|
|
|
investigating a hack
Tuesday, December 1 2015
As you might recall, a couple weeks ago I complained about a mysterious browser hijacker that was replacing web pages on Asecular.com with ads for Cialis and other medications for the aging penis. At first it seemed like code that had burrowed itself into the Chrome installation, though I was never able to track it down. I was forced to run Spybot Search & Destroy and hope that one of the many things is found and destroyed with the hijacker. There was another, similar hijacker infecting Firefox at the time (it animated static images and turned them into advertisements), and that was easy to find and remove from the Firefox add-ons. But periodically I'd see evidence that there was a hijacker insinuated deep in Chrome. Today, though, it became obvious. Every page on Asecular.com had been turned into an ad for Viagra. (For some reason this ad featured two young-looking actors getting ready to get it on.) At first, though, this still seemed to only be a Chrome problem. And even then I could navigate to the Asecular.com pages if I had the direct URL. I only got redirected to the Viagra spam if I used the URL of the Google redirect delivered with a page of Google results. (Google doesn't produce direct links in such result pages; instead it produces a links to a Google-hosted redirect so that it can track which links are being clicked on.) And redirects delivered in Google Chrome didn't lead to spam when followed in Firefox. This made me think Firefox wasn't affected. But then I did a Google search for an Asecular.com page on a Linux laptop, clicked on a link on a Google result page, and again saw Viagra spam. This was my first indication that the problem wasn't in Chrome or on my computer at all. I soon confirmed that this problem also happened in Firefox if I did a Google search for an Asecular.com page in Firefox and then clicked on one of the results. Could the problem be my DNS server? But the problem persisted even when I changed that. The only thing left in the house that could be harboring the hijacker was the DSL router, but the problem persisted even after swapping that out. Now I knew the problem was upstream from the house. My first suspect was Verizon, an evil corporation with a long history of laziness, malevolence, and sociopathy. It wouldn't surprise me if they'd compiled a list of obscure websites (like Asecular.com) and sold browser hijacks for their Google search results to shit-bag companies purporting to sell Viagra and Dr. Oz's fat-burning tonics. Verizon already sells search results on pages they deliver in place of domain-not-found messages (if you use their DNS server). With this in mind, I posted the following into the forum at DSL Reports:
Perhaps other Verizon DSL users can help me investigate this. I started noticing that some web pages I administer had been replaced by ads for medications such as Viagra and Cialis. At first I assumed the problem was malware on my computer, but when I couldn't find any, I began to check those same pages from other computers in my house, and they also appeared hijacked, but only when reached via clicking on a link in a page of Google results. These results appear hijacked from Chromebook and iPad as well, which indicates that the hijacking code is not on the client computers. I have two different DSL routers, and the hijacking appears when using either one, even when the router is only connected to the DSL line and the only attached computer is one running Google Chrome over a WiFi connection. This suggests the hijacking is happening upstream from my house, somewhere in Verizon's network. I'd be curious if others are seeing this too, since it could affect many people if it is upstream from me. Here's a test: do a Google search for "redneckistan" and click on the link for "Redneckistan Homepage - Asecular.com" -- if you see a Viagra ad, you're a victim of the hijack. (If you go directly to http://www.asecular.com/ran/terms/redneckistan.htm you will not see the hijack.) Thanks for any help on this matter!
Before long, others had helpfully posted that they were also getting the Viagra ads, and some of these people weren't on the Verizon network. Now it was looking like the problem might actually be in my web hosting environment, or perhaps the hosting company, Godaddy.com (which is every bit as sociopathic as Verizon). I would have been delighted to pin this on Godaddy.com, but none of my tests indicated anything odd about their DNS (name) servers. So then I took a hard look at my website. And this was how I came to find that someone had placed an .htaccess file in its webroot. The effect of an .htaccess file is to catch web requests before PHP or most of Apache gets ahold of them. Using the arcane syntax of .htaccess, a skilled user (or hacker) can hide or redirect URLs according to a tight set of rules. This is what the .htaccess file I found looked like:
This would have had the effect of redirecting to a file called indigent-grievers.php if any incoming web request had been referred by any of the major search engines. Sure enough, the file indigent-grievers.php was also in the root of the server, though its specific behavior was impossible to ascertain:
Its affect was to deliver ads for penis pills, but what else might it be doing? I certainly can't tell you. But the upshot of all this is that someone managed to get those two files onto my server on November 1st, and they've presumably been sending my search engine traffic to penis pill purveyors for a whole month. It's surprising that when a hacker gained access to my site that this was all they could think to do with it. But perhaps that's the only or best way to monetize such an obscure domain; it's not like I have passwords or credit card numbers stored there (or child pornography with which to blackmail me). This is the first evidence I've ever had of any part of my computer-resident life being hacked, and yet the affect was minor and easily-reversed. It's not as if my password is easy to guess, but for the past 19 years I've been using old-school FTP to upload files, and I know that you're really not supposed to do that because FTP passwords are sent over the internet in plaintext.
So I went to Godaddy.com in hopes of changing my password and migrating to SFTP, but their website is just as much of a mess as it has ever been, with loud clashing colors trying to sell stuff and anything one would ever want to do hidden away. Eventually I found a way to transfer my site to a server providing SSH, but then pulling the trigger on that locked me out of making any changes to the password until the process concluded. According to the nice young man I talked to at Godaddy tech support, that could take 24 hours. In the meantime, I just have to hope that either my hacker has forgotten about my website or never really had that much access to begin with.
For linking purposes this article's URL is:
http://asecular.com/blog.php?151201 feedback
previous | next |
