My MODx site got flagged by Google as a Malware / "Reported Attack Site!"

Really bad luck mate

If you’re on shared hosting you might want to check the status of other sites on your server, could be they’ve been compromised and Google is flagging the IP as dangerous?

therebechips - yes, it’s a hosted server. But, I host several sites on this same host and only this one domain is getting the error, so I don’t think it’s just the IP address that got flagged. I called my host and they verified that they don’t see any suspicious activity.

I did hear back from the author of the Hiveware Enkoder and he said he didn’t believe his enkoder was causing the problem -- it’s used on thousands of sites.

The blackout continues...

Ok, finally with the help of folks in the Google forum, the cause was identified: one of my Javascript files was writing a hidden iFrame upon the FIRST visit to my site (so that’s why I didn’t see it -- I’m not a first time visitor). The exploit is called "gcounter cn".
http://www.google.com/support/forum/p/Webmasters/thread?tid=6da65d4bd143a077&hl=en

Of course, this means that someone got access to my server, probably before I had SSH keyed logins enabled. In any case, the whole install is suspect now and I probably have to re-install the whole site... any other sites on that package could have also been compromised.

Well, if that isn’t a big FU from the hackers, I don’t know what is. As if my list of people to kick in the nuts wasn’t long enough...

Even better... when I thought my host had enabled Keyed Logins and Disabled Password logins, my hosting provider had in fact, only the done first and neglected the latter. I blame myself for not verifying that password logins were disabled. Fun little lesson there: any open port to your web server will be brute-force hacked.
http://www.tipsfor.us/2009/06/15/securing-a-linux-server-ssh-and-brute-force-attacks/

Holy smokes... this is gonna take me a lot of time to repair.

Hey, I have the exact same issue with Google blocking our site. Is this an inherent MODx issue because I too cannot find what code might be triggering for Malware. very frustating... I mean, who pays, the host, designer, or client? I know the answer.. us designers get stuck with the mess!

dave

That sucks, man. I feel you.

No, this isn’t a MODx issue specifically, it’s just a reality of having a site on-line. Any vulnerability can be exploited. I’m not sure where the vulnerability in my site was, but I know that Round Cube had some soft spots, as did one of my menu scripts, and I know that my SSH port was not locked down. It could have been a MODx vulnerability too... I just don’t know. But any weakness could have resulted in my site being compromised.

Here’s what I STRONGLY recommend for ANY site on ANY host running ANY CMS: do regular backups, so that if and when something breaks or gets compromised, you have versions of both your database and your files, e.g. daily backups, a backup that’s a week old, and one that’s a month old. You can’t ever have a site that’s 100% secure: security is a process, not a destination. So be prepared and have backups.