In the online world, a virus is used to negatively affect the people who own or view a website. Whether or not you own a website, it is possible for your personal information to be stolen when the site is infected. However, protecting yourself from viruses doesn’t require a Ph.D., nor do you have to be a developer or designer to do it. Informing yourself and having just adequate internet surfing skills is enough to allow you to identify them and keep your information safe.
What is a virus?
A virus is nothing more than a program written by a developer with bad intentions. Usually viruses are created to steal data stored on your computer. Some viruses target credit card information, others saved passwords. Sometimes a virus is implemented on a computer to turn into what we call a “zombie computer,” which the creator will use to attack other people’s servers and take them down.
Now, everyone has been targeted by a virus on their computers at some point in the past. Those who don’t think they’ve had a virus are just not aware that one ever existed. Fortunately, the last few years have seen an increase in the security of different operating systems, making them less vulnerable than they used to be.
During Windows XP’s heyday, viruses were extremely common and many computers operated with viruses. They were so common that people even got used to using computers affected by viruses. USB drives are the biggest culprits of storing viruses and helping them spread.
What is a web virus?
A web virus is a specific kind of virus that infects a website and steals information from its database and its users. This is a dangerous situation, especially for eCommerce sites that process credit cards for their customers. If the website is not meant for eCommerce, a virus will still steal passwords and other valuable information from the website’s database.
Our experience with viruses
We have a highly secure main server and a second server used for archiving purposes. When a project has been deemed inactive or closed, the data passes from the main server to the archive server. Of course, priority is given to the security of the main server because the data in the archive server is no longer useful. However, we still need to protect our archive server and data as well since, on occasion, we will need data / records from these projects.
We recently came across a virus and realized it was affecting all of the .php and .js files in the archiving server. So I started to analyze the problem to get a better understanding of what the virus was actually doing to these files, how it attacked them, and how we could clean them.
The security of web servers
Without diving into system administration, let’s take a look at the basics of how a virus is able to infect a website.
Apache Web Server, which has 65% market share according to Netcraft 2012, commonly runs PHP as a module. Within a web server, there is typically more than one website. Each website within a server can be called a ‘virtual host’ . A ‘virtual host’ allows web servers to serve more than one website over the same IP address and port. Apache Web Server also has a module called suPHP that is used to run PHP scripts with their own system user. I assume that the su in suPHP stands for “self-user”
An ideal web server would assign every website or domain its own system user and all of the files under it would be owned by that user. Using suPHP helps distinguish different users in a server. When a request is sent to the server and the server runs the PHP files within the website’s system user, the executed PHP files are not able to reach other system users’ folders, i.e. other website’s files.
Even though CPanel is the most used website panel in the world, it unfortunately comes with suPHP enabled in the default settings. This is a problem because it leaves your website vulnerable.
The drawbacks of suPHP surface when PHP runs with the website’s system user and that system user is able to write all of the files and folders in its own home directory. While that may seem handy to you because of the ease of uploading files through your website’s admin panel, it is actually a security issue. In a secure website environment, only the “Uploads” folder (and maybe the “Temporary files folder”) should be writable. The rest of the files and folders should not be writable at all. This was the main reason why the virus that infected our archive server was able to do so. The virus was able to write into .php and .js files.
Avoid multiple-domain hosting like HostGator, BlueHost, and HostMonster
If you have more than one website, the plans offered by host providers like HostGator and BlueHost may seem attractive. They offer multiple-domain hosting with unlimited storage and bandwidth for $10/mo – sometimes even less.
The problem with multiple-domain plans is that these hosting providers will execute all of your sites using the same system user. If one of your websites becomes infected, it leaves the rest of your sites vulnerable since that site can write to every file in your account – even those of another website. Obviously, this vulnerability can be disastrous.
So while the price is cheap, and therefore attractive, think twice when considering multiple-domain packages from these hosting providers; or buy the higher-priced, more secure packages like reseller, VPS or Dedicated. While you take a bigger hit initially, using a single, distinct package for each one of your websites is the best option to save time, money, and stress in the future and to ensure that your sites are safe.
The virus code that was in our .PHP files
Now comes the interesting part – the code piece that was written into all of the .php files in our archive server.
The code doesn’t make any sense because it is encoded. However, if we decode it, you can see that it actually says:
[cc lang=”php” escaped=”true”]<?php
@include_once “/home/…/public_html/…/wp-content/themes/revolution_business-10/plugins/wp-gbcf/wp-gbcf_themes/wp-gbcf_images/ymguw.php”;
?>[/cc]
The attacker was able to create a file in the WordPress blog and injected that code piece in all of the .php fileswhich would include and execute the malware file that was created.
The “@” symbol at the beginning of “include_once” means “Don’t display an error,” which means that the malware remains silent within the system, not producing errors that would give away its presence.
And while I would have liked to explain the contents of ymguw.php, it appears that the anti-virus software we use for our archive server has deleted it. This is ultimately a good thing because this virus didn’t harm us. Still, others may not be so fortunate.
A second Javascript virus
Now I’m going to share another encrypted code piece with you, but since it is not working, I did not take the time to decode it myself. Luckily the execution was halted by the browser, and so we were fortunate in not being affected by this virus either.
However, if you want to decode it, go ahead and share your results with me in the comments section. I’ll even include them in a future article!
[cc lang=”javascript” tab_size=”2″ lines=”10″]
/** 7d508557b75c2ca9fe5d55e065da96d4 */
var RMHGz;var yIiC;function SiFT(){var mgdKe=’XppNgi’;if(‘DMVIn’==’qqJXy’)uTWX();}var XkWW;var LKxhI=”a6a35d6565ab9eb3a6a49eb1acaf6bb2b0a2af7ea4a2abb16baa9eb1a0a5656c8a908682
[/cc]
So how did I find the virus?
Our COO, Duran Inci, told me that one of the admin panels in WordPress was not working in the archive server. So of course, I went ahead and checked it and found that the Javascript code was halting the execution and realized that this was due to the virus. I proceeded to download the entire website to my computer and began analyzing it. As I continued to analyze it, I found that the virus had infected the .php and .js files as previously mentioned.
Always watch out for unexpected behaviors on your website!
What was the purpose of the virus?
At this point, I cannot determine what the main purpose of the virus was or how the attacker was able to upload the file. However, if you want to protect yourself from situations like this:
• Be careful with plugins and themes you install. Always use ones from trusted sources.
• Always update your plugins and themes.
• Always update WordPress itself.
• Don’t use multi-domain shared hosting where all websites reside within one account.
• Keep an eye out for unexpected behaviors – they may be due to a virus.
While we weren’t harmed by the virus (thanks to the archive server’s anti-virus software), remember that not everyone is so lucky. So be sure to take precautions to ensure that your website(s) is secure as possible.
How can we clean our files?
You could do a clean installation of WordPress and reinstall all of your plugins and themes while keeping the database intact, but that is time consuming, laborious work. There’s a better way.
I used “find-replace in files” logic. Using Notepad++, I opened the Find in Files window and removed those code pieces.
To remove the Javascript infection, set search mode to “Regular Expression” in the Notepad++ Find in Files window and check the “. matches newline” option, which you should find near the Regular Expression. Then use this pattern for the “Find What” box and leave the “Replace With” box empty.
“Find What” pattern:
[cc]
/\*\* 7d508557b75c2ca9fe5d55e065da96d4 \*/.*/\*\* ~7d508557b75c2ca9fe5d55e065da96d4 \*/\n
[/cc]
To clean .php files, you don’t need a pattern because all of the code is in one line. Just set Search Mode to Normal and copy/paste the infection code into the Find What box and replace it with nothing.
Contact Us!
If you’re having security issues with your website or are looking to build a website with a company who knows what it takes to make it secure, contact us today! We also offer customized application development plans that may suit your needs. The initial consultation is free.
Editorial by Jani Seneviratne.
