Hacked? Vulnerability? Or just general CSS strangeness ...

Hi all,

My company’s website runs on ModX. I have to admit I haven’t updated the content for a while, but anyway that’s my laziness. I’ll be putting some links in here, but read to the end of the post before following any links however ... some of them are a little dodgy.

I have a google alert set up to notify me of any mentions of my domain. Recently Its been coming up with the following links ...


Uh-oh, that doesn’t look good. The link on the title goes here:
http:// www.filechaos.com /tags/south-park-whale-wars-streaming.html&ct=ga&cd=1vzfK45wv-A&usg=AFQjCNFNjUtdBgluJVVY95cer2E9MpwUyg

And when you look at the page, the link next to mydomain.com says

http:// www.filechaos.com /webdet?q=south%20park%20whale%20wars%20streaming&p=1&url=http%3A%2F%2Fmydomain.com%2F%3Ft%3Dsons-of-anarchy-s02e11-megaupload

Decoding the last bit of that URL, you get:
http://mydomain.com/?t=sons-of-anarchy-s02e11-megaupload

And when you click on that link you go through to a CNN newsfeed. OK, so what’s happening here? Filechaos dot com is just using my domain name to ’legitimise’ their links. No other harm done?

What’s the strange ?t= parameter on my URL. I haven’t seen it before. Is this legitimate? Other letters don’t work, so I guess its something built into ModX. Should I disable it?

Is there a vulnerability here that I need to be worried about? I’m certainly concerned that my domain name is associated with such a site (given the nature of my work), but is there anything else to be concerned about?

Erm ... many more questions ... any theories?

Compare your index.php file in the MODx root with the one in the original MODx .zip file and look for anything suspicious in the .htaccess file there too.

I think there’s a good chance that one or both are compromised, which may mean that someone has gotten your cPanel or FTP username and password. You don’t say what version of MODx you’re using, but I doubt if this is due to a MODx vulnerability.

Quote from: BobRay at Jan 05, 2010, 12:01 AM

I think there’s a good chance that one or both are compromised, which may mean that someone has gotten your cPanel or FTP username and password.

Could be Adobe Reader with javascript on. Happened to me a while ago.

Perhaps this topic can be of use to you.

Good luck.

If you’ve not updated in a while as you mentioned, I also strongly suggest you do so. See the security thread for security-related topics and notices.

Thanks all. Indeed there was some nastiness in index.php. I don’t believe this was a ModX hack, as another site on the same webhost also has the same code ... and its running Joomla. This leads me to the belief that it was a hack affecting the entire webhost server, perhaps with bad file permissions set somewhere. I’ll be taking it up with them. Its not a Cpanel issue because they don’t use that software.

For the record I was running version 1.0.0 and I’m now up to 1.0.2. I was actually resisting upgrading as I was waiting for the big move to Revolution, but probably should have upgraded anyway.

If anyone is interested in the hack code, send me a PM and I’ll share it. Its quite interesting from a professional point of view.