3

I have a website built on Joomla/PHP and it was going well until I found a RewriteCond directive in my .htaccess file to a website with porn content.

RewriteEngine On
RewriteCond %{HTTP_ACCEPT} "text/vnd.wap.wml|application/vnd.wap.xhtml+xml" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "android|BlackBerry|htc|iPad|iPhone|iPod|kindle|lg|midp|mmp|mobile|mot|nokia|o2|opera mini|J2ME" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "palm|pocket|psp|sgh|smartphone|sonyericsson|symbian|treo mini|up.browser|up.link|vodafone|wap" [NC]
RewriteCond %{HTTP_USER_AGENT} !Googlebot-Mobile [NC]
RewriteRule ^(.*)$ http://seokirja.com [L,R=302]

RewriteCond %{HTTP:Accept-Encoding} gzip
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/index.php
RewriteCond %{REQUEST_URI} (/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$ [NC]
RewriteRule (.*) index.php
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]

The host company said that they have found some spam tries to some PHP files. I checked them and I've found some encrypted code.

I also checked file permissions and PHP functions, but it seems OK.

How can I avoid being the victim of this hacking method?

Improve this question
4
  • This question is off topic here. System and network administration -- Server Fault participants are much more likely to know the technical details on topics such as DNS and Apache configuration than people who answer questions here.
    – Rob
    Mar 13, 2016 at 13:28
  • 4
    @Rob Securing a website is very much a webmasters question, as is DNS and Apache config/htaccess. Although this question could perhaps be considered overly broad.
    – MrWhite
    Mar 13, 2016 at 17:59
  • "How to avoid getting hacked" could be the title of an entire book. In fact entire books on the subject have beet written. This question is too broad, there is no way that a good answer can fit here in the space allotted.
    – Stephen Ostermiller ♦
    Mar 14, 2016 at 0:58
  • @w3dk Questions about both DNS and Apache configuration are specifically stated as off topic as I quoted from the FAQ for webmasters.
    – Rob
    Mar 14, 2016 at 1:47

2 Answers 2

Reset to default
4

No hacking method has been described, rather the result of an unknown method of access that has allowed the ability to change or add files to the server filesystem.

First step is to find out how they got in to change such a low level file. You need to determine whether:

  1. They were able to gain access to either your cPanel, ssh or sftp via weak, guessable passwords.

  2. They were able to gain access via hacking a workstation that was used to maintain the website.

  3. Joomla or its plugins have not been kept up to date or have a vulnerability that allows them to get server file write access.

  4. They were able to gain access to Joomla's backend and install a file manager that allows them to modify files on the server.

  5. Other scripts created by you or your website maintainer have serious programming flaws.

  6. Server configurations were lax and allowed other means of injecting files onto the server.

Only after the method used to break in has been determined and fixed can you begin to either cleanse the server of these scripts or better yet, nuke the server and restore from known good uninfected backups.

Improve this answer
2
  • Yep. The OP was hacked alright! Gotta get it straight or something worse will come along!!
    – closetnoc
    Mar 13, 2016 at 4:48
  • 1
    Answer in four words: secure the damn server. But the Fiasco Labs guy gave good detail on what I mean.
    – Mike -- No longer here
    Mar 13, 2016 at 4:53
3

Cross-site scripting (XSS) is a type of computer security vulnerability. XSS enables attackers to inject client-side script into webpages viewed by other users. Add this to the .htaccess file in the website main directory.

<IfModule mod_headers.c>
Header set X-XSS-Protection "1; mode=block"
</IfModule>

This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so the role of this header is to re-enable the filter for this particular website if it was disabled by the user. This header is supported in IE 8+, and in Chrome (not sure which versions). The anti-XSS filter was added in Chrome 4. Its unknown if that version honored this header.

Source:
https://www.owasp.org/index.php/List_of_useful_HTTP_headers

Improve this answer
7
  • 1
    What does that code snippet do?
    – MrWhite
    Mar 13, 2016 at 17:29
  • Quoted from the OWASP website: "This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so the role of this header is to re-enable the filter for this particular website if it was disabled by the user. This header is supported in IE 8+, and in Chrome (not sure which versions). The anti-XSS filter was added in Chrome 4. Its unknown if that version honored this header. - X-XSS-Protection: 1; mode=block"
    – Vasko
    Mar 13, 2016 at 18:12
  • Note that mode=block trows 500 error.
    – fiskolin
    Mar 13, 2016 at 18:27
  • 2
    Apache config directives should be on separate lines. <IfModule>, Header and </IfModule> should all be on separate lines - that's probably why you are getting a 500 error, if you've copied the code verbatim. You are also missing a double quote at the end of "1; mode=block, although that's unlikely to be the cause of this particular error, it could result in the wrong value being set.
    – MrWhite
    Mar 13, 2016 at 23:47
  • 1
    @w3dk I knew that need to be on separate lines, error was double quotes actually. Thanks. Also Vasko, answer edited.
    – fiskolin
    Mar 14, 2016 at 9:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.