Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I can't tell why my site is showing malware warning.

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 44 posts

Re: Ask HN: I can't tell why my site is showing malware warning.

#21

Post by balsamiq »

pierrefar wrote: post #18

Hi I work at Google helping webmasters. Hopefully there won't be a next time, but for reference, your best bet is to post in our forum specifically about this type of issue: http://www.google.com/support/forum/p/Webmasters/label?lid=2... For your specific case, unfortunately it can be anything. Start at the HTML and JS and see if it's different in ways you don't expect. Check for obfuscation techniques like base64 en…

Hello Pierre, thanks for chiming in, I appreciate it.

So it appears that we were in fact compromised. The problem is that the Webmaster tools didn't show this until a good 30 minutes after the browsers started complaining. How can this be? Now I feel terrible for posting this in the first place, I would hate to compromise anyone! :(

Re: Ask HN: I can't tell why my site is showing malware warning.

#22

Post by danielh »

DanielStraight wrote: post #20
bphogan wrote: post #17

Earlier quoted context omitted.

Happened to seven WP sites I maintain. It's a script and someone got into an account. The script finds all .php and .htm files and adds stuff to the top. If you only have wordpress files, it's an easy fix - reset the password and get a different template.

What does the attack do for those who visited the site trying to figure out what was going on?

The malicious script only inserted an iframe with a broken link, so I wouldn't worry to much.

Re: Ask HN: I can't tell why my site is showing malware warning.

#24

Post by rkalla »

Peldi, something similar to this happened to me for a number of years (I've run my own WP site for 6 years now); every 3 months or so, no matter what I did to lock the site down it would get reinfected with malware.

It got so frustrating that I toyed with just taking the site down permanently a few times because I couldn't handle the maintenance burden psychologically (it was such a downer to be fighting the same fight every few months for 2 years).

BUT, I finally found out what had happened, apparently there are some f-ing ingenious ways people can hide hacks in your WordPress site.

I outlined all of my steps here: http://www.thebuzzmedia.com/finding-and-removing-hidden-word...

The basic trick boils down to uploading a fake HTML or image file that is actually a PHP script that hides in your server folder and is executed by the running process every few weeks which then infects all the other files (adding in JS headers or footers to every template file).

Another nasty trick is to use the same mis-named file uploaded into your /uploads directly, but to register it as one of your WordPress plugins. So if you search the WP database plugin table for non-PHP extensions you might find a "plugin" registered as "/uploads/2011/06/profile.jpg" when in reality it is a PHP file and not an image that WordPress is executing.

The blog post outlines how to find and remove them, I'd also recommend against running WordPress with permissions that don't allow writing except for the /uploads directory.

This means no more automatic updates inside of WordPress, you'll have to do them yourself (same for plugins) but it also means no more hacks getting through and writing themselves to your DB or file system. They can even upload themselves but then cannot effect the system in anyway because the executing process has no write perms.

It has just been a lot easier for me to run in that fashion and keep everything up to date manually.

Hope that helps!

Re: Ask HN: I can't tell why my site is showing malware warning.

#25

Post by Matt_Cutts »

Sorry to hear that you got infected. You're getting good advice from pierrefar and others here, but here's one other tip: once you get your site back up, you can doublecheck that you're not infected by using the "Fetch as Googlebot" feature in Google's free webmaster console.

When you use Fetch as Googlebot, we actually send a crawler to your site, fetch the page you request, and then show you exactly what Googlebot saw. It's an extra way to tell if you've gotten rid of the hacked junk.

Re: Ask HN: I can't tell why my site is showing malware warning.

#26

Post by Matt_Cutts »

balsamiq wrote: post #21
pierrefar wrote: post #18

Hi I work at Google helping webmasters. Hopefully there won't be a next time, but for reference, your best bet is to post in our forum specifically about this type of issue: http://www.google.com/support/forum/p/Webmasters/label?lid=2... For your specific case, unfortunately it can be anything. Start at the HTML and JS and see if it's different in ways you don't expect. Check for obfuscation techniques like base64 en…

Hello Pierre, thanks for chiming in, I appreciate it. So it appears that we were in fact compromised. The problem is that the Webmaster tools didn't show this until a good 30 minutes after the browsers started complaining. How can this be? Now I feel terrible for posting this in the first place, I would hate to compromise anyone! :(

As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected.

It's a pain to get hacked, but on the bright side it will probably help you harden security in the longer run. Some quick, simple tricks (e.g. use an .htaccess file to make a whitelist of IP addresses that can access your /wp-admin/ directory) can give a lot of protection.

Re: Ask HN: I can't tell why my site is showing malware warning.

#27

Post by Matt_Cutts »

danielh wrote: post #22
DanielStraight wrote: post #20

Earlier quoted context omitted.

What does the attack do for those who visited the site trying to figure out what was going on?

The malicious script only inserted an iframe with a broken link, so I wouldn't worry to much.

I would still worry a bit. Some hackers will show a broken link if you're accessing a page directly with no referrers, for example. But if you come in with a referrer or from a search engine, then they might return the malware payload.

If a site was showing up recently in our malware list, it's practically certain that an actual user downloaded malware via the site.

Re: Ask HN: I can't tell why my site is showing malware warning.

#28

Post by balsamiq »

Matt_Cutts wrote: post #26
balsamiq wrote: post #21

Earlier quoted context omitted.

Hello Pierre, thanks for chiming in, I appreciate it. So it appears that we were in fact compromised. The problem is that the Webmaster tools didn't show this until a good 30 minutes after the browsers started complaining. How can this be? Now I feel terrible for posting this in the first place, I would hate to compromise anyone! :(

As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected. It's a…

Wow a reply from Matt Cutts himself! _blushes_ :)

Thanks for the explanation, and it makes sense. One thing I would suggest is to update the docs to point this out!

"Please trust the warning over what Webmaster tools says as they might take a while to update".

Love the idea of the .htaccess for /wp-admin/, I'll make sure the WPEngine guys implement that for our site.

So sorry for this whole hoopla everyone, and thanks for the help.

Re: Ask HN: I can't tell why my site is showing malware warning.

#29

Post by tonywebster »

Maldet is an awesome open-source linux program that searches a directory for malware signatures. http://www.rfxn.com/projects/linux-malware-detect/

I've used it dozens of times successfully, and with WordPress sites, it's usually a PHP backdoor uploaded into wp-content/uploads, and then compressed JS added into a file somewhere. Run it with -a.

Good luck!

Post reply on HN