Quttera web security blog

Simple Tip To Secure Your WordPress Website

11 Jun, 2017 blacklisted website malware removal malware cleanup remove malware wordpress malware hacking

Introduction Each automated or manual cyber attack starts with gathering as much information about the targeted website or server as possible. Usually, the first step would be the “poc scanning”, which aims to locate and identify an execution environment setup. Website owners tend to neglect the protection of such information and probably not aware of the risk accompanied. In this post, you will learn a simple technique that you can use to improve your website security.

Hardening WordPress Website

29 May, 2017 blacklisted website malware removal malware cleanup remove malware wordpress malware hacking php malware

Introduction Among the Content Management Systems (CMS) the WordPress is probably the most popular. Our statistics in the Annual Website Malware Report | 2016 show WordPress as leading CMS in 2016. Due to its popularity, it is also prone to vulnerabilities. In the same report it can be seen that 76% of our infected customers were using WordPress. What Are The Main Components Of The WordPress Installation? Each WordPress website has three main parts:

Propagation Of The 5 Year Old Bot

4 May, 2017 blacklisted website malware removal malicious javascript malware cleanup remove malware

Introduction We have encountered a 5-year-old malware while cleaning up one of our customer's website. The malware used a drive-by download method to infect the users. What is Drive-by Download? The drive-by download is an attack vector wherein the users are downloading the payload without their knowledge or consent. It usually happens during the visit to an infected site, reviewing an email or by just clicking a popup advertisement. What does the payload do?

Joomla Templates Under Hacking Attack

21 Apr, 2017 blacklisted website malware removal malicious javascript malware cleanup Joomla! malware remove malware

Introduction This short post is about recent attack that targets the Joomla! Content Management System's and specifically its templates. We decided that it is worth to spread the word about it after our malware experts resolved numerous similar incidents. Attack On Joomla! Templates The file index.php contains a malicious script that calls its main component like the snippet below: But if you view the site source via the web, the added script just before the head tag looks like this: Note: For stat88b.

Adware in Free CMS Plugins

29 Mar, 2017 blacklisted website malware removal malicious javascript malware cleanup adware malicious ads remove malware

Introduction As for the definition in CMS (Content Management System), a plugin is a collection of code files that adds one or more features to your website. After you install the core code for your CMS, you can install your choice of plugins. Depending on the nature and the design of your site, you can choose from thousands of plugins available on the internet. Our incident response team encountered one peculiar issue where the website got blacklisted for distributing adware to its visitors.

Compromised Ads Lead Visitors To Install App From The Google Play Store

27 Dec, 2016 blacklisted website malware removal malicious javascript malware cleanup spam malicious ads remove malware

Ads has been spreading all over the internet starting from any social networking sites to almost everything. Some ads are plain and straightforward, and some are horrific and disturbing. Like this one that we got just last week. When we checked a link, it showed these images below: And it will take you to the Play Store to download an app. If you are still unaware, along with the helpful and useful apps the Google Play Store is infested with a lot of malicious apps.

HTTP 404 Error To Generate And Serve Custom SPAM Pages

25 Dec, 2016 blacklisted website malware removal malware cleanup remove malware spam hacking website malware cleanup php malware wordpress malware

Background One of the most recognizable errors encountered on the Internet is the “404 Not Found” page. The website hosting server usually generates such error when a visitor attempts to access a page that does not exist (broken or dead link). Webmasters can configure the servers to display a customized and more user-friendly 404 error page offering the sitemap, branding or other helpful information. This post shows how the hackers that broke into the web server through the compromised website exploited this mechanism to serve SPAM.

Self-Recovering Spam Bot Launched Exploitation From Entire IP Sub-Network

11 Dec, 2016 blacklisted website malware removal malicious javascript malware cleanup spam remove malware

Background It is not a surprise that a Weak Password leads to a compromised website. What is not upfront obvious is the scale of the damage that could happen when such necessary security measure as a Strong Password is neglected. It is a must for every company and business to enforce strict policy for the creation and proper maintenance of the authentication details on every level and across all of the assets.

Your Apple ID Was Recently Used On A New Device (SPAM-Phishing)

9 Dec, 2016 blacklisted website malware removal malicious javascript malware cleanup spam remove malware

Background There is a wide blasting of SPAM emails that pretended to be a legitimate letter from Apple about your user account being used on a new device. Due to people's instinct to click on any link embedded in the email without analyzing the content, SPAM campaigns are usually very effective when disguised under a well known brand. SPAM investigation Let's take a deep look and spot the flaws of the email:

Happy Birthday CVE-2015-8562 (Object Injection Remote Command Execution)

8 Nov, 2016 blacklisted website malware removal malicious javascript malware cleanup remove malware joomla malware

Background As it turned out during the malware clean-up of customer websites, hackers were using exactly this type of exploit to attack the site. Furthermore, the site got reinfected with malware as soon as someone accessed it. We got alarmed as the reinfection was so sudden, so we dig deeply and found out something else. Website Malware Incident Investigation Upon checking the access logs of the site, we found a very nifty but familiar entry on the records as shown below:

Self-recovering Black SEO & Spam Infection Hits WordPress Installations

27 Oct, 2016 blacklisted website malware removal malicious javascript malware cleanup spam remove malware

Background There is a Black SEO/Spam poisoning campaign running that targets mainly the WordPress websites. While handling several incidents related to it, we have discovered a new self-recovering WordPress oriented malware among other malicious components. Let’s take a look at all of them. Backdoors To Control The Attacked Website We still don’t know if there is any relation between infections but all of the examined websites contained numerous generic PHP shells and backdoors which names have the following format:

Prestashop VTEM Skitter Modules File Upload Vulnerability

23 Oct, 2016 blacklisted website malware removal malicious javascript prestashop malware ecommerce infection

During our incident response to the client's website, we found a vulnerability in the VTEM Skitter module of Prestashop CMS. Here is the code snippet of the uploadimage.php: $uploaddir = ‘./img/’; $uploadfile = normalize(pregreplace(‘/ /’, ‘’, basename($_FILES[‘userfile’][‘name’]))); if (move_uploaded_file($_FILES[‘userfile’][‘tmp_name’], $uploaddir.$uploadfile)) echo ‘success:‘.$uploadfile; else echo ‘error’; To test if your site is vulnerable, try going to your favourite browser and enter the following in the address bar: http:///modules/vtemskitter/uploadimage.

Instant Ransomware For Unpatched Websites

22 Oct, 2016 blacklisted website malware removal malicious javascript malware cleanup remove malware ransomware

Information has been scattered all over the internet. Links after links are being distributed over the web through Facebook, Youtube, blogs, emails, text messages and any other form of online communication. Having said that, this also includes good and bad links which can cause problems to the visitors of these links. Unpatched sites are being exploited with a lot of infected redirections and do contain payloads to attack. A couple of weeks ago, we received a report about an unauthorized connection that the site makes whenever a visitor checks it.

Rig Exploit Kit - Responsible For At Least One-Third Of Malware In 2016

16 Oct, 2016 blacklisted website malware removal malicious javascript

There is no such thing as a perfect web application. Some software vulnerabilities have been there since the very first application was created. The majority of today's exploitation can lead to the automatic execution of arbitrary codes without the users' permission. In this post, we show the Rig Exploit Kit's attack flow. Quttera's malware researchers uncovered and removed this malware for one of our ThreatSign customer websites. Rig Exploit Kit has been thunderous, and it is widely used by the hackers to distribute malware over the internet.

From Compromised Website To Ransomware Infection

10 Oct, 2016 blacklisted website malware removal malicious javascript malware cleanup remove malware ransomware

Ransomware has become very frequent this year, and our malware researchers encounter more and more cases of cryptographic file-locking attacks. Easiness of deploying, the wide range of targets and clear business model are probably the main reasons for such popularity of this kind of malware among cyber criminals. Any company or organization is a potential target as it has been proven earlier this year when U.S. hospital computers and cancer treatment equipment were shut down due to ransomware.

Infected Websites: How Bad Can It Be

30 Sep, 2016 blacklisted website malware removal malicious javascript

Infected Websites: How bad can it be? Here are the top reasons for having a website: Information Dissemination Personal Biography Marketing your business Online shopping Let's have a look at sample scenario: Your new and shiny website is ready and goes online to serve your goals. You are enjoying every activity involved in building up your online presence like sharing information, marketing your business, serving your online shoppers and much more.

Deobfuscation Made Easy With MalwareDecoder.com

4 Sep, 2016 blacklisted website malware removal malicious javascript

Deobfuscation made easy with MalwareDecoder.com Battling malware has been a very competitive and very fulfilling task nowadays. It brings joy and confidence to each Malware Analyst that can discover or unravel the code being used for an attack or infection. We at Quttera, were able to help other Malware Analysts with their tasks by providing tools for them to be used in their analysis. We have tested it with one of the suspicious files that we got on one of our clean ups.

Web Ads-ministrator 101

21 Jul, 2016 malvertising malware removal malicious javascript

Malicious ads and website reputation Malvertising is one of the most profitable businesses in the cyber hacking industry. Exploiting website inventory is highly beneficial for cyber criminals as it is then sold to redirect traffic to gambling, adult, pharma and similar kinds of websites. Needless to say, that its damage to both publishing websites and advertising network reputation is huge. Ideally, Web Admins are the ones responsible for checking the Ads that their site is showing.

Website defacement with button click

10 Jul, 2016 check-website-for-malware malware-cleanup website-malware-scanning-products hacking

Website Defacement is just a click of a button In the past few months, Quttera malware researchers encounter a significant rise in website defacements by hackers. Government websites, among the others, were under such cyber-attack and thus getting a lot of attention and concern from the public. Interesting fact that, in some cases, hacker groups used defacement as their "cyber branding". The number of such sites being defaced is then used as a global ranking of a responsible hacker group.

SQLMAP.py - A friend or a foe

30 Apr, 2016 antimalware blacklisted website check website for malware vulnerability exploits website malware cleanup sqlmap.py

Security tools serving good and bad This is a python script used by Cyber Security Analysts to check for vulnerabilities in website . Like any other network security tool, it is being utilized by many, meaning it was also being utilized by the bad guys a.k.a "hackers". While we were browsing the dark web, we stumbled upon a hacking forum where you need to take an exam before you could join their group.

Malware clean-up and hacking recovery for websites

Get your website cleaned and removed from blacklists. Prevent traffic loss and protect your visitors now.

economy
119$ /yr
1 domain
Blacklisting removal
Malware clean-up
Daily malware scanning
Malware scan reports by email
Re-scan anytime
Create Account

professional
399$ /yr
5 domains
Blacklisting removal
Malware clean-up
Daily malware scanning
Malware scan reports by email
Re-scan anytime
Create Account

more plans

Need help? contactus@quttera.com

What's in newsletter?

Example newsletter

Latest Posts

tag

Malware clean-up and hacking recovery for websites

Newsletter