hacked via general.js file

Hi,

I'm using zencart v1.3.9h on a apache server (shared, with shared ssl).

On friday I started getting avast virus detections from my shopping cart.
HTML:Iframe-inf virus

I quickly deleted my shopping cart files and reloaded a safe fresh copy which solved the problem.
I kept a copy of the hacked files and made a comparison. The general.js file has been altered and I expect contains a virus.

I'm concerned that this amy occur again. Can any one shed light on this.

If I set the permissions of this file to read only will the shopping cart still be operational.

Regards
Robert

1. Yes you can make that file read-only. But that's completely unrelated to the overall security of your site.

2. You need to sort out HOW the intruder got into your site, and block that hole.
   And that includes also doing a thorough cleanup.
   http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks
   It also includes working with your hosting company to determine how the hacker got in.

Hi Dr. byte,

thanks for your response. I'm talking to the hosting company about it but I get the feeling they don't really give a damn. As usually they blame the software, and we blame the host company, and no-one does any investigation at all.

A stack of javascript files have been altered apart from the general.js file. I've changed the permissions on that file and the others that have been compromised to 444. We'll see if that has any effects.

Is there some sort of diagnostic routine we can use to see how they got access to the files.

Apart from using version 1.3.9 I also implemented the suggested security changes as in renaming the admin folder. The javascript file corrupted was not in admin though.

Since hacking of files takes place on the server side, there's nothing in Zen Cart that can give you "logs" to track anything related to intrusions.

However, webserver logs, which who has accessed your site, can be very revealing.
If they used FTP to upload files, then the FTP logs would expose that. And if they did use FTP, then you've got password problems and other security problems such as how did they find out your password.
If they used some sort of PHP or CGI script vulnerability on your server, then your apache/webserver logs will show you how they did it, because it will show all hits to the server files from remote locations.
If they have exploited a vulnerability in other software on your server (ie: old phpBB or wordPress or anything), in your hosting account, then you'll need to clean up by fixing those software holes.
If they exploited a vulnerability in someone else's hosting account, then your hosting company will need to audit things and clean up.

And the list goes on. If you're looking for guidance on tracking down hacker intrusions, there are other websites more devoted that topic, like maybe webhostingtalk.com

But there's no point going to outside sources if you haven't first audited EVERY file on your own hosting account and verified that each file belongs and is not malicious.

PS.

I just thought I'd mention this in case it was important. A few days before I got hacked my web site stopped processing credit cards numbers. I had to uninstall and re-install my eway module. I'm using eway to process my credit cards.
I mention this because the same thing happened the last time I was hacked. Eway module stopped working and then 3 days later massive hack of the web site. I was using version 1.3.8 on a zues server at the time. I upgraded to 1.3.9 on an apache server hoping to secure the site.

I wouldn't be surprised that there were traces of the old 1.3.8 code left around on your site. Extra files added by the attacker, shell scripts masquerading as image files when they're really php files, and all kinds of other things. Hence the direction to inspect every file.

I also wouldn't be surprised if the payment module itself might be the problem, especially if it was written for 1.3.8 or older.

But it could equally be stuff completely outside of your Zen Cart altogether.

Hi Dr. byte.

Yes, I have an old version of my 1.3.8 shopping cart. However the folder name has been renamed so that it wasn't visible unless you typed the correct name. Theres no links on my web page pointing to it. I've just checked the javascript files in that and they have been altered too. I'll delete those files too. Its starting to look like the hackers got access to my ftp password and altered files that way. Although my host has just come back and said they can't find anything wrong.
Where are my server logs stored? How do I access them? I've changed my ftp password as well now.

Um, your first post said you're using v1.3.9. But now you're saying you're using v1.3.8 ????

If you're using v1.3.8, you are almost certainly hacked. And it's time to upgrade .... long overdue there.

Some of the security issues in v1.3.8 could allow hackers to create their own "backdoor" to access files on your server without needing FTP.
THAT IS WHY YOU NEED TO UPGRADE.
All forum members were emailed in June 2009 about the issue. That's 3 years ago. There's no good reason to be using the old version.

To locate server logs, you'll need to ask your hosting company. Every server is set up differently in that regard.

Hi,

I've looked through the server logs, looking for reference to accessing the old zencart folder. I haven't accessed this folder myself but its infected. Theres also no direct link to this folder so I wouldn't expect access to it unless it was by a hacker during the infection. I can't see any reference to it in the logs for june which is when I got hacked. Does this mean its a direct ftp attack by someone who had my password?

Simple answer: I don't know.
Further, even if they are using your FTP password, you STILL need to DELETE that old 1.3.8 site and all its files, and clean up EVERYTHING else in your hosting account ... because if they've had ANY access to your site to do any hacking (which you've proven they do), then they will have set up their own backdoors in places you may not suspect.

Again: You need to inspect EVERY file in your hosting account, EVEN those outside of Zen Cart.

Hi dr. byte.

Originally I had version 1.3.8 but when I got hacked 6 months ago, I upgraded to version 1.3.9. I put the files in another folder but kept the 1.3.8 version files on my server. So one active 1.3.9 shopfront, and one non-active 1.3.8 shopfront with no direct links to it.

Ok, well I've checked all the files and deleted all unused files. changed my ftp password, renamed my admin folder. I guess I'll wait and see now. My host is of no help and its a low cost hosting company and support is minimal at best.

It's not clear from your post, but I hope you've now removed your 1.3.8 files from your server.

Hi,

Yes, my 1.3.8 files have been deleted now.

Hi,

I have urchin statistical package on my web site, and I was going through the web site error messages. The following is a list of what I think are attempts by a hacker to find an entry point. They came up as 404 file not found errors. I though I'd include them here so that it might give zencart developers some idea of what entry points hackers are using.

Over the weekend the shopfront has stopped taking orders. I keep getting session expired messages and error 503 server busy errors. I'm talking with the host about it now but I don't know if its hacker related or not. I've checked my files and they don't appear to have been altered since I last replaced them with a known clean copy.

/mobiquo/mobiquo.php
/wp-includes/wlwmanifest.xml 1 0.33%
/js/index.htm 1 0.33%
/ewebeditor/Dialog/about.htm 1 0.33%
/archive/archive.css 1 0.33%
/statics/js/ckeditor/plugins/capture/plugin.js 1 0.33%
/clientscript/vbulletin_ajax_htmlloader.js 1 0.33%
/Admin/Include/version.xml 1 0.33%
/admin/tpls/tpls/main/default/index.tpl 1 0.33%
/index.php/i 1 0.33%
/api/api_user.xml 1 0.33%
/admin/list.html 1 0.33%
/template/default/styles.css 1 0.33%
/admin/static/css/style.css 1 0.33%
/admin/licence 1 0.33%
/inc/playerKinds.xml 1 0.33%
/public/home/js/main.js 1 0.33%
/install/oecms_v3.0.sql 1 0.33%
/admin/js/command.js 1 0.33%
/Resource/Cache/City.xml 1 0.33%
/template/home.htm 1 0.33%
/data/config.js 1 0.33%
/install/en.sql 1 0.33%
/install/templates/step-1.html 1 0.33%
/system/skins/default/system.login.htm 1 0.33%
/lang/install_wind.sql 1 0.33%
/data/js/config.js 1 0.33%
/admin/tpl/showmessage.htm 1 0.33%
/system/language/zh-cn.xml 1 0.33%
/var/package/Mage_Compiler-1.6.0.0.xml 1 0.33%
/extensions/jcms/info.xml 1 0.33%
/app/code/core/Mage/Admin/etc/config.xml 1 0.33%
/install/templates/header.htm 1 0.33%
/templates/default/css/common.css 1 0.33%
/changelog.txt 1 0.33%
/virtuemart.xml 1 0.33%
/README.txt 1 0.33%
/plugin/backupdb/plugin.xml 1 0.33%
/install/data/sql/db_full.sql 1 0.33%
/FS_Inc/FS_CSS.css 1 0.33%
/App_Themes/AdminDefaultTheme/xtree.css 1 0.33%
/media/blogs/index.html 1 0.33%
/pub/guiedit/guiedit.js 1 0.33%
/admin/tpl/footer.htm 1 0.33%
/admin/inc/xml.xslt 1 0.33%
/Include/Editor.js 1 0.33%
/admin/modules/mod_virtuemart_category/mod_virtuemart_category.xml 1 0.33%
/images/edit/edit.js 1 0.33%
/gbook/_notes/dwsync.xml 1 0.33%
/pub/skins/pmwiki/pmwiki.css 1 0.33%
/data/subscriptionmail.txt 1 0.33%
/admin/template/foot.htm 1 0.33%
/js/PublicJS.js 1 0.33%
/plugins/tinymce_plugin/tiny_mce/plugins/more/editor_plugin.js 1 0.33%
/mthemes/default/images/style.css 1 0.33%
/admin/template/article_more/config.htm 1 0.33%
/xml_language/lang[arabic].xml 1 0.33%
/data/install.sql 1 0.33%
/agent/templates/Smarty/utf-8/footer.html 1 0.33%
/templates/default/cn/public/footer.html 1 0.33%
/member/template/homepage.htm 1 0.33%
/5107/chat/js/chat.js 1 0.33%
/plugins/tinymce_plugin/tiny_mce/themes/advanced/skins/o2k7/ui_silver.css 1 0.33%
/templates/cn/html/about.html 1 0.33%
/include/bottom.asp 1 0.33%
/themes/lazycms/home.html 1 0.33%
/a_d/install/data.sql 1 0.33%
/admin/jscripts/imodal.js 1 0.33%
/docs/DOCUMENTATION.txt 1 0.33%
/hack/gather/template/edit_title.htm 1 0.33%
/admin/jscripts/codepress/languages/codepress-mybb.css 1 0.33%
/wp-content/plugins/wp-property/readme.txt 1 0.33%
/templates/default/en/public/footer.html

Hi,

FYI,
Further to that list of hacker attempts. The ip address thats associated with those atempts is
220.155.1.205
someone in china.