cdncache-a.akamaihd.net malware exploring vunerability
-
-
- Leitura
- Jr. Rocketeer
- Posts: 45
- Thanks: 0
-
Hello,
I would like to open a discussion about it and point you some possible security problems and vunerabilities occurring with Rockettheme templates.
I had some clients saying website was showing unauthorized links and banners to them. I couldn'tn see them myself. After some investigation it cames out that the problem was being caused by a malware localy, in their browser - soavenSShaRe 5.10 or Download Pepeer (and probably other names) coming from cdncache-a.akamaihd.net
Now, of course it's not a matter of Rockettheme team. But, the same clients navigating around internet couldn't see the links and adds in all sites, but just some. That's why they thought the problem was me, on my server's files. During one of my tests to figure out what was happening uninstalled all templates of the site. That made the links and adds desappear, even if my clients could still see on firebug the malicious code being downloaded.
Now, the conclusion is that this malware is exploring some vunerability present in the templates (at list on the Metro and Kirigami). It looks really like a code injection, thus it's very confusing and difficult to figure out. Now, I'm not a javascript expert to say that if your team could be able to block those attacks or not by manipulating your code. But I just thought it was very valid to start the talk. If you are already advised about this or other types of similar malwares and you have any ideas to stop it, please let me know.
Thanks in advanced
Adriana
-
-
-
- MrT
- Preeminent Rocketeer
- Posts: 101084
- Thanks: 13484
- Web Designer/Developer
-
Thanks for the information - but I don't think this is anything to do with our templates. Anything on the net is potentially a target for hackers, whilst you can take many steps to deter hackers it is impossible to be 100% secure.
I recommend using Akeeba admin tools to tighten down security on your site. Of course you should be using very strong passwords as well (I personally use two levels of 40 characters randomized characters on my client sites).
Once hackers gain access they often inject malicious scripts and other code into any "programs" they think will be accessed (often index.php for example). The code they inject is often unintelligible and hidden away.
But I will pass on your comments...
Regards, Mark. - Please search forums before posting. Please make sure your post includes the version of the CMS you are using and a link to the problem. Annotations on screenshots can also be helpful to explain problems/goals. Please use the "secure" tab for confidential information.
-
Time to create page: 0.069 seconds