new iframe attacks (march and april 2009), modx may be compromised

it appears 2 of my sites has been compromised with iframe injection attack.

i advise you check your own sites. this tool may help - http://www.unmaskparasites.com/ (it’s not an ad, it’s not my site)

here are the details - it appears that compromised pages have injected hidden "A" links or hidden iframes which point to different domains (many of them ending with .cn (china)).

the mechanism of attack is a bit of a mistery. it appears that some cms-es are affected (modx may be the one, i also found that out on phpfusion as well). even though i use the latest version.

the other way of attack may be related if you store passwords for FTP sites in total commander or maybe firefox. these are unsecure to be stored. the malicious software logs into your ftp account and scans all index files and adds iframes.

how to fix all of this mess? find a secure way of storing passwords (any ideas about secure way that is also practical to use??), change all your passwords, and check all your sites for possible iframe / hidden a tag content.

take this seriously, google is dropping ranks for compromised sites.

Hi there,

While I appreciate your word of caution to all of Us, I doubt that MODx is at fault here. This might just be a security issue with the Hosting company. Many hosts like IX web hosting, (not that I wanna pick on them) have had many security problems wit their UNIX servers. The attacker was placing an .htaccess file in the root of the site to redirect users from Search engines to an antivirus software.

The best way to find out if MODx is truly compromised is to see if anyone else had the same problem.
Good luck though, tell Us the outcome.

:)

If somebody can get access to your server and modify the index.php files, that’s not a problem with MODx, that’s a problem with the server. It requires either your FTP/SSH passwords, or root access to the server, which has nothing at all to do with MODx. All of us using remote servers are dependent on our hosting companies to secure their servers.

after some additional analysis here is what i conclude.

modx is most probably not at fault, however the recent attacks will affect some of you (unfortunately).

phpfusion had a different kind of exploit (a problem with phpfusion).

this one - the malicious software affects all "index" and "default" files - not only the ones related to modx so it could have gained access by two ways:

1. by compromising FTP / Unix server

2. by compromising your FTP passwords kept in unsecure environment (firefox without "master password", total commander FTP, some other ftp clients etc.).

It appears that the second is more likely so I would advise all of you to scan your computers - and use the above tool to check your sites of course. By scanning your computers, don’t use "free" antivirus software (because they usually have a lot of false positives and miss on many viruses).

The worst thing you can do is to think you are not affected and ignore this warning, but that’s an arrogant way but still an option