We recently got a call from one of our clients, plaining that their site has some "strange looking code" at the bottom of the page. We checked out the source code, and discovered that about 800 bytes of malicious javascript code had been appended to the templates/master file, after the </html> tag. I won't post said code because it looked particularly nasty.

As far as I can tell, there would be no way for this file to be edited in any way, unless someone had direct access to the server and/or FTP login details. The actual file itself has been modified, so that rules out any kind of SQL attack. Besides a person physically gaining credentials and hand-modifying this file, would there be any other logical explaination for what happened? Has anyone else had experience with something like this happening?

We recently got a call from one of our clients, plaining that their site has some "strange looking code" at the bottom of the page. We checked out the source code, and discovered that about 800 bytes of malicious javascript code had been appended to the templates/master file, after the </html> tag. I won't post said code because it looked particularly nasty.

As far as I can tell, there would be no way for this file to be edited in any way, unless someone had direct access to the server and/or FTP login details. The actual file itself has been modified, so that rules out any kind of SQL attack. Besides a person physically gaining credentials and hand-modifying this file, would there be any other logical explaination for what happened? Has anyone else had experience with something like this happening?

• javascript
• security
• virus
• malware

7 Answers 7

The places I'd check are:

• File modification times (to see when it happened)
• HTTP server logs for signs of funny-looking GET params (eg, ?foo=exec('...'))
• FTP server logs
• SSH logs (something similar happened to me once, and it was because someone gave out their password)

Also, I'd immediately restrict write access to all the site's files, just to be safe from the same attack (of course, the vector is still open, but it's better than nothing).

If the attacker doesn't have other file access, it's likely that there is an exploit in the code somewhere that allows the user to execute arbitrary code. Use of passthru(), exec() and eval() are mon problems here. If there is FTP running on the same machine, that's typically a strong attack vector as well.

I'm not sure that I would categorically rule out a SQL attack (especially a reflected one bined with the above exploits), but it's not clear that it would be one, either.

To your question, it could be either automated or personally targeted, it's hard to say with the level of detail given. As others have said, switch out as many passwords as you can, restrict access to the server, and then start inspecting logs to see where things went wrong. That will be more successful than ripping apart the app itself.

You don't specify, but if you are you shouldn't be using FTP on a production server anyway because it's inherently unsafe (among other things it transmits credentials in plaintext, making you easily prey to a sniffing attack). Always use SFTP.

If you are using plain FTP this is most likely the attack vector, particularly as modifying the files is all that as happened. If your machine has been pletely penetrated I'd have expected to see more than that.

Almost certainly promised credentials allowing someone to alter the code remotely. Is the server located on site?

Here is how I see it. Using an FTP program? Your ftp log files storing passwords, paths ect.. gets grabbed. The passwords get decoded.

Try not to store FTP passwords in the FTP client. Or do like above, use SFTP. We had a similar issue and seems to have e from one puter with a set of FTP logins. Also as this puter had many previous odd issues with it. Javascript would not work right, odd session timeouts or simply removed. Which to me indicates this puter had something on it.

Do make sure to find and remove any suspicious files in your website. If they had access to FTP, most likely they left a backdoor script somewhere which would enable them to upload/modify files on your website via a specific URL even after you change your FTP password or switch to using SFTP.

Try running the script found here if you're using PHP.

To detect a existing malicious code, I remend that you use a good anti-malware scan engine on the server to detect malicious code on the website´s files. Many times, the server isn't vulnerable, but the website is! To prevent this, use a Web Application Firewall that can take a look on every request to detect and block a attack attempt.