VIP***Image Folder Injection Exploit on Algiers***VIP


#1

Hey folks, long time no write, but boy do I have a doozy. Recently, several of my sites hosted on Algiers has come under attack using an image folder injection exploit. It is VERY IMPORTANT that you login to your account via ftp or WebFTP (this exploit is especially common for those using SFTP & Shell account access) - navigate to your website(s)'s images folder & check for the following folder names (including another images subfolder):
2008
2009
2010
archives
cares
catalog
chapter
content
detalis
dirs
heeds
helps
images
info
looks
means
more
new
notes
notices
pub
read
records
threads
users
watchs

usually accompanied by around 6 sitemap pages (sitemap.html, sitemap0.html, sitemap1.html, sitemap2.html, sitemap3.html, sitemap4.html)

If you see ANY of the above folders or sitemap pages in your ‘images’ folder, it means that you have fallen prey to this injection exploit. I have already contacted DH for guidance, however no response as of yet. Each of the folders listed above contain numerous webpages usually with a prefix with the word ‘znakom-’ followed by a string of numbers (i.e. znakom-671.html)

Appears to be of russian origination. Let me know if you have also found similar files/folders on your site & report this to DH immediately. Any guidance would be appreciated.

UPDATE

The following websites have been compromised - if yours is listed, contact Dreamhost immediately & reference my trouble ticket (#4269962) (Image Folder Injection) in your support request (DO NOT CLICK ON ANY LINKS BELOW-REPORT TO DH:

The following information was gleamed from a forensics wildcard search from:
http://travelsvcs.com/index.php?PHPSESSID=1732c635bd2624e82c09bdb054169a11&action=recent;start=40

HERE IS THE CURRENT LIST (ALL ARE HOSTED ON DH):

niufurniture.com (http://www.niufurniture.com/css/records/znakom-6797.html)
wonderjewelers.com (http://www.wonderjewelers.com/img/notices/znakom-14855.html)
clickcrash.com (http://www.clickcrash.com/images/archives/znakom-19357.html)
yatoka.org (http://www.yatoka.org/images/new/znakom-13926.html)
tesuena.com (http://www.tesuena.com/wp-includes/js/2010/znakom-6956.html)
ensumesa.com (http://www.ensumesa.com/media/archives/znakom-11286.html)
malasnoticias.es (http://www.malasnoticias.es/fotos/threads/znakom-72.html)
malasnoticias.net (http://www.malasnoticias.net/inc/pub/znakom-146.html)
raulbellette.com (http://www.raulbellette.com/wp-includes/css/heeds/znakom-5457.html)
nomorepalabras.com (http://www.nomorepalabras.com/wp-includes/js/threads/znakom-14091.html)
malditaconciencia.com (http://www.malditaconciencia.com/scripts/detalis/znakom-2776.html)
dulcecastigobar.com (http://www.dulcecastigobar.com/wp-includes/css/new/znakom-7768.html)
xors3d.com (http://xors3d.com/media/heeds/znakom-17034.html)
backgroundnoise.es (http://www.backgroundnoise.es/wp-includes/js/read/znakom-18361.html)
urbanresearchlab.net (http://urbanresearchlab.net/wp-includes/images/pub/znakom-304.html)
trans-cultural-mediations.net (http://www.trans-cultural-mediations.net/wordpressmu/wp-includes/js/helps/znakom-2733.html)
nedrossiter.org (http://www.nedrossiter.org/wp-includes/js/dirs/znakom-19089.html)
orgnets.cn (http://orgnets.cn/wp-includes/images/archives/znakom-19949.html)
thecolla.com (http://thecolla.com/claire/more/znakom-17773.html)
marenkoehler.net (http://marenkoehler.net/files/more/znakom-15968.html)
balanceoftheuniverse.com (http://www.balanceoftheuniverse.com/Charchi/catalog/znakom-17098.html)
soundmachinerecords.com (http://www.soundmachinerecords.com/images/threads/znakom-17537.html)
thecollaborationist.com (http://thecollaborationist.com/images/info/znakom-15642.html)
mznak.ru (http://www.mznak.ru/images/2008/znakom-5380.html)
jamaicahills.org (http://jamaicahills.org/js/2010/znakom-8884.html)
imaginationmedia.tv (http://imaginationmedia.tv/wp-includes/css/means/znakom-4889.html)
electromost.com.ua (http://electromost.com.ua/language/more/znakom-9177.html)
smeta.cc (http://www.smeta.cc/media/cares/znakom-7291.html)
pedagog-master.ru (http://pedagog-master.ru/language/content/znakom-5601.html)
shub-hub.com (http://shub-hub.com/files/)
farmgeek.co.nz (http://www.farmgeek.co.nz/images/read/znakom-9916.html)
kiwisporthorses.co.nz (http://www.kiwisporthorses.co.nz/img/read/znakom-16014.html)
geekgirl.co.nz (http://www.geekgirl.co.nz/images/dirs/znakom-16841.html)
eqsd.org (http://pac.eqsd.org/docs/means/znakom-52.html)
chickenrescue.net.nz (http://chickenrescue.net.nz/editor/read/znakom-10905.html)
two-rooks.com (http://two-rooks.com/images/watchs/znakom-878.html)
mogki.com (http://mogki.com/js/2010/znakom-17280.html)
alicefox.net (http://alicefox.net/icons/2009/znakom-6170.html)
rhonna.com (http://www.rhonna.com/Chris/detalis/znakom-6731.html)
spinnershome.net (http://spinnershome.net/images/threads/znakom-11868.html)