Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Somehow, a "hacker crawler" is constantly inserting a harmful iframe-line into one of my files:

It's done automatically, and not by a person, I assume. I've changed all my passwords several times as well as the CHMOD of the file, so I assume this is somehow done on my site.

Any ideas how the crawler does this and how I can prevent it?

share|improve this question
1  
What system are you using? Is it your own, or something like Joomla? – Anonymous May 26 '11 at 20:28
php-fusion, and I know the flaw is because I'm using an old version, but I've unfortunately done too much modifying to switch to the newest version. I was hoping someone could perhaps point to possible causes anyway. – Anonymous May 26 '11 at 20:30
Check your server logs. – SLaks May 26 '11 at 20:32
Is your server patched? Firewall? That stuff exists for a reason. – vcsjones May 26 '11 at 20:35
2  
If you are using an unmaintained version of PHP-Fusion you should definitely either update it or ensure that your application is removed from any server accessible over the web. Otherwise you risk to be held liable for any damage your hacked applications causes (depending on the legislation in your country). – NikiC May 26 '11 at 20:35

migrated from stackoverflow.com May 26 '11 at 20:33

3 Answers

up vote 0 down vote accepted

Hmm... It's hard to say without seeing the page, and the code the drives it. I don't have any experience with that CMS, but, from what I can tell, it looks like it is being inserted into, then pulled out of a database, not a modification via FTP. If that is the case, I would:

  1. change your database password
  2. point the CMS to the same database, with the new password
  3. remove the iFrame, and see if the problem persists, with the new password

Usually things like this are a matter of trial and error.

share|improve this answer
up vote 1 down vote

Are you or someone who have access to this environment using Filezilla as FTP client?

If so, be aware that this program saves the clear password in INI files, and it's used by trojans to infect websites...

Path (Windows 7)

C:\Users[USER]\AppData\Roaming\Filezilla

Files

bookmarks.xml

recentservers.xml

share|improve this answer
up vote 0 down vote

The easiest way I know of to find a vulnerability of an outdated version of software is to look at the change logs of the next version up. See what was fixed in the newer version and start looking there. (This would likely include all outdated software IE ftp client, your server software, your CMS and so on).

Also if you have a backup from before the issue occurred revert back to that using SSH or A different ftp client rather then your ftp client if you think that is where the issue is.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.