(Note: I have merged the two "malware" threads, since this post will answer both of them).
It has taken quite some time and effort, but at last I can now announce that I have removed all the malware which was pestering the forum all these years, or at least I have not managed to find any more of them.
I have registered the forum on the Google Search Console, and asked them for a security review. They have now answered me that the review has been successful and that no more malware have been found, they will now remove all the security warnings related to the forum. I have also activated all the available security options in the admin's control panel, although we'll need to switch to a newer CMS to be safer from similar attacks in the future.
For those curious to know what type of malware was infecting the board:
- by searching for the "Call of Duty" text in a dump of the database, I have found that it was injected in the
Borderline-Blue skin, which is an alternative skin to the default one we use here. For some reason, Google cached all the pages using this skin, and sometimes a redirection URL was triggered when opening a page from a Google search. Google will probably still keep the cached pages with the injected text for some months, as it doesn't refresh them often, but at least all the pages which will be cached from now on will not have that text anymore.
- the
images/diag directory was full of harmful scripts; the
images directory is actually part of the (still offline, I'm working on that) Wiki, so all those files have been added though the Wiki, rather than the forum. The owner of all the files was "apache" and not the OESF shell's account user, since the were added via the HTTP protocol, and only that "user" (and ibiblio's root) could remove them or change the permissions. I solved the problem by temporarily installing a PHP web file manager with an internal web shell, and by manually removing the files using that shell. There was also a malware file called
wso2.php inside images/thumb which has been removed, too.
- when searching for write-protected files (i.e. set as 700 and similar), I found out that the
lang_global.php and
lang_javascript.js files in the forum's cache had the malicious code described here:
https://peter.upfold.org.uk/blog/2013/01/15...url4short-mess/I'll check Google's Search Console in the future for any security issue, since the admin's board is unfortunately unable to detect such threats.
Varti
