Closed: Something modified my manager/frames/nodes.php -any ideas?

My hosting service is Lunarpages. Not sure how to confirm what username Apache/PHP runs under or if it is the same as the FTP server. The FTP logs showed no activity except my repairs.

Now waiting to see if it happens again after fixing the file and setting all the access permissions to read only. I’ve also changed my passwords as a precaution.

:(

A person in this thread has responded privately that no further activities were noticed after all their passwords were changed. Previously they were happening daily, and the logs showed no access other than through the users FTP account.

This possibly points to some sort of keylogger or spyware that posts FTP (and likely other sensitive information) having been installed on the local development PC. There has been recent discussion on these forums of this happening via an exploit associated with older, unpatched versions Acrobat Reader. I don’t know if that’s the cause or even if this is the case in this instance. While only the nodes.php file is reported to have been changed, I suspect that there are other files altered or added somewhere in the filesystem of the MODx sites in question.

This is a very suspicious, concerning and possibly dangerous situation.

Read this topic silent but interested until now.
I’m not affected but thought about something:
Quote from: rthrash at Oct 07, 2009, 10:58 AM

While only the nodes.php file is reported to have been changed, I suspect that there are other files altered or added somewhere in the filesystem of the MODx sites in question.

This is a very suspicious, concerning and possibly dangerous situation.

I’m not a programmer and so don’t know how complicated this would be...
BUT: Couldn’t we have a script, that checks the MODx core files against a table of hashes to make sure, they aren’t altered?
This would make it easier to check if an install is affected and if it needs to be cleaned.

Sorry for being litte OT with this

Greetz
JUSI

jusicgn: It certainly can be done, but it’s not trivial.

It seems really strange that the only thing changing is the removal of an empty <div style="display:none"></div> container. Could this be some kind of automated scanning and cleanup program (this kind of empty div container will cause unexpected white space in IE)? What do the people having this happening have in common?

Inspite of changing passwords and all the other stuff I did, the file is modified again. My auditor crawls the directory comparing file checksums and permissions...
From the (now) hourly audit:

If there is malicous code on my website it was in place before the auditor was installed (July 4th) or it is code somehow injected in to the database. I now know the the fle change happens between 23:00 and 00:00 hrs (Server time). The 100444 above shows that the file has been left as read only so whatever is doing this is changing the access to manager and frames and nodes.php to write access, modifying the file then changing them all back to read only.

For comparing notes - I am running MODx 1.0.0, SMF 1.1.10, Gallery2. Apache 1.3.41 (Unix),MySQL 5.0.67-community.

I am going to remove Gallery2 temporarily from my site as I see many alarming things in the Error log.

I am also on Lunarpages.

Since the site itself looks normal over time, someone might be trying to use it to forward spam or as part of a Denial of Service attack. Do you see any evidence of that in the logs?

Quote from: BobRay at Oct 08, 2009, 11:35 PM

Since the site itself looks normal over time, someone might be trying to use it to forward spam or as part of a Denial of Service attack. Do you see any evidence of that in the logs?

I don’t think that is the case since the only thing they are doing is adding a hidden div. This is very strange to say the least, but I think Susan may be on to something, especially since all of these seem to be on the same host...

Quote from: OpenGeek at Oct 09, 2009, 07:33 AM

Quote from: BobRay at Oct 08, 2009, 11:35 PM

Since the site itself looks normal over time, someone might be trying to use it to forward spam or as part of a Denial of Service attack. Do you see any evidence of that in the logs?

I don’t think that is the case since the only thing they are doing is adding a hidden div. This is very strange to say the least, but I think Susan may be on to something, especially since all of these seem to be on the same host...

Assuming that no other code is changed. It’s hard to imagine a host utility adding well-formed code inside a single file that would hide a particular div.

I’m on that host too but haven’t seen this, although I have an older version of MODx there.