PDA

View Full Version : Clear out old/trial website scripts - a tip/warning!


CrispyUK
16th January 2009, 17:39
Just thought I'd mention this as it's something we got caught out with this week...!

If you've ever tried out a script or program on your website, or used to use something and it's no longer in use - it's a good idea to remove the files from the server.

I got a message earlier in the week from one of our site team letting me know we'd been hacked, our homepage had been changed to a political message littered with profanity. After some digging around the server logs (never done this before so was quite pleased with myself to solve it!) I found some suspicious entries and traced it down to an old copy of flashchat that we'd experimented with in June 2006 and never removed.

Turns out this had a vulnerability and had allowed them to upload a PHP file into the flashchat directory, and from that they could edit pretty much what they liked on the server space.

Interestingly, the first thing I did after noting the edit time and taking a 'forensic' copy of the new homepage, was to throw up a quick page in our site colours stating we were offline for maintenance (I didn't have the correct homepage to hand). Shortly after doing that and while hunting for the entry point, it had been left in the same style but wording changed to another political message - are hacked sites usually monitored by the hackers? (I guess a long standing edit is a bit of a trophy piece for them?).

So, if you think you've got anything like that sitting on your webspace, check it out, take a local backup incase you need it again and remove it :)

This also applies equally to keep updated scripts that are in use on your site, although you need to take more care with these and be careful if you've skinned or customised them in any way - updates often break them!

stugster
16th January 2009, 18:15
Good tips there! It's surprising how often people leave crap lying around a publicly accessible directory. I'm bad for it myself!


Just for fun: http://www.puremango.co.uk/cm_wargames_110.php

Subbynet
16th January 2009, 18:40
You really need someone to test the security of your website on a regular basis ;)

KM-Tiger
16th January 2009, 18:51
- are hacked sites usually monitored by the hackers?

Often yes. If you check out your backlinks with Google tools you might find yourself referenced somewhere you'd rather not be.

Do be sure you have removed all traces of the hack. Unless you are certain you know how to find everything that has been changed, you are probably better to delete everything and restore a known good backup.

Subbynet
16th January 2009, 19:12
Unless you are certain you know how to find everything that has been changed, you are probably better to delete everything and restore a known good backup.

This is true, and it is not unknown for a hacker to place malicious code inside an existing file. For this reason you should run file integrity checkers on a regular basis.

Edward Moss
16th January 2009, 19:25
This is true, and it is not unknown for a hacker to place malicious code inside an existing file. For this reason you should run file integrity checkers on a regular basis.

Is that something I can do or does it have to be a webmaster wizard?

Subbynet
16th January 2009, 20:05
Is that something I can do or does it have to be a webmaster wizard?

Hi Edward,

Integrity checking is just one facet of your security. I'm not sure I would advise just anyone to implement the security systems - some can be rather technical to set up and understand.

These systems should be checked by a competent person, as while they're helpful they can only work to the rules they are programmed for.

Dwebs-Ltd
16th January 2009, 23:07
The most common cases of hacked websites we see is down to outdated scripts and always will be. Popular opensource and commercial application are always open to hack attempts.

Touch wood none of our brands have had their websites hacked yet.

I've been trying to find a decent solution for a while now that we can use to scan websites we host for vulnerabilities but nothing of high quality or affordable has popped up. But if someone finds something let me know :)

PointandStare
17th January 2009, 02:37
Why are you testing scripts on a live site?
Never do that. Only test them on a fresh local dev install.

Interconnect IT
17th January 2009, 08:44
Why are you testing scripts on a live site?
Never do that. Only test them on a fresh local dev install.

Sometimes you're not so much testing, as trialling. i.e. you've tested on a dev machine and now want to push it out to users in beta form. If they then don't like it you switch it off... but really should tidy up.