eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Web administrators who host their domains on GoDaddy should check their source code again for rogue code that downloads malware, according to a security research firm.
Sucuri Security updated its Oct. 30 post warning about the latest malware attacks on GoDaddy-hosted sites with another note on Nov. 3. The research company was investigating reports of “another related outbreak of exploited sites on GoDaddy,” read the update.
The affected sites generally ran some kind of PHP Web application, such as Zen Cart eCommerce or popular CMS packages including WordPress, Drupal and Joomla, according to a post on GoDaddy’s blog. In a series of injection attacks, hackers were embedding malicious code into the site’s Web application, often through blog comments, according to Chris Drake, chief executive of security-conscious Web host provider FireHost.
According to Sucuri Security, the code, when executed, inserted a single line of PHP code into every PHP file on the infected site: eval(base64_decode, followed by a string of random-looking characters, that hides actual PHP code that is being run. This command basically sets up a redirect to a malware site running rogue JavaScript code that automatically downloads fake antivirus and other scareware onto the visitor’s computer, said the security firm.
With this code in place on every PHP file, any visitor coming to the compromised site is sent to the malicious domain and infected with malware. Because the offending PHP code is written in base64, it’s also not immediately apparent to the owner what that line is actually doing.
In the original post, Sucuri Security identified a handful of malicious domain names that were part of this attack. The malware authors responded by changing the domain names delivering the malware. Hackers switch domains frequently as antivirus vendors blacklist attacking domains.
A quick domain WHOIS lookup indicated that many of the attacking domains were registered under the name of Hilary Kneber. This is an alias often used by criminal groups and sometimes associated with ZeuS Trojan gangs, according to security researchers.
As Sucuri Security and GoDaddy both noted, this is not a GoDaddy-specific problem, as other Website hosting companies, such as Dreamhost and Network Solutions, have been attacked.
Sucuri’s researchers released a fix to help administrators clean up their code. It offers the file as a text file which Webmasters should rename as a PHP file and execute on the site to remove the offending lines.
The fix is a “very crude attempt” to clean up the attack, according to Richard Wang, manager of SophosLabs. While it would remove the malicious code from PHP scripts, there is “very little” error checking and “no way” to roll back changes if the script goes wrong, said Wang. If the comments on Sucuri Security’s site and other security-based sites are any indication, at least the fix appears to work, which is what affected site owners care about.
If site owners decide to apply the Sucuri file, they should first examine the code to assess any impact on site content before running, said Wang. He added that site administrators should back up the site before running any scripts, just in case.
GoDaddy-hosted sites have been slammed with one attack after another this year. In May, five of the top 10 malicious domains in May were part of the GoDaddy attack. It was attacked in two separate incidents in May, twice more in September and at least twice in October, according to Sucuri Security.
GoDaddy originally said the attacks were succeeding because site owners were running insecure or older versions of software, and until the bugs in the Web application were closed, attacks would continue. Sucuri Security provided information to the Web host provider in May showing the attacks were not in the application layer. GoDaddy at the time acknowledged there was a deeper internal problem, but had no updates.
GoDaddy has said that of more than 4.3 million hosted sites, these attacks impact less than half-a-percent of its customers.