After my own experience and the recent rash of new infections, I wanted to take a moment and outline a new backdoor trojan / malware that poses a significant risk to CMS users as well as anyone who seeks out third-party "nulled" or "free" content. If you’re technically minded and want as much detail as possible, check out the Whitepaper that Fox-IT has published on the CryptoPHP backdoor (50 pages or so). If not, I've put together a summary below. Going forward, I will be instructing our team to utilize more rigorous and aggressive scanning techniques to ensure the continued quality of our content here, and the safety of our users. One idea currently being discussed, is requiring all submissions to link to a valid (and current) VirusTotal scan.
As you should already know, "nulled" scripts are commercial web applications that you can obtain from [pirate] websites that have been modified to work without a license key (often including WordPress plugins and themes, the target of this post). WebFlake is widely considered to be primarily a pirate community, but I believe we are bigger (and better) than that, which is why I strive for the best security here. Per Fox-IT, some nulled scripts are confirmed as being distributed via several websites of similar nature to WebFlake, with a sophisticated infection pre-installed. Fox-IT has dubbed it CryptoPHP because of the fact that it encrypts data before it sends it to command and control servers.
The infection is relatively simple; inside a nulled script there’s a little line of code that looks like this:
<?php include('assets/images/social.png'); ?>
If you're familiar with PHP, you will immediately recognize this as looking strange: it is a PHP directive to include an external file containing PHP source code, but the file is actually an image. Inside this image file is actual PHP and the code is obfuscated (hidden through scrambling) to try and hide the fact that it’s malicious.
Hopefully you have enough sense to implement additional security on your WordPress site (such as Wordfence) as, fortunately, Wordfence is aware of this infection and have since added an option to scan image files as if they are PHP code. Wordfence will detect the 'include' directive above in your PHP source, so even if you haven’t enabled image-file scanning, you will still catch all known variants of this infection (provided you are running the newest version of Wordfence).
Fox-IT has determined that the purpose of the malware is, currently, to engage in black-hat SEO by injecting links to other, presumably malicious, websites into your content. However this infection is sophisticated and it communicates with command and control servers that can instruct it to do a variety of tasks including the ability to upgrade itself. So this is a classic botnet infection which turns all infected websites into drones that can be instructed to do just about anything, from sending spam email to SEO spam to hosting illegal content to performing attacks on other websites.
This infection doesn't just affect WordPress but affects Drupal and Joomla too. The detection Wordfence added will actually detect the infection in Drupal or Joomla source code too if that lives under your WordPress directory.
Again, you can find the full white paper discussing this new threat here and it includes quite a bit of technical detail if you're interested in that kind of thing.
Please help spread the word about the danger involved in downloading or distributing third-party "nulled" content and help keep the WebFlake community safe.