can gain access to your server. Without access to your server configuration, it is impossible for us to say anything except what the most common form of attacks are. Jun 24, 2010 at 23:43
  • 1
    Someone needs to sanitize their input!
    – Aren B
    Jun 25, 2010 at 0:00

5 Answers 5

2

If the forms on your site are posted and then displayed on your website, it is possible that someone injected a script in your site.

But that's only possible only if you're not using htmlentities() or htmlspecialchars() (if you're using PHP, that is.)

2

Most likely Cross-Site Scripting (XSS).

4
  • this answer should be a comment instead. Jun 24, 2010 at 23:41
  • You are right Mike. I was thinking that as I typed it. Edited. Jun 24, 2010 at 23:43
  • @Chris, he edited the answer after I posted my comment. Original it was a question. Jun 24, 2010 at 23:43
  • @TomWilsonFL, I didn't want to sound pedantic. I'm glad we agreed. Jun 24, 2010 at 23:45
2

It's probably an FTP attack. Not for any definitive logical reason—it's perfectly possible that a content-injection, IIS, or server-level compromise could cause this—but simply because FTP credential attacks are very very widespread at the moment.

You view a web page with an exploit on it. That exploit installs a trojan(*). That trojan steals the FTP password you use to upload files to your site, and sends it to the attacker's servers. Those servers connect to your site's admin FTP (probably via a layer of botnet proxies) and alter every HTML file stored there to add the script/iframe attack to the bottom. That attack uses an exploit to install trojans on other's people's machines. ♪ It's the circle of life.

You need to:

  1. ensure every client machine accessing your site via FTP is completely clean. If you're unsure about a machine (for example because it has at some point in the last few years had a trojan on it), reinstall the OS. Don't trust anti-virus software to remove these threats, because today's AV is way behind the attackers and of very little practical use. Even when it claims to have ‘cleaned’ a machine it is likely it has missed something.

  2. stop using FTP. There's no reason to be using sucky FTP in this century. Get an SFTP client, and if your host doesn't give you an SFTP interface to your site, change hosts. Whilst it is possible for a client-side compromise to steal SFTP passwords to if it really tried, most currently don't, and there are many other reason FTP is a super-bad idea.

(*: and possibly other stuff, typically a fake-antivirus promo app trying to get you to spend $50 on their rogue AV app which is even more useless than real AV.)

2
  • +1 Also, use key pairs to authenticate your SFTP sessions.
    – gravyface
    Jun 25, 2010 at 2:17
  • Second this. We have an FTP server that we use for data interchange with clients. We have a policy where we use randomly generated passwords 10-12 char passwords (pwgen -s 12). A while back we found that a project had been crawled, and there was a hack inserted @ the bottom of each page. We established that a trojan on one of the user's machines had snagged the saved password out of filezilla, and the bot just changed all the pages.
    – Jason
    Jun 26, 2010 at 17:49
1

A trojan is a piece of code that hides itself as part of another program. So, unless you were executing a file on your server, then it wasn't a trojan.

As far as iframe attacks, those don't modify your source files.

So the question becomes: are your site files dynamically generated? Or, is the javascript actually in the source?

The reason I ask is that if they are dynamically generated then it may have been a Cross Site Scripting or SQL Injection issue. If the latter, well, someone rooted you, and you have a whole mess of other issues.

0

I don't think it's possible to tell without analyzing all of your code and your server configuration. It could be

  1. a remote exploit on the web server not related to your code
  2. a flaw in your application related to storing/displaying unsanitized input (XSS)
  3. a flaw in your application that allowed them to alter your files.

You must log in to answer this question.