Loading site search ...
I first came across this attack in late May of 2012. It had quite a recognizable and frequently updated type of malicious JavaScript code injected in the <head> section of WordPress blogs and iframe URLs generated by this script always ended with top2.html (now rem2.html)
It was a massive infection and many webmasters asked me to help them clean up their sites. I told them how to search for various pattern of malicious files and asked them to provide me with access logs and samples of the malicious code they found on their servers.
At first the hack looked quite mysterious:
- Webmasters sent me many backdoor files but none of them contained the malicious code I saw in infected web pages.
- In theme files, the <head> section didn’t contain any malicious code at all.
- While access logs showed some successful TimThumb attacks, I didn’t see requests to backdoors that updated the malicious code injected into the <head> section (and that code somehow changed every day).
- And the script injection was quite hard to track since it would usually disappear after the first check. You couldn’t tell whether webmasters really cleaned their sites up or the malware was simply hiding from you.
The mystery was solved when I got access to one of the infected sites.
Continue »»
