PHP Files in CMS, Targeted for Alteration
JPCERT/CC has been continuously observing cases where websites in Japan created with Content Management Systems (hereafter “CMS”) are defaced in a similar way, and the same kind of cases are also observed overseas , . In these cases, part of the PHP files composing the CMS are altered, and this results in defacement of the website contents .
Based on the analysis of several cases, this entry today describes the alteration of such files composing CMS.
JPCERT/CC confirmed that the targeted CMS contained partially altered PHP files as components. The CMS names and altered PHP files in each are listed in Table 1.
|CMS Name||Altered PHP Files|
Our study revealed that malicious codes were dynamically inserted into the response from the website for each access by the visitor, which was a result of the PHP file alteration.
How Altered PHP Files Insert Malicious Codes
Altered PHP files included malicious PHP codes in between “//istart” and “//iend” as in Figure 1 (we noted that malicious codes are obfuscated in some cases).
These malicious PHP codes have a function to insert codes obtained from outside. They receive malicious codes from a specific URL and insert them in a certain place.
Malicious Codes to be Inserted
In such cases where malicious codes are dynamically inserted, it may be difficult for website administrators to realise that their websites are providing malicious contents. We recommend the administrators to confirm that there are no malicious PHP codes (as in Figure 1) in the PHP files described in Table 1 and others in their websites. We have not yet confirmed how these PHP files are altered, but vulnerabilities in the CMS or the plug-ins used by CMS may be leveraged for the alteration. We also recommend updating the CMS and plug-ins to the latest version.
Other than the instances introduced here, JPCERT/CC has been seeing cases where Japanese websites are defaced, and then leveraged as an entrance to the attacker’s website. We hope that each website administrator takes actions as updating the software and properly managing passwords, and be mindful that their website would not be abused for such attacks.
- Ayaka Funakoshi
(Translated by Yukako Uchida)
 Sucuri Inc
WordPress Malware Causes Psuedo-Darkleech Infection
DarkLeech: Finally Under Control?
JPCERT/CC Incident Handling Report (October 1 – December 31 2015) (English)