[Resolved] o2switch customers targeted by insidious WordPress hack - UPDATE: The hosting provider is handling this in an exemplary manner

Identification & causes: everything you need to know 👇

Last week, I revealed on LinkedIn widespread piracy among owners of WordPress sites hosted by o2switch. In our capacity as WordPress security experts, and thanks to an investigation with a number of affected and unaffected colleagues, we have been able to find out more.

📄 How the hack works

The hack redirects mobile users to fraudulent sites, particularly related to the Ukraine/Russia war, via a shortener URL hosted in the United Arab Emirates.

Technically, it consists of injecting obfuscated JavaScript code into all the WordPress posts on the site. It is therefore loaded into pages and posts and sometimes into other plugins such as cookie plugins, user opinion plugins, etc.

Here's an overview of the pirate code after de-obfuscation, so that even if you don't speak the language you can understand that the action takes place when you click and that a random URL is selected according to the «UserAgent», i.e. the browser used:

Jul-2024:213287:199.195.252 [HIDDEN] - - [27/Jul/2024:20:10:59 +0200] "POST /index.php?s=captcha HTTP/1.1" 200 102292 "https://www.[HIDDEN].en/index.php?s=captcha" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MS-RTC LM 8; InfoPath.3; .NET4.0C; .NET4.0E) chromeframe/8.0.552.224"

🔍 Identification

• The hack is sometimes poorly inserted into the articles and is displayed as text in the body of the pages instead of being executed.
• Most of the time it is invisible, you can check if your site is affected by searching for «_0x365b», or «0x3023», or «function _0x», via the inspector in your developer console when you visit the site, or via a search in phpMyAdmin.
• Eset and Avast antivirus software block access to affected sites
• Update 31/07/2024 - One of the affected sites is not visible via the developer console. Instead, you need to use the «curl» command line tool to observe the malicious code. This may be due to the site cache.

Here is an example of the pirate code as seen from the developer console:

🌐 Distribution of the hack

By searching for the pattern of the hack on Google and Bing, I found a large number of infected sites. I contacted all the site owners to alert them, advise them to contact their service provider and offer my help if necessary.

• Out of 40 domains affected, found in France and Belgium, only 2 are not with o2switch - update 30/07/2024: Some sites at OVH, Hostinger and other hosting providers have also been affected, but this is rarer at the moment.
• Other foreign server providers are affected, but I've found fewer than in France.
• This suggests a targeted attack on sites present on o2switch IPs, which the hacker would have found via public lists that reference this. This type of attack can target any web host that can do absolutely nothing about it. That's why you need to be proactive in your security.

💡 Causes still uncertain

Here's what we were able to see and deduce by cross-checking information between colleagues:

• As the hack is insidious, many are not diagnosed and detected quickly, but the earliest occurrence appears to have taken place in May - the year of the hack. update 30/07/2024 potentially in July
• This does not affect a specific plugin or theme
• The Tiger plugin from o2switch doesn't seem to be the cause of the problem either, as sites without this plugin are affected.
• The sites affected generally appear to be less well maintained than others, but this is the case for most sites, and sites that are fairly well monitored (perhaps not well enough) are also affected.
• The flaw exploited may have originated in the WordPress core if it was not updated quickly enough.
• This may be due to the use of an obsolete PHP version defined by the hosting manager (end customer).
• It's possible that the presence of a second WordPress instance (a dev instance, for example) on the hosting, which isn't up to date, could affect the main instance, due to a lack of isolation (it's the same hosting, the same system user, the same rights, and there doesn't seem to be an open_basedir rule to restrict the directory at PHP level at o2switch).
• This does not affect the customers of a specific o2switch server, they are spread over several shared servers, and some servers are not affected at all, suggesting a marginal concern (so no server or global host intrusion).
• There is a tiny probability that an intrusion or a more global hosting flaw has occurred (for example a flaw in a system package that allows hacking), but we have no evidence to verify this and insofar as o2switch has not reported anything, it is more reasonable to think that the problem comes from the end application (WordPress) or the version of PHP used by the end customer.
• - Update 29/07/2024 Finally, it is possible that a Apache web server vulnerability was exploited, either when it had not yet been properly corrected, or because o2switch was too late in updating its software versions. The dates seem to coincide for the most recent hacks. Here again, there is no certainty without an official announcement from the hosting provider.
• - Update 31/07/2024 Des vulnerabilities in sub-versions of PHP, particularly in certain revisions of PHP 8.0, could explain the hack. This is consistent with the requests observed that could cause a buffer overflow and enable code injection. If the host's PHP 8.0 sub-versions are not up to date, this would explain the possibility of the hack. Whatever the case, the customer is at fault if this is the cause, as PHP 8.0 is in any case obsolete and should no longer be used. It is no longer available for selection on LRob hosting.
• There have been no hacks on LRob accommodation.

🔨 Hack repair

Repair involves cleaning up the database by deleting the lines corresponding to the hack pattern. Before any operation, back up your database. Website files do not seem to have been affected by this hack, but as with any hack, a full manual check is always recommended. Remember also to empty the various caches so that the malicious code is also removed.

Need help repairing your sites and staying secure in the future? Find out more about my WordPress repair and security as well as my secure WordPress hosting.

If you've got more info, share it in the comments or by PM!