1

This morning some sites which are hosted on the server as me started triggering malware alerts and started to redirect traffic to external sites.

I've found out that a line of packed javascript was added to many js files across the server.

What the script does is pretty simple, but what I would like to know is if this malware is well known and how it infect servers and propagate.

For the curious here's the Javascript line in question:

http://pastebin.com/S0iAmRMx

NB: Some Anti-Virus solutions capture this link as a threat due to the pasted JavaScript

Improve this question

2 Answers 2

Reset to default
4

By any chance are you running Plesk Control Panel? If so, this could be the password vulnerability issue they notified about earlier this year. If your passwords were grabbed, they may just now be using them. Check your Plesk Action log for logins to multiple clients from a single IP.

Improve this answer
0
1

The most likely cause of infection would be either SQL injection or cross site scripting. You probably already know what both of those are but just in case...

XXS or "cross site scripting" is most commonly found where a site allows a user to upload content to a page (say on a forum or comment section or whatever) without checking and validating the content - or perhaps poorly checking and validating the content. So a nefarious user uploads his HTML / JS as a comment and the next person viewing the comment executes the script.

SQLi (and I'd bet on this one) is where a nefarious user sends executable SQL along with URL or FORM (or cookie) params. It's most common where someone uses numeric "ids" - say ?news_Id=4 for a news story - and the DB is configured for multiple statements. Careless programmers allow the URL param to pass directly to the DB without qualifying it as a number... so someone can put something like ?news_id=4; update tableA set title=..... you get the idea. SQLi attacks can be really tricky and involve executing evaluated encoded hexes and the like.

So a "best guess" would be that someone has an unprotected query that is being hit by SQLi - and that's appending this JS to some content that is put out to the page.

As to the exploit itself. I've seen exploits like it but I have not seen this specific one. It's very clever to say the least. It's obfuscation of the domain name is pretty unique to the exploits I've seen. Still - it is a LOT of JavaScript to try and get loaded into a char column.

Improve this answer
3
  • Both possibilities are improbable .. There is many different websites infected on the server, some are in PHP, some plain HTML and even django websites. SQLi is next to impossible in django and impossible with plain HTML website. And all websites are cloaked in their own user space so they cannot write in other website directories. So the infecting script has either access to the user/pass of each infected website or has root access.
    – h3.
    Jun 19, 2012 at 15:35
  • Got it. So something infecting at the root level eh? Perhaps look for a file upload vulnerability. I have one documented here: coldfusionmuse.com/index.cfm/2009/4/16/iframe.insertion.hack They tend to be very specific attacks with a human involved and not agent based - at least not on a server that's reasonably secure. Common editors (like FCK) have vulnerabilities that are patched over time - maybe you have one that's unpatched? Just noodling with you :)
    – Mark A Kruger
    Jun 19, 2012 at 15:41
  • One more comment - we had a server a few years ago infected at the root level with a root kit. We gave up at some point and reformatted and reinstalled each site from a previous backup. Not fun.
    – Mark A Kruger
    Jun 19, 2012 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .