OpenX Vulnerability: “This Site May Harm Your Computer”

09/16/2010 Update: An update has been made to this post after another security hole has been discovered in OpenX, allowing hackers to inject malicious code again.

Yesterday I got multiple emails from Google regarding some of my websites that were supposedly pushing malware (or badware, whatever you want to call it) to the visitors’ computer:

Malware notification regarding www.mywebsite.com

Dear site owner or webmaster of mywebsite.com,

We recently discovered that some of your pages can cause users to be infected with malicious software. We have begun showing a warning page to users who visit these pages by clicking a search result on Google.com.

Below are some example URLs on your site which can cause users to be infected (space inserted to prevent accidental clicking in case your mail client auto-links URLs):

www.mywebsite.com

Here is a link to a sample warning page:

http://www.google.com/interstitial?url=www.mywebsite.com

We strongly encourage you to investigate this immediately to protect your visitors. Although some sites intentionally distribute malicious software, in many cases the webmaster is unaware because:

1) the site was compromised
2) the site doesn’t monitor for malicious user-contributed content
3) the site displays content from an ad network that has a malicious advertiser

If your site was compromised, it’s important to not only remove the malicious (and usually hidden) content from your pages, but to also identify and fix the vulnerability. We suggest contacting your hosting provider if you are unsure of how to proceed. StopBadware also has a resource page for securing compromised sites:

http://www.stopbadware.org/home/security

Once you’ve secured your site, you can request that the warning be removed by visiting
http://www.google.com/support/webmasters/bin/answer.py?answer=45432
and requesting a review. If your site is no longer harmful to users, we will remove the warning.

Sincerely,
Google Search Quality Team

Note: if you have an account in Google’s Webmaster Tools, you can verify the authenticity of this message by logging into https://www.google.com/webmasters/tools/siteoverview and going to the Message Center, where a warning will appear shortly.

At first I wasn’t even sure of the legitimacy of the emails so I went to my Google Webmaster Tools account to find out it was actually true.

Fortunately, Google gave me a few hints as to what code was suspicious so I got to find out it was due to OpenX. And as I use a single OpenX server to serve ads over all my websites, this caused Google to flag almost all of them as harmful. Within an hour, I got from 30,000+ visitors a day to almost nothing.

What Happened

I hadn’t updated OpenX in a while and was running version 2.8.1. This version is vulnerable to attacks where an IFRAME is embedded within the banner script which requests data from a badware site.

By using phpMyAdmin, I quickly found out which banners were affected:

SELECT *  FROM ox_banners WHERE append LIKE '%ifra%'
OR prepend LIKE '%ifra%';
SELECT *  FROM ox_zones WHERE append LIKE '%ifra%'
OR prepend LIKE '%ifra%';

How to Fix This

First of all, get the latest version of OpenX and upgrade it. Next, if you’re sure you’ve never used any “append” or “prepend” code in any of your banners, simply issue these two SQL queries using phpMyAdmin :

UPDATE ox_banners SET append = null, prepend = null
WHERE append LIKE '%ifra%' OR prepend LIKE '%ifra%';
UPDATE ox_zones SET append = null, prepend = null
WHERE append LIKE '%ifra%' OR prepend LIKE '%ifra%';

Otherwise you’ll have to edit each banner entry manually through either OpenX or phpMyAdmin to remove the malicious code.

Once you’ve cleaned up everything, delete the banner cache. You can do this by using an FTP client and deleting everything from /[openx directory/var/cache/

And finally you need to submit a review request to Google so that the warning is being removed from your site. This can be done by using either the Google Webmaster Tools by using the link you got in the warning email.