Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites.

I've found out that a line of packed javascript was added to many js files across the server.

What the script does is pretty simple, but what I would like to know is if this malware is well known and how it infect servers and propagate.

For the curious here's the Javascript line in question:

http://pastebin.com/S0iAmRMx

NB: Some Anti-Virus solutions capture this link as a threat due to the pasted JavaScript

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

By any chance are you running Plesk Control Panel? If so, this could be the password vulnerability issue they notified about earlier this year. If your passwords were grabbed, they may just now be using them. Check your Plesk Action log for logins to multiple clients from a single IP.

share|improve this answer
    
Yes I am. And it got compromised with this exploit. The server has been patched, but I'm told they did not change all the accounts passwords (dumbfucks..). I managed to backtrace the attack source by analysing logs in /usr/local/psa/admin/logs (basically just cross checking POST requests with IPs). Thanks ! –  h3. Jun 20 '12 at 13:28
add comment

The most likely cause of infection would be either SQL injection or cross site scripting. You probably already know what both of those are but just in case...

XXS or "cross site scripting" is most commonly found where a site allows a user to upload content to a page (say on a forum or comment section or whatever) without checking and validating the content - or perhaps poorly checking and validating the content. So a nefarious user uploads his HTML / JS as a comment and the next person viewing the comment executes the script.

SQLi (and I'd bet on this one) is where a nefarious user sends executable SQL along with URL or FORM (or cookie) params. It's most common where someone uses numeric "ids" - say ?news_Id=4 for a news story - and the DB is configured for multiple statements. Careless programmers allow the URL param to pass directly to the DB without qualifying it as a number... so someone can put something like ?news_id=4; update tableA set title=..... you get the idea. SQLi attacks can be really tricky and involve executing evaluated encoded hexes and the like.

So a "best guess" would be that someone has an unprotected query that is being hit by SQLi - and that's appending this JS to some content that is put out to the page.

As to the exploit itself. I've seen exploits like it but I have not seen this specific one. It's very clever to say the least. It's obfuscation of the domain name is pretty unique to the exploits I've seen. Still - it is a LOT of JavaScript to try and get loaded into a char column.

share|improve this answer
    
Both possibilities are improbable .. There is many different websites infected on the server, some are in PHP, some plain HTML and even django websites. SQLi is next to impossible in django and impossible with plain HTML website. And all websites are cloaked in their own user space so they cannot write in other website directories. So the infecting script has either access to the user/pass of each infected website or has root access. –  h3. Jun 19 '12 at 15:35
    
Got it. So something infecting at the root level eh? Perhaps look for a file upload vulnerability. I have one documented here: coldfusionmuse.com/index.cfm/2009/4/16/iframe.insertion.hack They tend to be very specific attacks with a human involved and not agent based - at least not on a server that's reasonably secure. Common editors (like FCK) have vulnerabilities that are patched over time - maybe you have one that's unpatched? Just noodling with you :) –  Mark A Kruger Jun 19 '12 at 15:41
    
One more comment - we had a server a few years ago infected at the root level with a root kit. We gave up at some point and reformatted and reinstalled each site from a previous backup. Not fun. –  Mark A Kruger Jun 19 '12 at 15:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.