Hi,

 

I had two WP sites hacked over two days. Both on the same hosting server.

 

When viewing the website, it actually had webpage with blank background, starts and corny text saying that I have been hacked blah blah, and "Im proud to be Indian." Also with cheesy music.

I logged into the FTP and found a few files a had been added. index.html was added, index.php had been removed, 404.php had been added and this next file:

wysiwgPro_preview_eacf331foffc35d4b482f1d15a887d3b.php with a file type of application/x-httpd-php

 

Not sure what that is?!

 

How I knew was that WP sent me an email to say that I had forgotten my password and that it had been reset. I managed to get back in by changing the password in phpmyadmin. The guy had added his email address into my User Profile too.

 

What I want to know is; How did this guy get into the backend by changing my password and how did he alter the files in my FTP?

 

The other worrying thing is that he went and did it all over again to another website on the same server. Same method etc. Has this guy got details to my other sites?? If so, How?

 

I understand that it may be an impossible question to answer but I would love to find out if any of your guys have an idea?

 

Thanks in advance.

Sorry to hear your sites have been compromised.

 

With so many variables it's normally impossible to say exactly how your site was hacked.

 

First checkout http://codex.wordpress.org/FAQ_My_site_was_hacked

 

As you'll see WordPress recommend contacting your hosts. Have they given you any advice? - If your host is like us, they'll work through your log files and look for anything strange. Sometimes this can be enough to work back to a particular plugin etc.

 

These pages may also help; http://wordpress.stackexchange.com/search?q=hacked

 

Cheers,

 

Rich

 

P.S: Forgot to ask, what version of WP were you running at the time?

Edited April 22, 201214 yr by eCenica

If he's managed to do more than one site on the same server it's likely there's a server side security issue, or a securiy weakness in WP has allowed them to get in. As eCentica suggests, get in touch with your host to resolve the issue.

Wordpress security is a huge issue. I recently did some work for a client on a brand new WP install. 3 days later the site was compromised, and all the plugin files had the base64(...) spammer code prefixed.

 

There are a few resources available to toughen up your install (although if it was a server hack, these are superfluous):

 

• Hardening WordPress: http://codex.wordpress.org/Hardening_WordPress
  
• Protection with htaccess: http://www.netmagazine.com/tutorials/protect-your-wordpress-site-htaccess
  
• A handy list of plugins: http://www.hongkiat.com/blog/hardening-wordpress-security/
  

 

Regards,

 

Mei

Wordpress security is a huge issue. I recently did some work for a client on a brand new WP install. 3 days later the site was compromised, and all the plugin files had the base64(...) spammer code prefixed.

 

Good advice by Mei.

 

Our advice to our web hosting customers running WordPress is, the less popular the WordPress plugins/themes, the more suspicious you should be of the code.

 

A simple string search of the plugins files/theme for "base64" is a good start for detecting some of the nastiest JavaScript injections.

 

Rich

i have a few friends who are sys admins, and the first thing they do on most of there sites is ban places like, india, iran, egypt, brazil as there the worst for hacking might be something to consider

 

obv you still need to question the security of WP itself

Edited April 23, 201214 yr by JoshUK

I'm taking a stab at a dodgy plugin, I did uninstall one which had a Dashboard widget with links to The Latest WordPress News; all the links went to to sites with Malware issues....

 

I think I should report the plugin? It had 4 out of 5 stars in the repo too?!!?

 

My hosts say that they havn't had any issues with other clients so I think it's just me. It's gotta be that plugin.

 

Thanks for all the advice and the helpful links.

Worth changing your FTP password, just in case.

 

As far as hardening WordPress goes, here's a few bits and bobs:

 

1. Never use an account called "admin".
   
2. Change the database table prefix to something other than "wp_".
   
3. Make sure your file permissions are tight.
   
4. Add a bit of security to your .htaccess. I use a modified version of the Perishable Press 5G Firewall:
   

 

# Disallow access to .htaccess and .htpasswd files
<Files ~ "^.*\.([Hh][Tt])">
order allow,deny
deny from all
satisfy all
</Files>

# Anti XSS protection
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
RewriteCond %{QUERY_STRING} (\|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index_error.php [F,L]
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

# Anti cross site tracing - protection
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
</IfModule>

# disable directory browsing
Options All -Indexes

#disallow comment posting with no or foreign referrer - bye bye, spambots
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !.*[b]yourdomain.com[/b].* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

# compress text, html, javascript, css, xml:
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript

# 5G FIREWALL from PerishablePress.com

# 5G:[QUERY STRINGS]
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REMOTE_ADDR} =86.130.254.239
RewriteRule http://www.legislation.gov.uk/ukpga/1990/18/contents [R]
RewriteCond %{QUERY_STRING} (environ|localhost|mosconfig|scanner) [NC,OR]
RewriteCond %{QUERY_STRING} (menu|mod|path|tag)\=\.?/? [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini  [NC,OR]
RewriteCond %{QUERY_STRING} echo.*kae  [NC,OR]
RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
RewriteCond %{QUERY_STRING} \=\\%27$   [NC,OR]
RewriteCond %{QUERY_STRING} \=\\\'$    [NC,OR]
RewriteCond %{QUERY_STRING} \.\./      [NC,OR]
RewriteCond %{QUERY_STRING} \:         [NC,OR]
RewriteCond %{QUERY_STRING} \[         [NC,OR]
RewriteCond %{QUERY_STRING} \]         [NC,OR]
RewriteCond %{QUERY_STRING} 3.0.2.1$	[NC]
RewriteRule .* - [F]
</IfModule>

# 5G:[uSER AGENTS]
<IfModule mod_setenvif.c>
SetEnvIfNoCase User-Agent ^$ keep_out
SetEnvIfNoCase User-Agent (casper|cmsworldmap|diavol|dotbot)   keep_out
SetEnvIfNoCase User-Agent (flicky|ia_archiver|jakarta|kmccrew) keep_out
SetEnvIfNoCase User-Agent (libwww|planetwork|pycurl|skygrid)   keep_out
<Limit GET POST PUT>
 Order Allow,Deny
 Allow from all
 Deny from env=keep_out
</Limit>
</IfModule>

# 5G:[REQUEST STRINGS]
<IfModule mod_alias.c>
RedirectMatch 403 (https?|ftp|php)\://
RedirectMatch 403 /(cgi|https?|ima|ucp)/
RedirectMatch 403 (\=\\\'|\=\\%27|/\\\'/?|\)\.css\()$
RedirectMatch 403 (\,|//|\)\+|/\,/|\{0\}|\(/\(|\.\.\.|\+\+\+|\|)
RedirectMatch 403 \.(cgi|asp|aspx|cfg|dll|exe|jsp|mdb|sql|ini|rar)$
RedirectMatch 403 /(contac|fpw|install|pingserver|register)\.php
RedirectMatch 403 (base64|crossdomain|localhost|wwwroot)
RedirectMatch 403 (eval\(|\_vti\_|\(null\)|echo.*kae)
RedirectMatch 403 \.well\-known/host\-meta
RedirectMatch 403 /function\.array\-rand
RedirectMatch 403 \)\;\$\(this\)\.html\(
RedirectMatch 403 proc/self/environ
RedirectMatch 403 msnbot\.htm\)\.\_
RedirectMatch 403 /ref\.outcontrol
RedirectMatch 403 com\_cropimage
RedirectMatch 403 indonesia\.htm
RedirectMatch 403 \{\$itemURL\}
RedirectMatch 403 function\(\)
RedirectMatch 403 labels\.rdf
</IfModule>

 

The above needs to go before the standard WordPress stuff in your .htaccess file.

 

Edit: at the end of the day, you can have all the security in the world and someone can still access your files if you're on a shared box and someone else on the same box hasn't taken precautions.

Edited April 27, 201214 yr by Renaissance-Design