General Support2 edb Apr 26, 2009 03:26
b2evolution CMS Support Forums- Miscellaneous
- Chat away
- ATTENTION bloggers! Hackers are mad and hungry
1 sam2kb Apr 26, 2009 02:06
3 sam2kb Apr 26, 2009 03:44
Was the file size noticeably different? For example my conf/_basic_config.php file is 4716 bytes according to my FTP program.
The infected file was around 6 kb (original file content + the first block I posted above). A good start is to check the file modification date, and of course open if in text editor afterwards just in case :)
Was the file CHMOD'd to facilitate installation?
Probably, but sure not to 777. Maybe 666 or 644
Any other info that might help shed light on this? For example PHP version?
PHP 4.4.6
MySQL 4.1.22-standard
Oh and do you suppose SuPHP (I'm pretty sure that's the name of the thing) can protect someone against this?
I think it's installed, not sure about this.
4 edb Apr 26, 2009 03:51
sam2kb wrote:
Oh and do you suppose SuPHP (I'm pretty sure that's the name of the thing) can protect someone against this?
I think it's installed, not sure about this.
I wonder how one could learn if their server has it or not? I know I have it because the host told me in response to my problem, but I can't for the life of me find where to SEE that it is installed.
5 sam2kb Apr 26, 2009 03:56
Check the system tab in b2evo admin.
PHP running as USER: XXX
PHP running as GROUP: XXX
Their should be something unique, with numbers.
6 john Apr 26, 2009 05:37
Thanks for the heads up Sam.
Nothing on my 3.1 though I had malicious scripts in the previous 2# version.
I would love to have SuPHP but I have to have a Virtual Private Server to get it with my host. :(
My System tabs say..
PHP running as USER: apache (uid 48)
PHP running as GROUP: apache (gid 48)
PHP version 5.2.4
7 sam2kb Apr 26, 2009 05:41
I meant something like this
PHP running as USER: user_12345
PHP running as GROUP: user_12345
8 edb Apr 26, 2009 05:53
Cool. I was looking for a way to find out from the outside but I guess not. phpinfo says nothing about it - to the best of my abilities to interpret that stuff.
9 tblue Apr 26, 2009 13:26
It would be interesting why/how the code could be injected in the first place - I hope this isn't a vulnerability in the b2evolution core.
What Plugins do you have installed?
//edit: I wrote a little script to compare an b2evo installation with the fresh/unmodified b2evo files. [url=http://tblue.pastebin.com/f1edbe8f6]Get it here[/url].
To use it, you of course need the fresh b2evo files (download a release and unzip it). Then execute my script (you may want to redirect the output to a file):
php diff.php -d your_b2evo_dir original_filesIt will show something like this:
NEW - ../blogs/plugins/http_BL_plugin/_http_BL.plugin.php
MODIFIED - ../blogs/conf/_advanced.php vs. ../b2evo-release/new/b2evolution/blogs/conf/_advanced.php
--- ../b2evo-release/new/b2evolution/blogs/conf/_advanced.php 2008-01-23 17:44:28.000000000 +0100
+++ ../blogs/conf/_advanced.php 2009-04-02 22:52:47.000000000 +0200
@@ -30,7 +30,7 @@
*
* @global integer
*/
-$debug = 0;
+$debug = 1;
// Most of the time you'll want to see all errors, including notices:
// b2evo should run notice free! (plugins too!)"NEW" indicates that the file was added to your directory (doesn't exist in the fresh directory). If you don't know the file, check it...
"MODIFIED" means the file has been modified - the differences are displayed.
I've only tested the script on Linux, but it should run everywhere where PHP runs. You'll also need the "diff" utility.
//edit2: OK, to compare two directories you could also simply use diff(1). Weird I haven't thought about that (tired?). :|
10 sam2kb Apr 26, 2009 17:44
I think a hacker somehow stole an FTP login/pass and modified the files. There is only one user (admin) in that blog.
feed_importer_plugin
stw_webshots_plugin
I hope this isn't a vulnerability in the b2evolution core.
I don't think it is.
11 fplanque May 26, 2009 22:34
This kind of hacks happens on lousy shared hosts that do not use suphp.
Every client on the servers runs their php scripts under the same user ID. So if you leave one of your files writable (like the conf file), any other user on the server can modify it by running a php script in his own hosting account that is on the same server. They do not even need your username and password!!!
Here's how they operate: they signup with a stolen credit card. Then they hack all the other accounts on the same server. Then a couple of hours their account gets cancelled because of credit card fraud. nut they don't care bc they already infected everyone on the server.
You have 3 solutions for this not to happen to you:
- do not use shared hosting. But dedicated is expensive.
- be paranoid and change the permissions of all your files & folders. But you won't be able to upload images either.
- use a DECENT web hosting provider. Seriously, all major & serious web hosts use suphp now which gives you a break with those permissions issues. You don't even need to worry about them anymore. List of decent hosts:
http://b2evolution.net/web-hosting/
Some questions, if I may.
Was the file size noticeably different? For example my conf/_basic_config.php file is 4716 bytes according to my FTP program. Obviously that number changes from installation to installation, but if the hacked one was way off that then file size is a good clue for those with concerns.
Was the file CHMOD'd to facilitate installation? I'm pretty sure the manual says to change permissions to something so that b2evolution can write the values it needs if you want to edit the file during the installation process, but (last I looked), did not tell you to change it back after you were done installing.
Any other info that might help shed light on this? For example PHP version? Not that I know *why* those might be issues ... just that it comes up in this type of situation.
Oh and do you suppose SuPHP (I'm pretty sure that's the name of the thing) can protect someone against this? I had a malicious activity once, but it only affected directories I had opened to 777. Both my host and fplanque came up with SuPHP around the same time. A feather in both their caps eh? Not that users can go magically install that, but users MIGHT want to shop around for a host with it IF it can protect them against malicious activity.