Comments on: Malware on Hijacked Subdomains. New Trend?

By: Jayson Feidler

Jayson Feidler — Wed, 10 Nov 2010 19:26:45 +0000

Isn’t this a rather old method that hackers have been doing for a while now? I have found several reputable sites that host malware because either the webmaster did not update the infrastructure such as a wordpress install, or the hacker has basically taken control of the site inserting his scripts.

Google is now starting to weed out these sites and not list them on search results.

By: Phishing – Alive and kicking | Naked Security

Phishing – Alive and kicking | Naked Security — Mon, 25 Oct 2010 01:28:47 +0000

[...] by a hijacked DNS server for a French construction company. This may be related to other reports of sub-domains being used to mask scam sites off of otherwise reputable domain names. The last four phishes I investigated have all referenced [...]

By: Denis

Denis — Fri, 03 Sep 2010 19:28:21 +0000

It’s good that you consider alternatives, however in this particular case we are not talking about WordPress (all types of sites are getting infected), and we have confirmed infection vector (via FTP).

By: Ruben

Ruben — Wed, 01 Sep 2010 06:43:36 +0000

The answer may seem obvious but it aint necessarily so. What if your Wordpress site has been infected by an SQL injection attack which has compromised the database and your tables and files have base64 encoded scripting inserted into them. Those three steps won’t help much…

By: Denis

Denis — Wed, 04 Aug 2010 20:01:31 +0000

Do you mean 0 bytes by empty? Note, sometimes hackers add several screens of blank lines before the actual code. This way files may look empty when you open them in a text editor/viewer and don't pay attention to the scroolbar (or there is no scrollbar in case of terminal editors like vi or nano)

By: Alex

Alex — Tue, 03 Aug 2010 20:32:57 +0000

I have 2 websites with a 302 redirect to electnate.com

I scanned the websites and didn’t find any inserted code. I checked the .htaccess files but they are empty even though they shouldn’t be. So I changed the file name in httpd.cong from .htaccess to .testing this way Apache would ignore any .htacess files and see what happaned. After ding this I ran the unmaskparasites tool again and it no longer found the 302 redirect for the sites but now I’m confused.

It seems that 302 redirect rule for electnate would then have to be in one of the .htaccess files that I had Apache ignore but, the .htaccess files are empty.

If I don’t have the .htaccess files then my websites don’t work properly and if I do have them somehow there is a hidden 302 redirect.

Why are my .htaccess files mysteriously empty?

I checked the entire server from root down, one directory at a time (it took hours) and there are no other .htaccess files other than the ones in public_html for each site but why are they empty and how come I can’t see the content?

By: Denis

Denis — Sun, 25 Jul 2010 15:00:35 +0000

Dan, Rogue A-records don't apply to hacked sites. They apply to the sites where your webpages redirect to. In your case, wiki.natebennettfleming .com is an A-record of natebennettfleming .com >I checked every level up to the root Did you check above the root?

By: Dan

Dan — Sat, 24 Jul 2010 07:07:30 +0000

- UPDATE –

Ok so since I could not find the redirect rule in any .htaccess and didn’t see an A-record I decided to:

1) Back the site up by changing the directory’s name since it was a addon domain.

2) Create a new/blank directory with the previous name.

3) Delete the addon domain from cPanel. This is why I created a blank directory because otherwise cPanel might have a problem deleting a site that didn’t have a directory found.

4) I readded the addon domain.

5) I deleted the directory that was automatically created when I added the addon domain again and then renamed the old directory that I previously named something else back to the original name.

That solved it!

Not sure how because their wasn’t an A-Record before but if there was somewhere or somehow by doing the above I erased my DNS zone records and started fresh. I never found any thing in .htaccess in fact I don’t have an .htaccess file for this particular site so if anyone one else comes across this hopefully this will help.

Best of luck :)

By: Dan

Dan — Sat, 24 Jul 2010 04:21:26 +0000

Hmmm, I have the same problem but my website is in flash and I don’t use an .htaccess file for this site since I don’t need any rewrite rules. When I visit my site as soon as I get to the home page my antivirus goes crazy and it looks like my sie is trying to redirect to wiki.natebennettfleming.com/main.php?e=r&h= which is on the list above.

I checked the DNS zone for this domain in my hosting panel and there isn’t an A record for any other IP other than my host’s.

Where else can I find where this may be inserted so that I can cure my site?

It’s not in DNS zone as an A-record and it’s not in .htaccess, I checked every level up to the root and I don’t have any .htaccess for this site.

Any help is appreciated.

By: Denis

Denis — Tue, 22 Jun 2010 13:57:19 +0000

Actually, while strong passwords are a really good practice, it doesn't matter how strong they are if hackers can simply steal them.