[DUG-TO] index.php hacked

[Evan Leibovitch]

Hi folks.

A Drupal site that I work on stopped functioning a few minutes ago,
showing a parsing error on index.php.

Getting into the site by ssh revealed that the index.php file had been
modified; specifically, about 100K of HTML links to gambling and drug
sites had been appended to the usual Drupal index.php file.

So far I can't find anything else that's been modified; deleting the
offending stuff renders the site fully functional again.

This is your garden variety Cpanel/fantastico installation on a hosting
site located in Minnesota. It looks like the appended links were
intended mainly to boost Google rankings, as they were not meant to be
displayed.

Does anyone have ideas on how this happened and how recurrences can be
prevented?

Thanks!

- Evan