On 5 November 2009 I woke up to a dozen e-mails from people worried about my website being blocked by Google's malware detector. Indeed, I discovered, there were malicious iframes on every page of my website. I cleaned them out, but I still had no clue how it had happened.
Only with the help of DreamHost tech support did I discover that I had been rather lazy when my website got hacked. They didn't do too much to tell me why it had happened though, so I pieced this together by looking through logs this morning (and I'm rather proud of myself).
What I should have done
When I was hacked I should have scanned every page that was modified in the past X days and fixed all the hacks.
What happened because I didn't do this
I had forgotten about the shii.org/tech/ directory entirely. The hacker put a php file in this directory and executed it a year later. Thankfully all it did was add iframes to every page pointing to malware Google already knew about and blocked. Google was also right to block my website, because a file had been uploaded to /temp/index.php which served malware to a single unsuspecting user on the afternoon of Nov. 5th.
Why DreamHost is awesome
They discovered and deleted the back door when I asked them to determine the source of the hack. Of course, this should have happened automatically, but it required them to notice this error log, which probably happens far too often:
[Wed Nov 04 23:21:37 2009] [error] [client 213.163.xx.xx] ModSecurity: Access denied with code 404 (phase 4). Pattern match at RESPONSE_BODY. [file "/dh/apache2/template/etc/mod_sec2/99_dreamhost_rules.conf"] [line "9"] [id "10000001"] [msg "Backdoor access"] [severity "CRITICAL"] [tag "MALICIOUS_SOFTWARE/TROJAN"] [hostname "shii.org"] [uri "/tech/eula.php"] [unique_id "SvJ87EWjqwYAAB0XDO0AAAAX"]
For people who can't read Apache logs: DreamHost is aware of this kind of exploit and put in a rule to prevent their box from getting rooted. The only fool affected by this hack was me.
