Hacked site

While I don’t want to cause alarm in the MODx community, I want to give a heads-up that my site was hacked.

I checked my server logs and found one hit from a Chinese-based IP address, but no other activity. No get or post query.

Script error logs revealed a strange error regarding a shared object
’/usr/libexec/ld-elf.so.1: Cannot open "/usr/local/lib/compat/libstdc++.so.3"

The affected file resided in the cache directory, where a few cached pages were overwritten with spam. Clearing the cache restored the site.

I’m still researching how they got into the cache directory, which has 755 permissions.

The exploit may have come from the server itself, being a shared host. It may also have come from an infected PC. Although, I must admit I run a tight shift in terms of antivirus protection and use Verio hosting services, which is one of the best IMHO.

I’ll post updates as I find them.

What version of MODx are you running?

I’ve had to get a bunch of sites cleaned that had a similar attack (not modx sites though - that would suck)
and the attacks (also from a Chinese IP address) were most likely through someone’s compromised email security.
Some sites would be cleaned entirely and end up with more harmful content within a week, but as soon as the passwords were changed the attacks stopped. So as good rule of thumb, I’d like to advise that anytime you get an attack, switch the passwords. I also started using strong passwords for added safety. It seemed silly that someone would bother hacking these sites, but it’s all done through a script so I don’t imagine that it takes a lot of effort for them to add another 1000 sites to the list.

anyhow, hope you can get that sorted out.

The targeted site is running Evo 1.02

A strange side-effect of the hack was that the PHP parser began to act erratically, sometimes throwing ’too many open files’ error messages, 404s, server errors, and on occasion, the browser would just echo back raw php code!

My passwords are, as a rule, very cryptic and not meant to be memorized. My config file permissions are set at 600, and I’ve followed every recommended security precaution. This leads me to believe that the attacker got in from a co-hosted compromised site, or some other back door. The cache directory is not something directly editable via the Manager, so I don’t think it was a MODx security exploit.

I should also mention that the site is not even public yet. It’s a brand new hosted site currently being accessed via a temp domain name.

At any rate, all is well so far, and I found no other altered files other than those that resided in the cache directory.

Take a really close look at the index.php and .htaccess files (and the rest of the site, for that matter). Modification of just the cache directory would seem to imply that the hacker knew it was a MODx site, which is possible but unlikely.

If you have a recent pre-hack backup, it wouldn’t be a bad idea to wipe everything and reinstall.

So far, so good. My faith in MODx security is not shaken.

Most likely it was some kind of backdoor server-based attack, as the PHP parser was severely affected (based on the contents of the error log and intermittent server errors when pages were being viewed).

Funny thing, next day my OTHER site went down with a ’MODx is not installed. Install now?’ error message. I thought for sure I had a keylogger or other traffic sniffer running on my machine that was stealing my credentials. It turns out that server maintenance caused a permissions change on my config file, so MODx couldn’t access it.

I’ve had a similar thing happen where a change in server locked me out. Would be nice if modx could handle it, but then I don’t know if the usual suspects like joomla are susceptible to this as-well.