Hacked by Russians!

[JenniFranks]

While updating content on a client's website, I noticed an odd include in the footer. When I checked, I discovered someone had installed sape.ru's affiliate program as a tiny link in their footer and it was linking to child porn. I restored the site from backup and warned the client. Let is be a warning, maintain backups and be vigilant about security!

 

[Grizzy]

Report that shit to the police as well!

 

[Deleted member 21250]

http://www.youtube.com/watch?v=D4OtxqTD32Y

 

[JenniFranks]

Report that shit to the police as well!

That's up to the client. I urged them to, but I doubt they will. For all I know, they could have installed the affiliate code themselves. Doubtful though.

 

[Grizzy]

That's up to the client. I urged them to, but I doubt they will. For all I know, they could have installed the affiliate code themselves. Doubtful though.

Screw the client, cover your own ass. Aside from the moral issue, in some places it is a criminal offense to fail to report such a thing. I used to work in IT, and I know of a network admin who got into very serious trouble becuase he handled a similar situation very poorly.

 

[JenniFranks]

Done, I reported the site in question.

 

[wrangler]

You do realise that when you restored from backup, you restored it to the state in which it was, obviously, hackable. You should ensure that you keep it offline until you figure the vector you were hacked, and fix it, m'kay.

 

[Marketing Jhonny]

Russians suck sometimes... and meh just block all outlinks from the site!

 

[Autumn]

If they got root on your box you have to do a clean install, they could have left any number of backdoors on there.

 

[sfidirectory]

When will these Russian hackers ever learn? I'm not hassling Russians in general, as some of them are pretty good at legal things online (I think there is a Russian BHW Admin/Moderator on here, not sure though), just some of them tend to ruin Russia's reputation. It's the same with China, I hear of all these hackers sending worms and backdoors etc and infecting websites and computers. The Chinese are very clever and innovative, and they actually do alot of good (apart from human rights issues), just a group of Chinese people go the extra mile to give their nation a bad name.

As for the child porn, you must report it, seriously! I have a very young boy and if someone ever sent me that shit I will track them down and make sure they get what they deserve, no matter how long it takes. If you or your client has children, you would have no hesitation in reporting this crap (if you havn't done so already).

 

[madoctopus]

Are you using FileZilla FTP client? I had the same problem and it was because I had the password saved by FileZilla and there is an ezploit/virus that exploits FileZilla and uploads a JavaScript injection in all your site's files (in footer). In my case it was trying to download an .exe on the client's/visitor's computer. It may not be just FileZilla that is exploitable but other FTP clients too.

Also, the host might be exploitable for PHP file upload and execution (allow execution of PHP files in temp diectory). It could also be an XSS (cross site scripting) exploit.

 

[sfidirectory]

Are you using FileZilla FTP client? I had the same problem and it was because I had the password saved by FileZilla and there is an ezploit/virus that exploits FileZilla and uploads a JavaScript injection in all your site's files (in footer). In my case it was trying to download an .exe on the client's/visitor's computer. It may not be just FileZilla that is exploitable but other FTP clients too.

Also, the host might be exploitable for PHP file upload and execution (allow execution of PHP files in temp diectory). It could also be an XSS (cross site scripting) exploit.

I use FileZilla and I have had a couple of my sites infected. Been trying to find out how it happened for ages but you've explained it pretty well, hence the thanks given . Is there any way to get rid of the particular virus that causes the problems? I have McAfee full version (paid for by the way ), just not sure how deep in the syste this virus resides. I also noticed that the injected code was at the top of my site's PHP files. My PHP knowledge is still growing, but I'm guessing because it is server side script it's how the virus can do all this, as opposed to HTML.

 

[Kid Shaleen]

I also recommend that you report the matter to the authorities. The whole kiddie porn issue is a major one internationally that you don't want to run afoul of, for any reason whatsoever.

Also, as I recall from having checked a couple of Russian providers a while ago, their TOS's tended to list four violations: 1) kiddie porn; 2) illegal drugs; 3) illegal weapons; 4) Nazis (whatever their politics today, they're Russians afterall, and they've long memories.)

So I think you should also inform the service providers about what's being done on/with their systems.

 

[JenniFranks]

Are you using FileZilla FTP client? I had the same problem and it was because I had the password saved by FileZilla and there is an ezploit/virus that exploits FileZilla and uploads a JavaScript injection in all your site's files (in footer). In my case it was trying to download an .exe on the client's/visitor's computer. It may not be just FileZilla that is exploitable but other FTP clients too.

Also, the host might be exploitable for PHP file upload and execution (allow execution of PHP files in temp diectory). It could also be an XSS (cross site scripting) exploit.

all of our dev machines are macs, so were using Transmit and the command line interface.
It's very likely a PHP exploit. I've since hardened the configuration. If anyone is curious and wants to try some penetration testing, PM me.

 

[JenniFranks]

I also recommend that you report the matter to the authorities. The whole kiddie porn issue is a major one internationally that you don't want to run afoul of, for any reason whatsoever.

Also, as I recall from having checked a couple of Russian providers a while ago, their TOS's tended to list four violations: 1) kiddie porn; 2) illegal drugs; 3) illegal weapons; 4) Nazis (whatever their politics today, they're Russians afterall, and they've long memories.)

So I think you should also inform the service providers about what's being done on/with their systems.

It's been reported to three authorities: One government and two non profits.

 

[houseaz]

penetration testing, PM me.

Sounds like an offer to me...lol...j/k. Actually the Filezilla thing was pretty serious BUT if you upgrade when it tells you to you ain't got nothing to worry about!

 

[smolodoys]

why do search engines even ranking that shit... specially the child porns it should be out of the .net period..

 

[LyNHS]

Assuming the "include" as in using PHP's include function ... why didn't you configure your clients server to not include any file that isn't on the same server, or have I got the wrong end of the stick?

If the link was actually embedded in the footer, then damn! Definitely report that shit to the Police!

 

[ivictus]

I got hit buy a java scripted webpage virus. I had passwords stored for FTP in Dreamweaver and WSFTP. I could see the page had some java script thing load and then I shut dowm my computer right away, but it was too late.

 

[madoctopus]

I used Malwarebytes Anti-Malware as my antivirus didn't detect that program. Malwarebytes did a good job identifying and cleaning it. Then, I wrote a custom PHP script to find the injected code and delete it.