Modx Evo site infected by javascript redirect script

Quote from: smashingred at Jun 18, 2014, 08:17 AM

What version of Evo are you running and are all your add-ons/extras up to date?

At the moment of attack it was MODx Evo 1.0.4 (it was of course my fault not to update the system from time to time)

Quote from: sottwell at Jun 18, 2014, 08:25 AM

That code got into the index.php somehow. Most of these seem to be activated by malicious scripts hidden in the filesystem. Check your files for anything newer than all the rest, or older if you have just upgraded.

I agree that it can help in similar cases, but there is a chance that the file creation date will be modified by the malicious script, so you won't find the file only by this criteria. However, it can be helpful in some cases, too) thank you for idea)

Quote from: sottwell at Jun 18, 2014, 11:06 AM

Revolution does allow for the renaming of the config.inc.php file, as well as renaming the manager, core and assets directories, and even moving the core outside of the web root. The index.php and other critical files can be set as read-only as well, at least on most system.

That's a good note, too. I will follow your advice with new sites on Revo.

Quote from: smashingred at Jun 18, 2014, 03:45 PM

It should also be noted that in later versions of Evo, some of the key files are monitored and there is an alert to warn you of changed/altered files. It can only tell you that you've been hacked, not prevent them in the first place.

Jay, is this function active by default, or it must be installed and activated manually? I didn't hear about it yet.

I forgot to tell you one more important detail. When I discovered that some my sites are hacked and didn't find the solution yet, I decided to make copy of their files first, just in case. I connected via FileZilla to FTP and copied all, but namely the index.php files of the root directory could not be copied (they were read-only). I could copy them only after execution of chown command on them.