Beware: Adsense Hijackers

Hello folks.

Although I do read this forum for quite a while, I had never posted here. But today something came to may attention.

Yesterday I saw that my Adsense stats were frozen, no updates since 11:00AM EST. I thought that is was some kind of Adsense glitch and that everything would be ok in some time. I came here and found no topic on this subject.

In the end of the afternoon, I've saw this topic (http://forums.digitalpoint.com/showthread.php?t=190618), some people in the same situation I was. I though it was just a matter of wating.

This morning my stats were still frozen. So I've decided to check on my adsense files (I keep one big adsense file and I do include the code on my pages, to get easier).

When I've check them out, I've saw that all my IDs had been changed, that's was the "why" on the frozen stats.

In my case, someone injected code to re-write all adsense codes through a faulty script, I've already detected.


Well, if you stats are not updating, you better check to see if your ID's are ok.


For those of you that has root access to your boxes, a good solution would be "chattr +i" your adsense files. But anyway, even better is run a pretty good security check and see if there is anything compromised.


My two cents, hope it helps someone...

 

thanks for this

 

where did you gather this info by the way?

 

moral of the story be carefull with open source php scripts some like phpBB are infamous for security holes

 

and also avoid cheap hostings.

 

Hey, thanks for the info...quite a scary concept really.
What do you mean by chattr +i?

 

@phb50530

All my codes were modified, Sunday (12/03). The hole was in a flash chat script.


@Mong

I do run my site on a dedicated box, no one else has access to it, only me. The problem was the script that allowed the injection of code...


@ian_batten

If you do have root, and do "chattr +i" a file (ssh), even the root can't change the file until he does "chattr -i" the file...

 

spooky talk going on in here - Im going to keep a better watch from now on..Although it is possible that it is someone that you know that may have had access to your server info..?

 

Hello,

I think he means set the immutable flag so that the file may not be altered of appended to. Of course, this assumes you hold your AdSense code in a separate include file - which is usual.

Also, flipping that bit has different consequences on different OSes; on some OSes the consequences depend on what securelevel your kernel is running at etc. You might want to check the man pages before just setting it.

Cheers,