7 ms·

How botnets are created with hijacked Worpess, fake Flash downloads and Node.js

102 points by Sujan 11y ago

paxtonab 11y ago
I wonder if the point of the botnet is to get SERPs from Google? They stopped letting you know quite a bit of information about keyowrds, rankings, etc. a while ago. Seems like there is lots of potential for blackhat SEO with this type of botnet.
- Sujan 11y ago
  Hm interesting, good point. Would have to check if the API returns the same results as the real search listings...
- jastanton 11y ago
  It's fairly easy to get serp just by spinning up some ec2 instances. You can make a good number of requests just by providing proper headers. That is, assuming the last guys using that ip didn't just do the same and get rate limited. All this to say this seems to be a lot of trouble just for SERP results.
  - paxtonab 11y ago
    I was also thinking that if competitors showed up in the results you could then use the botnet to then link bomb them? I agree that it does seem like quite a bit of effort for an undetermined purpose though...
eljamon 11y ago
tl;dr Someone hacks WordPress websites and includes strange .js files that a) lead to fake Flash downloads that install a botnet on your PC and b) abuse your browser to get URLs from a Google search.
- thenerdfiles 11y ago
  (Like tracking CSS pseudo-classes or CSSi.)
Ianvdl 11y ago
This is why you disable flash and run NoScript.
- bkolobara 11y ago
  No. It is offering an executable pretending to be a flash player installer. Nothing to do with actually running flash.
  - Ianvdl 11y ago
    I realise that. It is just generally good advice to disable flash.
    - elbigbad 11y ago
      Well, to be fair, you did say "[what the article talks about]. . . is why you disable flash," not "it's generally good advice to disable flash."
      - Ianvdl 11y ago
        I concede, I could have phrased that better.
JoblessWonder 11y ago
This is the whole reason Sucuri [1] exists and blew up in popularity shortly after it launched. If you are running Wordpress, I'd definitely recommend Sucuri. If you don't have a paid plan, at least run the free scan once a month or more to make sure you weren't hit by anything. I don't mind Wordpress as a CMS, but it is a constant target. Constant. And nothing looks worse than having "Cheap Canadian Viagra" at the bottom of your corporate website. [1] https://sucuri.net/ https://sucuri.net/
- Sujan 11y ago
  Can you run it from the outside? Where can I find more on the free offering? (Obviously asking for my former employer... the haven't understood or fixed the problem yet.)
  - Sujan 11y ago
    Ah found it: https://sitecheck.sucuri.net/ https://sitecheck.sucuri.net/ At least the pages I looked today at aren't recognized by this external tool. Only green checkmarks, also the "List of scripts included" doesn't see the 2 scripts added dynamically by the injected code in the post. The Wordpress plugin would probably do a better job.
    - perezbox 11y ago
      Hi Sujan Can we get a list of the domains you scanned that weren't recognized? Thanks
      - Sujan 11y ago
        Done, Celise should have them on your site's chat tool.
  - eli 11y ago
    Seems like it would be very hard for it to catch everything from the outside. I've seen malware that only presents itself to clients with a Referer from Google or an iPhone user-agent, for example
joshfraser 11y ago
I have a Wordpress plugin with ~100k active installs. Recently I've started getting emails from people wanting to buy the plugin from me. I'm assuming they want it for a botnet or other nefarious purposes. I'm not sure if Wordpress have stepped up their monitoring of plugins or not, but in past there was little oversight of the plugins and adding a direct backdoor to those 100k servers would be trivial, not to mention the millions of people that could be reached via JavaScript injection.
- Sujan 11y ago
  May I ask how much they are offering?
  - joshfraser 11y ago
    $150.00 USD for every 1,000 installs.
    - Sujan 11y ago
      Wow, that's a lot of money. Thanks for not taking it. (You didn't, right?) Btw: still wearing my Torbit shirt sometimes ;)
      - joshfraser 11y ago
        No, I didn't take it. Saving it for my own botnet. ;) And awesome! Really happy to hear you're still enjoying your Torbit shirt.
    - jakejake 11y ago
      That's a surprising amount. I'd imagine if its spammers or something, I would be highly suspicious of their payment being legit (stolen PayPal account or something). I have almost 500k plugin installs, I'd sell my plugin for that amount if I knew it was going to a legit company!
- lucaspiller 11y ago
  Over the summer I tried taking over a few abandoned Wordpress plugins, some of which had a similar number of installs. Before they would even try to get in touch with the authors they wanted to see my updated code and made sure it was up to current Wordpress standards. Once you have access to the plugin repo you are free to push whatever you want though without review...
P4u1 11y ago
The domain hosting one of the files seemed too legit to me, so I checked and it's an actual website of a Brazilian company,http://cjccontabil.com.br/ http://cjccontabil.com.br/, seems whoever built the website got a WP (free I assume)theme from somewhere which happened to include this malicious file(/wp-content/themes/Hermes/main1.js). I guess folks are downloading free stuff and hosting them at their websites without inspecting the content of all files, so if you think you're safe by just making sure your system is injection-proof, think again, are you using some theme or plugin downloaded from somewhere on the web and if so have you checked every single file included?
- OSButler 11y ago
  The theme directory is a common target for code injection, as it is often set with writeable webserver-user permissions, in order to allow the admin to use the backend theme editor. Almost all of the compromised accounts I've dealt with over the years were the result of outdated WordPress or plugin installs, where an exploit was used to upload a file to one of the commonly known writeable directories: plugins, uploads, or themes. Most of those cases could have been prevented if the owner would have kept their installs up to date, which makes these issues so frustrating to deal with.
heyalexej 11y ago
Wow, this one infected at least 1.000+ sites according to Meanpath¹. [1] http://meanpath.com/f/j5LK9K http://meanpath.com/f/j5LK9K
- Sujan 11y ago
  Ouch.
NickHaflinger 11y ago
How botnets are created with hijacked Worpess, fake Flash downloads, Node.js and Microsoft Windows ..

102 points by Sujan 11y ago

I wonder if the point of the botnet is to get SERPs from Google? They stopped letting you know quite a bit of information about keyowrds, rankings, etc. a while ago. Seems like there is lots of potential for blackhat SEO with this type of botnet.

Sujan 11y ago
Hm interesting, good point. Would have to check if the API returns the same results as the real search listings...
jastanton 11y ago
It's fairly easy to get serp just by spinning up some ec2 instances. You can make a good number of requests just by providing proper headers. That is, assuming the last guys using that ip didn't just do the same and get rate limited. All this to say this seems to be a lot of trouble just for SERP results.
- paxtonab 11y ago
  I was also thinking that if competitors showed up in the results you could then use the botnet to then link bomb them? I agree that it does seem like quite a bit of effort for an undetermined purpose though...

eljamon 11y ago

tl;dr Someone hacks WordPress websites and includes strange .js files that a) lead to fake Flash downloads that install a botnet on your PC and b) abuse your browser to get URLs from a Google search.

thenerdfiles 11y ago
(Like tracking CSS pseudo-classes or CSSi.)

Ianvdl 11y ago

This is why you disable flash and run NoScript.

bkolobara 11y ago
No. It is offering an executable pretending to be a flash player installer. Nothing to do with actually running flash.
- Ianvdl 11y ago
  I realise that. It is just generally good advice to disable flash.
  - elbigbad 11y ago
    Well, to be fair, you did say "[what the article talks about]. . . is why you disable flash," not "it's generally good advice to disable flash."
    - Ianvdl 11y ago
      I concede, I could have phrased that better.

JoblessWonder 11y ago

This is the whole reason Sucuri [1] exists and blew up in popularity shortly after it launched. If you are running Wordpress, I'd definitely recommend Sucuri. If you don't have a paid plan, at least run the free scan once a month or more to make sure you weren't hit by anything. I don't mind Wordpress as a CMS, but it is a constant target. Constant. And nothing looks worse than having "Cheap Canadian Viagra" at the bottom of your corporate website. [1] https://sucuri.net/ https://sucuri.net/

Sujan 11y ago
Can you run it from the outside? Where can I find more on the free offering? (Obviously asking for my former employer... the haven't understood or fixed the problem yet.)
- Sujan 11y ago
  Ah found it: https://sitecheck.sucuri.net/ https://sitecheck.sucuri.net/ At least the pages I looked today at aren't recognized by this external tool. Only green checkmarks, also the "List of scripts included" doesn't see the 2 scripts added dynamically by the injected code in the post. The Wordpress plugin would probably do a better job.
  - perezbox 11y ago
    Hi Sujan Can we get a list of the domains you scanned that weren't recognized? Thanks
    - Sujan 11y ago
      Done, Celise should have them on your site's chat tool.
- eli 11y ago
  Seems like it would be very hard for it to catch everything from the outside. I've seen malware that only presents itself to clients with a Referer from Google or an iPhone user-agent, for example

joshfraser 11y ago

I have a Wordpress plugin with ~100k active installs. Recently I've started getting emails from people wanting to buy the plugin from me. I'm assuming they want it for a botnet or other nefarious purposes. I'm not sure if Wordpress have stepped up their monitoring of plugins or not, but in past there was little oversight of the plugins and adding a direct backdoor to those 100k servers would be trivial, not to mention the millions of people that could be reached via JavaScript injection.

Sujan 11y ago
May I ask how much they are offering?
- joshfraser 11y ago
  $150.00 USD for every 1,000 installs.
  - Sujan 11y ago
    Wow, that's a lot of money. Thanks for not taking it. (You didn't, right?) Btw: still wearing my Torbit shirt sometimes ;)
    - joshfraser 11y ago
      No, I didn't take it. Saving it for my own botnet. ;) And awesome! Really happy to hear you're still enjoying your Torbit shirt.
  - jakejake 11y ago
    That's a surprising amount. I'd imagine if its spammers or something, I would be highly suspicious of their payment being legit (stolen PayPal account or something). I have almost 500k plugin installs, I'd sell my plugin for that amount if I knew it was going to a legit company!
lucaspiller 11y ago
Over the summer I tried taking over a few abandoned Wordpress plugins, some of which had a similar number of installs. Before they would even try to get in touch with the authors they wanted to see my updated code and made sure it was up to current Wordpress standards. Once you have access to the plugin repo you are free to push whatever you want though without review...

P4u1 11y ago

The domain hosting one of the files seemed too legit to me, so I checked and it's an actual website of a Brazilian company,http://cjccontabil.com.br/ http://cjccontabil.com.br/, seems whoever built the website got a WP (free I assume)theme from somewhere which happened to include this malicious file(/wp-content/themes/Hermes/main1.js). I guess folks are downloading free stuff and hosting them at their websites without inspecting the content of all files, so if you think you're safe by just making sure your system is injection-proof, think again, are you using some theme or plugin downloaded from somewhere on the web and if so have you checked every single file included?

OSButler 11y ago
The theme directory is a common target for code injection, as it is often set with writeable webserver-user permissions, in order to allow the admin to use the backend theme editor. Almost all of the compromised accounts I've dealt with over the years were the result of outdated WordPress or plugin installs, where an exploit was used to upload a file to one of the commonly known writeable directories: plugins, uploads, or themes. Most of those cases could have been prevented if the owner would have kept their installs up to date, which makes these issues so frustrating to deal with.

heyalexej 11y ago

Wow, this one infected at least 1.000+ sites according to Meanpath¹. [1] http://meanpath.com/f/j5LK9K http://meanpath.com/f/j5LK9K

Sujan 11y ago
Ouch.

NickHaflinger 11y ago

How botnets are created with hijacked Worpess, fake Flash downloads, Node.js and Microsoft Windows ..