Code Injection Attempts linked to FTP?

[TechnoBear]

Thanks, guys, for the replies and helpful information.

@sparek

Since you said you are running Linux, I would think this would minimize the malware threat. I’m not aware of any such malware like this that runs on Linux, but that doesn’t mean Linux is infallible.

Are there other computers that have your login information stored on them? Perhaps one of those computers is infected.

I only ever log in from my own computer, which is a PC not a laptop and therefore only connects through my own ethernet modem and never a public wi-fi. It is not - and never has been - on any kind of network.

@sparek

From what you have posted in the logs, it looks like someone is trying to exploit your guestbook using the admin.php remote file include exploit - CVE - CVE-2007-1486 (under review) - which was fixed in version 1.7.3. The information you posted from the logs just shows that they are attempting to exploit this. It doesn’t necessarily mean that they are successful. If you are using version 1.15, you should be clear of this exploit. But again, this doesn’t mean that there isn’t another exploit in the script, but I don’t see anything being disclosed. Lazarus Guestbook is up to version 1.16 but it is in beta, so 1.15 should be safe of any KNOWN threats.

Thanks. That’s helpful and fairly reassuring.

@sparek

The only time these two types of exploits can be combined is if you have a script vulnerability that allows a malicious user to read the files on your webhosting account. And if you are using the same username and password in your script’s config files for MySQL access as your main webhosting account login, then those malicious users can steal that information and then log in via FTP.

Oh dear - I confess I’d never thought of that, although now it seems pretty obvious.

@sparek

You haven’t stated if you are using cPanel or not.

I am.

@sparek

If you have a config file for your script and if the script uses MySQL databases. If, in that config file, you use your main FTP username and password, then a malicious user that exploits the vulnerability in your script (assuming that a script on your account is vulnerable), then that person can read this information and then access your account via FTP. Because all that is needed for FTP access is a hostname (your domain name, which they obviously know) and a username and password (which was stolen from the config file).

Well, I’ve just had a wee panic and looked at the database and the config file. The MySQL username is the same as the database name and the password is pretty strong and is not the same as the main account password. As these are the default settings, I can only assume Lazarus is brighter than I am!

@sparek

With cPanel you can create separate MySQL username and assign them passwords. The MySQL username that is created will have your main username appended to it (in order to keep MySQL usernames unique in a shared hosting environment) so if you create a new username, but reuse your same password, then again all of this information is made available to the malicious user that exploited your site.

Bottom line, always use a MySQL user for accessing your MySQL database, and never reuse your main account password.

Thank you. I’ll remember that in future.

@sparek

Worth mentioning, the config file routine is not the only way a malicious user can glean information. If a malicious user gains access to reading the files on your webhosting account through a script vulnerability, then they could conceivably read any email that might also be stored on your webhosting account. If your login information is stored there, then again this information can be stolen.

Again, that’s something I hadn’t thought about, although it’s not a problem here. All admin e-mails for my various domains are sent to an e-mail address which is not associated with any of them.

@sparek

I would be more concerned with how these IP addresses are getting your FTP information to log into your account. I assume you are using a strong password, something that is not hard to guess, in that case you have a vulnerability somewhere.

That has been concerning me, too. As I say, the sites were hacked over a period of about a month. I was away for some of this time, or I might have picked up on it sooner. As soon as I discovered the problem, I changed all the passwords for all my sites (not just those that were hacked) and haven’t had any further problems. The passwords were all strong - mixed case, letters and numbers - and since I changed them, they now contain symbols, too. I never re-use old passwords and each account has a different password.

If I log into my cPanel using mydomain/cpanel, as advised by the hosting company, it resolves to port 2082, which is not secure. I hadn’t noticed this at first (oops again ), but since the hacks I’ve been very careful to login in using mydomain:2083, which uses https.

@Crazybanana

In other words: the kids know about these previous vulnerabilities, and are trying to exploit 'em…

But as sparek told ya, with 1.15 you should be safe for any known threats

Thanks again for the reassurance. I know I’ve been getting paranoid.

@Crazybanana

They probably used a vulnerability scanner, and maybe they postet the result log for others to have fun… maybe your site(s) listed as vulnerable on some forums etc ,because of the previous hack

Until recently, I had no idea such forums even existed. What a sheltered life I’ve led!

@Crazybanana

If everything is running the latest version/patches this may go away on its own - but I would monitor it anyway to keep an eye on whats going on

Since I started this thread, there have been another 34 attempts, much the same as before although from different IPs/countries. (Again, nothing targeting my other Lazarus guest book.) I find this really bizarre, not least because the site in question is a small local business, with only a handful of visitors per day and a couple of dozen inlinks, so I’m amazed that anybody has found it. The guestbook wasn’t on it when it was hacked.

Thanks again for the replies.

[rageh]

@TechnoBear

My hosting company won’t allow me to use SFTP or FTPS, so after three of my sites were hacked, I decided to upload files only through the cpanel file manager with a secure log-in.

Two days ago, I had quite a number of files to upload to one site, to update the guest book, so I used FTP for convenience and changed the passwords immediately afterwards. In the last 48 hours, there have been 38 code injection attempts on that site, all targeting the guest book. There were only two in the whole of the preceding two months, which makes me wonder if there is some connection here, although it’s hard to see what. None of my other sites have been targeted recently, including another one on the same server.

Is this just a co-incidence, do you think?

Code injection vulnerabilities are not easy to trace down. There could be a number of ways that such vulnerabilities can come about, many of which you ruled out. It is futile to speculate whether the a malware in your PC is the culprit or not. If you are in the Web business, you need to have SFTP period. If your host does not allow it(It is beyond me why now?), change it. Switch to another hosting company that only allow secure FTP. Even that does not guantee anything. But it could point the blame finger only in one direction.

[TechnoBear]

@rageh

If you are in the Web business, you need to have SFTP period. If your host does not allow it(It is beyond me why now?), change it. Switch to another hosting company that only allow secure FTP. Even that does not guantee anything. But it could point the blame finger only in one direction.

I also can’t understand why they won’t allow secure FTP. I have already moved some sites to another host, but I can’t afford to move them all at once. I’ve found several hosting companies that allow secure FTP, but none that only allow secure FTP.

All my sites are very small, which is why they’re on shared hosting. This one has fewer than 200 visitors per month.

[Stormrider]

I use a VPS - then I can set up and/or install whatever I want on there. I rarely use FTP now anyway, I’m usually logging invia SSH and rolling things out from SVN directly