I18N Gallery

[devaintfire]

They gave one last suggestion which was this

"A simple way to remove the ability for attackers to use remote file inclusion is to add a "php.ini" file at the top-level of the website with the following contents - be aware though that the web-site will need testing afterwards to ensure that no legitimate web-site scripted actions have been affected by the change.

------------------------------
The php.ini directives are...

allow_url_include = "0"
allow_url_fopen = "0"
------------------------------"

Here's the whole message they sent me.

Hi Robert,

Thanks for contacting us.

I have a read through your ticket and had a look through your site. The information you are requesting is as follows.


rcosstickphoto.com-access_log.7.gz:rcosstickphoto.com 207.255.175.25 - - [05/Mar/2012:20:49:33 +0000] "GET /it/nc-peace-sign-free-needlepoint/ HTTP/1.1" 200 809 "http://www.google.com/imgres?q=perler+bead+peace+patterns&start=179&um=1&hl=en&biw=1600&bih=666&addh=36&tbm=isch&tbnid= hH5RVBXilR1U1M:&imgrefurl=http://rcosstickphoto.com/it/nc-peace-sign-free-needlepoint/&docid=l2YHtCH1gM0w6M&imgurl=http:/ /0.tqn.com/d/crossstitch/1/0/b/q/-/-/peacesign.jpg&w=972&h=999&ei=oyZVT9aWMYGx0AHG5rz_Dw&zoom=1&iact=rc&dur=78&sig=115058 349598720292892&page=7&tbnh=146&tbnw=142&ndsp=31&ved=1t:429,r:20,s:179&tx=198&ty=-3" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB6.3; SearchToolbar 1.2; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; AskTbGAM1/5.12.2.16749)"
rcosstickphoto.com-access_log.7.gz:rcosstickphoto.com 207.255.175.25 - - [05/Mar/2012:20:49:58 +0000] "GET /it/nc-peace-sign-free-needlepoint/ HTTP/1.1" 200 809 "http://www.google.com/imgres?q=perler+bead+peace+patterns&start=179&um=1&hl=en&biw=1600&bih=666&addh=36&tbm=isch&tbnid= hH5RVBXilR1U1M:&imgrefurl=http://rcosstickphoto.com/it/nc-peace-sign-free-needlepoint/&docid=l2YHtCH1gM0w6M&imgurl=http:/ /0.tqn.com/d/crossstitch/1/0/b/q/-/-/peacesign.jpg&w=972&h=999&ei=oyZVT9aWMYGx0AHG5rz_Dw&zoom=1&iact=rc&dur=78&sig=115058 349598720292892&page=7&tbnh=146&tbnw=142&ndsp=31&ved=1t:429,r:20,s:179&tx=198&ty=-3" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB6.3; SearchToolbar 1.2; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; AskTbGAM1/5.12.2.16749)"

These are the logs for what appears to be the exploit on site. The IP address which has done this appears to be 207.255.175.25.

It appears that your site has been subject to an attack via a method known as script injection. Typically, this works by forcing a site to execute code when it was expecting to process another input, fake .txt files are often used for this purpose.Because script injection attacks the site code itself, it is able to completely avoid webserver security.

Subsequently we have disabled the hosting account, however FTP access is still available.

1) Firstly all files in the hosting space must be removed before we can reactivate. You can either ask us to do this for you or let us know when you have done this yourself - when we can see the hosting space is empty it will be reactivated

2) Change all passwords associated with this account. This includes FTP, eXtend, databases, mailboxes, etc. If the site connects to any external data sources - databases, rss feeds, etc. change the password there as well and modify scripts as necessary.

3) Run full virus scans (with up-to-date definitions) on any and all computers that have been used to FTP to the site.

4) Rebuild the site from scratch using the latest versions of the software used for the site from a known clean source

5) Make sure directories are only set to 755 or 711 only - do not ever use 777 permissions.

If using common CMS software as these infections commonly come via addon modules, extensions and themes, we'd suggest limiting these to only those necessary and taking care to ensure that they come from the module provider's home-site. Many of these themes/modules/extensions are available pre-infected on third-party sites.

A simple way to remove the ability for attackers to use remote file inclusion is to add a "php.ini" file at the top-level of the website with the following contents - be aware though that the web-site will need testing afterwards to ensure that no legitimate web-site scripted actions have been affected by the change.

------------------------------
The php.ini directives are...

allow_url_include = "0"
allow_url_fopen = "0"
------------------------------


They seem pretty sure it's down to the gallery, I gave em hell last night, but if it is a problem with the gallery surely it should be sorted?