Serendipity Forums

Hi,

Sometimes when I access my blog I get antivirus warnings about the site deathishere.ru and step57.info and so on. I think my blog is hacked, but when I search trough all files, I can't find the string "deathishere.ru" or "step57.info". Then I searched the database for this string, but I can't find it too. Then I tried to search the pagesource (an error occured about that sites but I can't find it in the source). Does anybody had the same problem or any idea what I can do. It appears no every time and I can't reproduce it. But when I access the page from a new computer then I allways got this.

Greets and best regards,
Dawn

Dawn,

Your site has been hacked and the page that it is pulling up tries to gain your user's data. I suggest taking your site offline ASAP until we can figure out exactly what was done.

I am looking into the sites listed and they are both script kiddie sites. I will keep looking to see what the issue is.

Zac

Hmmmm That sucks...

I'll take my page offline as soon as possible. But as I wrote, I can't find the include of these sites and till I get the problem it doesn't help me to take my blog offline.

Can such code included trough adsense? The only other external resouce I include is some videos from youtube and dailymotion.

Chickens helped me to investigate this a litte bit, we've found out there was some code included in the index.php in the root of my serendipity installation. It has the following permissions:

-rw-r--r-- 1 www-data www-data 19819 2006-11-14 10:22 index.php

This code was inserted:
Serendipity has the owner/group www-data:www-data. I'm using Serendipity 1.0.4. Have installed the following plugins:

Sidebar:
- Calendar
- Quicksearch
- Archives
- Categories
- Syndicate This Blog
- Blog Administration
- AdSense
- Show tagged entries

Event plugins:
- Markup: Serendipity
- Markup: Emoticate
- Markup: NL2BR
- Browser Compatibility
- Spam Protector
- Autosave entries
- Spartacus
- Sitemap Generator (for Crawlers)
- GeoURL
- Show links to services like Digg, Technorati, del.icio.us etc related to your entry.
- Tagging of entries

I don't think my server was hacked because I don't have such code includes on other pages than my blog.

Does anybody have an idea?

Nice job, chickens!

(When did anyone ever think they'd be saying something like that?)

It looks like a hack to me, unless it's some kind of advertising. That's unlikely, though.

With those permissions, it's highly unlikely that hack originated from Serendipity. We don't have anything that overwrites files in the template directory, least of all among those plugins. It might have originated from lower in the code chain: PHP, Apache, even a system administrator. Or a hack into your actual account.

Why not change everything? They're script kiddies. They don't know better. If it's a PHP hack, they might have been unable to get anywhere else.

I hope everyone keeps an eye on this. If we see similar attacks on other Serendipity blogs, we'll have to assume it's something in our code and do a more thorough audit.

Do you see anything in your Apache access logs including "popupka" or "iframe" in any of its requests? If it's a PHP attack, that might show us exactly how they did it.

judebert wrote:Nice job, chickens!

(When did anyone ever think they'd be saying something like that?)

Yeah, yeah. Thats what happens when you are playing a game and someone calls you a chicken-- the name sticks.

As for the security aspect, I had a friend who is a white-hat look for holes and he was only able to find problems in versions 1.3.x and below. He then tested my personal site for mySQL injections or XSS and was unable to find any problems. This could also be due to the fact that I run mod_security along with a fairly hardened (secured) Linux box.

I will continue to look for problems as time goes on, but for the moment I do not see anything in the wild that might cause a issue.