Malware Analysis - Does only WP installation file cleaning makes you secure?

One word answer “NO”. This is based on my experience w.r.t cleaning Wordpress (WP) sites against malware attack. Hackers mostly attack CMS based websites i.e. WP and Joomla by inserting malicious links on target website to redirect users to their sites and rank up in the google search results. You may want to call it as “Illegal SEO techniques”.

Hackers mostly target vulnerable plugins, themes installed on a WP website. They tend to include their malicious data in header.php or footer.php present under /wp-content/themes/<theme_name> as it loads up with every page of your website. It’s a smart way to infect full website with just one file. This is usually hard to detect as the malicious data might be encoded or hidden inside an image.

Ideally when a website is hacked there are few steps that need to be performed immediately:

1. Replace your website folder with clean copy of website. This will save you from blacklisting by google
2. Perform a sucuri malware scan i.e. http://sitecheck.sucuri.net/scanner/ to check if you are already blacklisted
3. Inspect your plugins or themes folder for malicious code
4. Remove the malicious code from infected file

Once cleaned, next step is to inspect and clean your WP database.

WP Database Inspection

It is equally important to inspect and clean your WP database after you clean WP website files. This is to ensure that the malicious code does not appear again and you have a fully cleaned website. WP database can be accessed using PHPMyAdmin console. Below is the quickest way to do a database inspection:

1. Login to PHPMyAdmin console
2. Click on database_name in use
3. Export your complete database in a .sql format and open it in a text editor
4. Do a search for malicious code

In most cases, you will find the malicious code in database. Perform below steps to clean:

1. Identify the table and column in which malicious code exists
2. Perform PHPMyAdmin search on the infected table and look for the malicious row
3. Clean malicious code and click on Save
4. Repeat steps 1-3 for every row in the table

Please note you can run a query on full database as well but this will be more time-consuming and effort will be as equal as performing above steps.

On a final note, the most important things to remember if you own a WP site are:

1. Backup, backup, backup your website
2. Keep your WP version up-to-date
3. Have few of the security plugins installed for your WP website

Happy Reading!!!

Malware Attack Analysis

Recently, we have seen a massive increase in malware attacks. Hackers find weak holes (vulnerability) in system or application, exploit them to gain access and ends up infecting them with malware. The attack is usually targeted for huge set of audience i.e. website legitimate users. Malware can be spread by various means, an email attachment, file download, javascript via page load, broken links, page redirects, etc.

In a recent Malware analysis activity, I noticed hacker adopting different approach to infect website. Hacker exploited weak ftp credential to gain web folder access and infected application supported files i.e. js, cs, html files instead of infecting main application pages. The malicious script executes on user’s browser, gives an unavoidable pop-up of Microsoft Essentials and then pop-up disappears after user clicks on “OK” button. This script also executed a function from within the page which silently transferred all valid sessions opened in same browser tabs to attacker’s website. Eventually, compromising user account by session hijacking. Think of less secured website which sends authentication credentials in cookie!!!

There were two interesting points in this attack:

• Attacker injected the malicious code in Base64 encoded format and referenced to decode function from within the file to make it browser understandable
• Attacker infected very few application supported files ignoring all application files to get past the malware detection

The attack was identified and notified by a legitimate user, who knew something about security, noticing that Microsoft Essential was not installed on his system.

The Steps: Root Cause Analysis

Analyzing malware requires effort, time, skill and minimal application knowledge. Below are few mandatory questions that must be asked before you conduct RCA for a website:

• How many entry points does your application have?
• Do you have system and application logs?
• Why do you suspect your website is infected?
• How do you manage your website?

After gathering these answers, you will find a direction into which you need to look for. Ask website owner for web application files, application logs, system logs and firewall logs, if exists. Next step is to adapt the approach for analysis:

• Identify and block hacker access on your server
• Backup old infected code
• Identify the activity/action of malware like installing backdoor, stealing session cookie, fake redirects, etc
• Replicate the malware attack at your end to verify the malware behavior
• Analyze every application file for malicious injected script. Code file size may give you a hint of which files are infected. In my case, every infected file code size was increased by 2 KB as compared to original file
• Remove malicious script from all infected files
• Scan your website folder with anti-virus and malware detection tool
• Audit your server with Autoruns tool - Sysinternals
• Make your cleaned application files go-live ensuring website is functioning perfectly as before. Look for every page load, image, buttons that must be in place
• Scan your website with McAfee SiteAdvisor to ensure no malware exists on the website
• Issue a best practice guideline

Hackers are always on the run with our own evolving technology.  Be Aware to Be Safe.