Editing triggers popup asking for username and password – security breach?

One of my editors is reporting this same problem today. I checked the site with Safari and Firefox, but was unable to reproduce the error. Would be interested if you figure out anything else on this issue.

Recently within this last month, my computer’s (I run Windows) anti virus caught a backdoor Trojan that had -somehow- attached itself to my SSH program/client. Additionally, it caught a random contaminated program file (not yet executed) along with it.

I got rid of the Trojan and the questionable/Trojan/spyware/malware .exe and changed all passwords to anything related to any of my accounts on that SSH client and sent my server host a message letting them know of the possible compromisation.

I have never experienced anything else after that that would look like an ‘attack’ on my WP installs or websites in general and no ad-ware or mal-ware infestations, either.

My question to you all, therefore, is, perhaps something similar happened to you?

A backdoor Trojan that got through your FTP/SSH/related client perhaps that is giving you these pop-ups that seem to be phishing for information?

The server (our server domain, e.g. DOMAIN.COM) at Magic

Does it show your domain? Do you have a server at “Magic”?

Have you checked wp-login.php for additional code?

kmessinger: Yes, it shows our domain name. So if our domain was google.com, it would say “The server google.com at Magic”. And no, we have no relationship with anything called Magic. Our host is RimuHosting.

I skimmed over wp-login.php which is a long file and coulnd’t find anything alarming. I ran a diff of wp-login against https://svn.automattic.com/wordpress/branches/2.7/wp-login.php and it was exactly the same. Did you mean wp-config or wp-settings? Nothing on wp-config; as for wp-setttings there’s this stuff

set_magic_quotes_runtime(0);
@ini_set(‘magic_quotes_sybase’, 0);

but it’s just standard WordPress code as far as I’m concerned

EMG: if the trojan had our root password, why would it phish for more? it could test out its password at the WordPress install and if it works there would be no need to reveal yourself.

I’m having the same problem here. I just went to put up a new post and received a dialog box stating “authentication required” and it also says the site says Magic. All the usual usernames and passcodes will not get me in.

I’m having the exact thing, too. I just ran a virus scan last night (through Kaspersky) and now this morning I’m getting this pop-up from Magic.
I have no idea who Magic is, I contacted my host server and it’s not them.
It FEELS phishy, so I didn’t enter any passwords. I didn’t check it in Firefox, but the error message did come up in Google Chrome and IE.
I’m also running 2.7 and have hesitated updgrading until they slow down with the updates.

I just checked it in Firefox and I’m getting the pop-up.
Anyone know what this is?

Potentially it’s a hack that’s been introduced through the XSS vunerability present in versions before 2.8.2. I’ve not seen someone say that this has been introduced on a 2.8.2 site yet.

However it is interesting that people are seeing this on sites where the core files have not been altered, so possibly its a hack through a plugin.

@yokima did you check all your WordPress core files?

Obviously upgrading would replace all the core stuff, but it wouldn’t fix any hacks that had been introduced elsewhere e.g. other malicious code or database-hidden stuff.

There is a server partition software called Magic but I think all of your servers running this is unlikely.

There is a Lucky virus but it does not do what you describe.

Of course, you can do the normal chore and turn off all plugins, switch to default theme and see if the problem goes away.

mrmist: to upgrade, we obviously need to back up… will that bring the infection with us?

If you back up a hacked blog it will back up any hacks that are in your database, yes.

So if you were to restore to that backup later, you would need to clean it out of any malicious content.

bummer. Not being a coder, how do I find this content to clean it out? My spyware scan last night obviously didn’t find it.

Unfortunately the scattered nature of this is making it difficult to say exactly what it is and what to do about it. Uploading a fresh wordpress zip over your existing files might help.

If you have you entire site on your local computer also do a search for Magic.

You can go to your db and do the same thing.

The other threads on this topic points towards the malicious file being in wp-includes, possibly in the js directory. If anyone finds anything odd please post here.