2

We were running out of space on our server so we did a search for large files we could delete and found one in htdocs/media/catalog/product/N/o/ called "NoImages100_184x.jpg" which was 112MB. It was also present in our test environments in sizes varying from 60-240MB. My web guy and I had no idea what this was, so we downloaded the file to both a Mac and PC and tried to open it. No luck. Said that file was corrupt or the wrong file type. So, we deleted the file. And it reappeared with 600 permissions and owned by the webserver user. Instantly. Small, just a couple of k. Then it started growing. 5k, 6k, 7k, 8k, 9k, etc. I did a tail -f on the file and there was a line getting written to it just about every second. Most of the lines looked like this:

"YToxOntzOjI6ImlkIjtzOjg6Ilc5SE03SDhCIjt9LS1hOjA6e30="

with 10 characters to the right of center changing each time it was written, but the rest of the line remaining the same. The file has no header, just starts right in with those cryptic lines, just like a log file.

I ran ClamAV and found no viruses or anything. I grepped my Magento installation looking for a file that referenced the jpg filename, but found nothing.

Finally I just changed permissions on the file to 400, and it stopped growing.

I did tail -f on the file in one of our test environments and it was static. Of course, the test environment doesn't have traffic and cron is not running. Even so, I tried loading some webpages, and running cron.php from the browser, and the file remained static.

Web searches for the filename, the directory name, related keywords, stuff like "growing JPG file yielded no results. We searches for some of the strings inside the file likewise were fruitless.

Can anybody shed some light on this. I'm more than a little freaked out.

  • the tale of the expanding jpg... sound spooky to me. :c – easymoden00b Dec 19 '14 at 20:45
  • 1
    Can you list out your extensions? Who is your host? Have you read this? blog.nexcess.net/2014/07/25/… – kab8609 Dec 19 '14 at 20:48
  • 2
    btw it is base64 a:1:{s:2:"id";s:8:"W9HM7H8B";}--a:0:{} reminds you of anything? – Piotr Kaminski Dec 19 '14 at 21:13
  • Oh wow. I hadn't seen that. It looks like almost EXACTLY what happened to us. We didn't use any of those listed extensions at any time, but we have a LOT of extensions. I'll list the modules below if you want to look over them for suggestions. It looks like the exploit is running, but not actually working correctly probably because we have upgraded our core files, so the core files seem clean. The JPG file doesn't seem to contain the information that this article says we should be able to see. We are hosting with Peer 1, a dedicated server. – Steve Tallent Dec 19 '14 at 21:23
  • 1
    It does seem to be an exploit. To confirm this, you may need someone who can research into the codes and clean them up. I highly recommend the guys at Sucuri which are one of the most competent security researcher you can find (go for their Website AntiVirus): sucuri.net – Aspiration Hosting Dec 20 '14 at 5:52
1

This is not any hack happened to your website. This is because of your custom module that maybe use catalog/image helper methods to cache. because when the product image is cached in media/catalog/product/cache check its sub direcotry` its look like this..

/var/www/image/media/catalog/product/cache/1/image/9df78eab33525d08d6e5fb8d27136e95/1/0

So, from this check the number in the above path 9df78eab33525d08d6e5fb8d27136e95 this is what writed in that file. So some of your module or maybe your core module doing this.

Its look like the image is created by catalog/image helper class, so the image name is "NoImages" and then name contains 100_184 so it maybe tries to resize() but the x is added at end, usually catalog/image helper put x only for directory.

So Think about the statements i have listed above, definitely you will solve this..

Hope this helps to solve your problem..

  • 1
    good explanation, but you are way too optimistic. OP is not talking about cache folder but actual product folder. – Kalpesh Mar 21 '15 at 3:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.