CRYPTO PHP ON WEBSERVERS
Over 23,000 Web Servers infected with CryptoPHP.
See the link: @pcworld http://www.pcworld.com/article/2853192/over-23000-web-servers-infected-with-cryptophp-backdoor.html“Security for a website should be the top-most priority” @KatanaWebWorldOver 23,000 sites using Drupal, Joomla, and WordPress have been infected with malware called CryptoPHP. According to this report by Fox-IT, a Dutch security firm, CryptoPHP is used for Black Hat Search Engine Optimization, to push malicious content higher in the search rankings.The infection vector in this case is not exploited vulnerabilities, but rather pirated copies of valid plug-ins that have had the CryptoPHP backdoor inserted. The black hats wait for webmaster to download what appear to be valid plug-ins. Once compromised, the infected websites function as bot-nets, waiting for commands from command-and-control servers using encrypted channels, operated by the attackers.The security firm Fox-IT took control of the command-and-control domains and directed them to their sites to gather statistics, in a process known as sinkholing.The Impact of the Infection:
Top 5 Countries infected and percent of total
- US IP addresses infected 37%
- German IP addresses infected 12%
- French IP addresses infected 5%
- Netherlands IP addresses infected 4%
- Turkish IP addresses infected 3%
Fox denoted the extent of the infection and its spread in this blog post: They report that, at a minimum, 23,693 IP addresses have the infection.The Security researchers released Python scripts on Github to scan for the infection. See link here: They also posted removal instructions, but noted that it is best to reinstall the entire content management system, since it is know to have been compromised.We are using the work by Fox to create procedures and tools to ensure your sites are safe. Call ItGresa if you would like a security scan. –ItGresa Security
