Site Hacked.....

Hi all,

Need some advice - In fact I need some HELP! - a site Im working on a for a client has been hacked. A copy of the Google’s Chrome browser report is included below with all the references to the exploit and its location. Also flagged in AVG - site tries to download an Active X control in Internet Explorer

Using Modx Version: 0.9.6.3 / PHP 4 / Register_Globals is set to OFF. I had the problem with the reflect snippet being left in the install folder : /assets/snippets/reflect/snippet.reflect.php - renamed this to .txt file - made no difference.

List of snippets installed above the standard includes: Easy Events, GoogleMap, MaxiGallery, mPlayer, XSPF JukeBox, YouTube, Easy Newsletter, NewsPublisher.....

Now it seems the site is going to be blacklisted by Google, too

See Google Chromes report below:

The website at www.[edit:hackeddomainname].co.uk contains elements from the site gstats.cn, which appears to host malware - software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for gstats.cn.
Learn more about how to protect yourself from harmful software online.


Return to the previous page.
If you are the owner of this website, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google’s Webmaster Help Centre.

Safe Browsing
Diagnostic page for gstats.cn

What is the current listing status for gstats.cn?
Site is listed as suspicious - visiting this website may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 4 pages that we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time that Google visited this site was on 2009-06-01, and the last time that suspicious content was found on this site was on 2009-06-01.
Malicious software includes 7 scripting exploit(s), 3 trojan(s).

This site was hosted on 2 network(s) including AS48856, AS41947 (WEBALTA).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, gstats.cn appeared to function as an intermediary for the infection of 23 site(s) including istage.hk/, thaisubtitle.com/, gcc.mn/.

Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 26 domain(s), including nebeskelampiony.cz/, istage.hk/, gcc.mn/.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:
Return to the previous page.
If you are the owner of this website, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google’s Webmaster Help Centre.


Safe Browsing
Diagnostic page for gstats.cn

What is the current listing status for gstats.cn?
Site is listed as suspicious - visiting this website may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 4 pages that we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time that Google visited this site was on 2009-06-01, and the last time that suspicious content was found on this site was on 2009-06-01.
Malicious software includes 7 scripting exploit(s), 3 trojan(s).

This site was hosted on 2 network(s) including AS48856, AS41947 (WEBALTA).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, gstats.cn appeared to function as an intermediary for the infection of 23 site(s) including istage.hk/, thaisubtitle.com/, gcc.mn/.

Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 26 domain(s), including nebeskelampiony.cz/, istage.hk/, gcc.mn/.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:
Return to the previous page.
If you are the owner of this website, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google’s Webmaster Help Centre.


Safe Browsing
Diagnostic page for AS48856

What happened when Google visited sites hosted on this network?
Of the 57 site(s) we tested on this network over the past 90 days, 5 site(s), including, for example, saho-ltd.com/, loskut.cn/, hyipi4nvestment.com/, served content that resulted in malicious software being downloaded and installed without user consent.

The last time Google tested a site on this network was on 2009-05-26, and the last time suspicious content was found was on 2009-05-26.

Has this network hosted sites acting as intermediaries for further malware distribution?
Over the past 90 days, we found 17 site(s) on this network, including, for example, 95.129.144.0/, bizoplata.ru/, startdontstop.ru/, that appeared to function as intermediaries for the infection of 4456 other site(s) including, for example, livrosweb.com/, diocesejounieh.org.lb/, c4lpt.co.uk/.

Has this network hosted sites that have distributed malware?
Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 32 site(s), including, for example, martuz.cn/, bizoplata.ru/, startdontstop.ru/, that infected 40918 other site(s), including, for example, diocesejounieh.org.lb/, doae.go.th/, prachinburi-museum.go.th/.

Next steps:
Return to the previous page.


Advisory provided by
Safe Browsing
Diagnostic page for AS41947 (WEBALTA)

What happened when Google visited sites hosted on this network?
Of the 14474 site(s) we tested on this network over the past 90 days, 435 site(s), including, for example, uatraf.org.ua/, traff.org.ua/, eltaroute.com/, served content that resulted in malicious software being downloaded and installed without user consent.

The last time Google tested a site on this network was on 2009-06-03, and the last time suspicious content was found was on 2009-06-03.

Has this network hosted sites acting as intermediaries for further malware distribution?
Over the past 90 days, we found 26 site(s) on this network, including, for example, s100.ucoz.ru/, brockenmon.cn/, web-masteru.net.ru/, that appeared to function as intermediaries for the infection of 130 other site(s) including, for example, thaidvd.net/, wowcheater.net/, brajeshwar.com/.

Has this network hosted sites that have distributed malware?
Yes, this network has hosted sites that have distributed malicious software in the past 90 days. We found 36 site(s), including, for example, total-virusprotection.com/, s100.ucoz.ru/, newslentarss.ru/, that infected 170 other site(s), including, for example, krestania.sk/, all4meat.com/, bissnes.org/.

Next steps:
Return to the previous page.

This sounds that your server was hacked and not the site itself. Look for any javascript or an iframe that may have been inserted into the site code (look at the source code in the browser).

dev_cw,

Many thanks for your reply - could you please provide me with more information regarding why you think it might be the server itself - I wouldnt want to go down that route with my provider unless Im sure.....

Thanks,

Dan.

Are you running any other applications than MODx? Is it a shared server? If your server was compromised or your site for that matter, they most likely installed a back door script in some folder deeply nested within your site. Could be in the assets directory or could be in the manager directory. You should investigate the logs, or have a server admin do so, to try to figure out how and when this occurred.

Yes its shared server space - there is also an install of Zen-Cart in the same server space, but thats locked down for development with a .htaccess password on the root directory - but wether that would prevent a hack or not I couldnt say....

I have isolated one hack down to a javascript file for the snippet ’easy events’ - can anyone recommend any further steps I could take to isolate the the exploit itself?

Dan.

I work for a web hosting company and 99% of the time a site gets hacked the hacker successfully logs through FTP with one attempt, meaning that at least one of the computers used to access your account through FTP have been compromised by a trojan or keylogger.

A recent, particulary insidious exploit (Gumblar .cn) has been infecting several sites per day. It takes advantage of a buffer overflow in Adobe Acrobat reader (which has JavaScript enabled by default) to capture all of your FTP usernames and passwords. You only need to visit an infected site (even if you click nothing on the site). Any sites you have stored FTP usernames and password for will be downloaded, infected with malicious Javascript, then the infected content is FTP’d back to your site.

http://blog.unmaskparasites.com/2009/05/07/gumblar-cn-exploit-12-facts-about-this-injected-script/comment-page-1/

Although I cannot say that your site is infected with this particular exploit, it would be wise to disable Javascript in Adobe Acrobat, change all FTP passwords on relevant servers, and scan any computers with FTP access with a Malware scanner, such as malwarebytes:

http://www.malwarebytes.org/

Check you FTP logs for suspicious IP addresses, and if you find any suspicious activity, restore your site from a backup before it was accesses (if possible).

Steven

Hi Steven,

Many thanks for your reply. My hosting company also suggests that it could be the same exploit too. They suggest running a virus scan on my local machine and then securing my FTP server settings, usernames and passwords, etc. It seems that the site Im working on with Modx is the only site so far to have this exploit however. It is also true that while trying to diagnose the problem last night, my copy of Adobe ’unexpectedly quit and crashed’ - even though it wasnt open.

My problem is however, that I dont know whether my machine may be infected with the exploit since visiting the site, or whether it has been there for a longer period of time... in other words, did the exploit get generated from my machine, or has some other incident caused it to happen?

Dan.

If you have Javascript enabled in Adobe Acrobat on any computer (I believe Adobe released an update fixing this issue) where FTP passwords are stored, and you simply visit a site with the malicious Javascript code, your FTP usernames and passwords will be accessible. This buffer overflow exploit is also possible using a malicious .swf file, but since it’s a more difficult exploit, it’s not really used much to my knowledge. Please note that your computer will be vulnerable visiting any infected site even with Javascript turned off in your browser since the Adobe plugin’s Javascript settings are independent of your browser (I test this with a computer on an infected site with Javascript disabled). Once infected, the malware disabled my antivirus and antivirus updates, then created FTP login attempts to a remote IP (the IP of the hackers) which captured my FTP login attempts.

The only thing that could be easily detected on hacked sites is that the exploit requires an iframe to open the initial malicious .pdf file.

Before running a virus scan, install malwarebytes (or similar malware scanner). It’s free if you do not use real-time protection, and it’s likely whatever antivirus you are running is not functioning properly at this time. You could also reset firewall settings so that every program needs permission before accessing the Internet, then re-approve applications you are certain are not malicious. If you are using Windows, have system restore enabled and you can pin down when you were infected, you can try to restore to a point before you were infected (I have not seen any manipulation of System Restore by this exploit).

Steven

Thanks all for your help - will keep you posted as to how I get along with this - that is indeed a dangerous expoloit, anf there doesnt seem much written about it anywhere

Please note that this attack is NOT specific in any way to MODX CMS - but if you’re a web designer / developer / manager using FTP clients, then you should take particular care. Been trying to hunt down the trojan on my system that is supposedly responsible for this hack - not having much success.

For anyone interested in more information, take a look at this article.


http://www.webologist.co.uk/2009/05/gumblar-virus-threat-to-the-internet-how-to-remove.html