The researchers think they may have identified the location of the author. Inside the code of the malware is a user-agent (browser) check that checks to see if the web browser user-agent equals ‘chishijen12’. If it does, then the application is instructed to output all PHP errors to the browser, presumably for debugging purposes. Fox-IT found an IP address that is associated with that user-agent and the IP is based in the state of Chisinau in Moldova. The name of the state is similar to the user-agent string, which gives their theory some credence.
21 Comments on "WordPress Security: Nulled Scripts and the CryptoPHP Infection"
Everything has a price. Use Nulled scripts and pay a bigger price in the end, so to speak.
What would we do without Wordfence?
Thanks for the effort. Regarding themes, absolutely no good idea to use free themes. Besides base64 code in the footer and embedded affiliate links nobody needs, we now have a 'new' threat. Although, embedding malicious code into image files isn't that new, the way this works is pretty sophisticated. I sure hope they catch this knucklehead and put him out of business.
Last but not least; why isn't Wordfence a core part of Wordpress?
The white paper is 52 pages long but the pages do contain a lot of "white". It didn't take that long to read. . It was well worth the time. Thanks for sharing.
Yeah, I knew about this some months ago.
I downloaded a script for study and suddenly my Avast! Antivirus alerted.
On scanning I discovered social.png was the culprit.
So I simply used the antivirus to remove it and then saw the above php code in the theme files and removed it too.
Now it is standard practice to scan every theme I get no matter the source. Safer that way.
This is the problem that infected my blog and made it imposible to login. I'm not sure how it got there. I have a very plain very old theme on the site. But I recently experimented with some new plugins. I thought they all came from the wp website, but I need to see where this came from.
Didn't know the term "Nulled scripts" untill now.
I understand it this way: If i do not use any software on my blog of dogdy origin, I should be in the clear, legal wise?
And with the latest update to Wordfence, and a fresh scan, my blog should be in the clear too?
Sadly funny. Ahh, if you used hacked / pirated themes, umm, maybe you should expect the scripting is or will be compromised... Got Karma?
That has been around as long as the themes are. Don't download from unconfirmed sources and problem solved.
Does Wordfence or anything else scan for this? I have a number of client sites where I know the client just downloaded any plugin they could find.
Thanks for sharing, well that's what you get when you go for Nulled Scripts, if you truly need a script, buy it and not steal it.
Um - Sounds like a beat up. I had a site infected via a Premium theme from ThemeForest that I paid $63 for (Premium author). Author denied it was their theme of course despite 3 other people having the same issue. Lack of secure and organised system architecture in Wordpress I reckon. Too many open doors and alleys.
All begins to look like the virus/antivirus cat and mouse games all over again.
@Graham, I recently started having major issues with redirects and spam groups, etc after switching to a premium ThemeForest theme that starts with "K" (same price as you mentioned). Does the theme you are referring fit this? If so, and to prevent tarnishing the developer in case it's just a bad extension they packaged with it, can you verify and tell me what the theme name ends with?
If we're both having the same issues with the same theme, I'm going to request they fix it ASAP or refund my money and leave a proper review for it.
I have already found such line of code in a nulled theme but never noticed that it was a malicious code. Just thought the code was wrong (misplaced) and strange and removed it.
Encrypted code (base 64) and footer links are common in nulled scripts, but this thing would pass by most people. Thanks for spreading the awareness!