Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Somehow some javascript code got appended to the bottom of several of my index pages on my site. I know it's a trojan or iframe attack. However, I am wondering how is it even possible that someone was able to add code to my source?

Is it a security issue with IIS? Is it something they did through posting through one of my forms? Or something else that I don't even know about.

Any help in this regard is much appreciated.

share|improve this question

migrated from stackoverflow.com Jun 24 '10 at 23:48

This question came from our site for professional and enthusiast programmers.

4  
It's hard to know without being able to see the page(s) in question... –  Dean Harding Jun 24 '10 at 23:39
    
Is this a content managed site, like Joomla? Does it have any forms/user input at all? Need more info about the environment. Thanks. –  TomWilsonFL Jun 24 '10 at 23:42
2  
There are many ways a hacker can gain access to your server. Without access to your server configuration, it is impossible for us to say anything except what the most common form of attacks are. –  Mike Sherov Jun 24 '10 at 23:43
1  
Someone needs to sanitize their input! –  Aren B Jun 25 '10 at 0:00
add comment

5 Answers

If the forms on your site are posted and then displayed on your website, it is possible that someone injected a script in your site.

But that's only possible only if you're not using htmlentities() or htmlspecialchars() (if you're using PHP, that is.)

share|improve this answer
add comment

Most likely Cross-Site Scripting (XSS).

share|improve this answer
    
this answer should be a comment instead. –  Mike Sherov Jun 24 '10 at 23:41
    
You are right Mike. I was thinking that as I typed it. Edited. –  TomWilsonFL Jun 24 '10 at 23:43
    
@Chris, he edited the answer after I posted my comment. Original it was a question. –  Mike Sherov Jun 24 '10 at 23:43
    
@TomWilsonFL, I didn't want to sound pedantic. I'm glad we agreed. –  Mike Sherov Jun 24 '10 at 23:45
add comment

It's probably an FTP attack. Not for any definitive logical reason—it's perfectly possible that a content-injection, IIS, or server-level compromise could cause this—but simply because FTP credential attacks are very very widespread at the moment.

You view a web page with an exploit on it. That exploit installs a trojan(*). That trojan steals the FTP password you use to upload files to your site, and sends it to the attacker's servers. Those servers connect to your site's admin FTP (probably via a layer of botnet proxies) and alter every HTML file stored there to add the script/iframe attack to the bottom. That attack uses an exploit to install trojans on other's people's machines. ♪ It's the circle of life.

You need to:

  1. ensure every client machine accessing your site via FTP is completely clean. If you're unsure about a machine (for example because it has at some point in the last few years had a trojan on it), reinstall the OS. Don't trust anti-virus software to remove these threats, because today's AV is way behind the attackers and of very little practical use. Even when it claims to have ‘cleaned’ a machine it is likely it has missed something.

  2. stop using FTP. There's no reason to be using sucky FTP in this century. Get an SFTP client, and if your host doesn't give you an SFTP interface to your site, change hosts. Whilst it is possible for a client-side compromise to steal SFTP passwords to if it really tried, most currently don't, and there are many other reason FTP is a super-bad idea.

(*: and possibly other stuff, typically a fake-antivirus promo app trying to get you to spend $50 on their rogue AV app which is even more useless than real AV.)

share|improve this answer
    
+1 Also, use key pairs to authenticate your SFTP sessions. –  gravyface Jun 25 '10 at 2:17
    
Second this. We have an FTP server that we use for data interchange with clients. We have a policy where we use randomly generated passwords 10-12 char passwords (pwgen -s 12). A while back we found that a project had been crawled, and there was a hack inserted @ the bottom of each page. We established that a trojan on one of the user's machines had snagged the saved password out of filezilla, and the bot just changed all the pages. –  Jason Jun 26 '10 at 17:49
add comment

A trojan is a piece of code that hides itself as part of another program. So, unless you were executing a file on your server, then it wasn't a trojan.

As far as iframe attacks, those don't modify your source files.

So the question becomes: are your site files dynamically generated? Or, is the javascript actually in the source?

The reason I ask is that if they are dynamically generated then it may have been a Cross Site Scripting or SQL Injection issue. If the latter, well, someone rooted you, and you have a whole mess of other issues.

share|improve this answer
add comment

I don't think it's possible to tell without analyzing all of your code and your server configuration. It could be

  1. a remote exploit on the web server not related to your code
  2. a flaw in your application related to storing/displaying unsanitized input (XSS)
  3. a flaw in your application that allowed them to alter your files.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.