Sites Hacked

Gillie · Aug 28, 2008

Word to the wise ... make sure you are all secure and up to date with latest updates of software and sites and everything else.

Mine was done at lunchtime today and what seemed an innocent removal of the home page turned into the whole thing just not being accessible and eventually dying on its feet!!

I have heard of half a dozen now in the last week who have all suffered with hackers getting backdoor access.

OldWelshGuy · Aug 28, 2008

What script are you using?

Gillie · Aug 28, 2008

It was a wordpress site that had been customised!

Aug 28, 2008

Wordpress I believe...

worlddom · Aug 28, 2008

Bad luck Gillie. Is there no back up?

2.2.1 release is over 12 months old and will inevitably have some security issues

Gillie · Aug 28, 2008

Yep backup, but we are moving on to our third version of it, with a few more tweaks, so perhaps its a blessing, just the timing is bad!!

worlddom · Aug 28, 2008

Be careful not to wait in limbo too long or else you may encounter indexing issues.

Gillie · Aug 28, 2008

As I said, timing is bad bad bad ... got an article via Smallbizpod on Fox News today and just think of all that possible traffic I won't get!

Should be up and about at the weekend though, if all the stops are pulled out!

worlddom · Aug 28, 2008

Why not roll back to your backup in the meantime? Should be a 2 minute job.

noidea · Aug 28, 2008

Is this a wordpress problem or a exploit regarding a modification to it?

Gillie · Aug 28, 2008

worlddom said:
Why not roll back to your backup in the meantime? Should be a 2 minute job.

No access to anything, its a reload of the whole lot but yes I aim to get everything reloaded tomorrow and then work on it as version one was not a wordpress theme, just adapted to work on it, so its a tweaked thing that only works with early versions of wordpress, and version two, also does not work without a lot of manipulating with latest wordpress ... I never do anything the easy route!

asonda · Aug 29, 2008

Who hacked your site then? As when you get hacked, you inevitably get a message from the delightful hacker! Seen enough of them happen recently.

Interconnect IT · Aug 29, 2008

Often it's just people trying to get links back - often porn or medicine, but there's other hacks around. Sometimes it's just kids messing about.

It's not strictly necessary to upgrade, though it's advisable. You can 'harden' WordPress and the server it's on quite easily. We've had to do it with a few sites which can't be readily upgraded.

noidea · Aug 29, 2008

just a general/random note to other users chmod 777 to all files to get a script (well more of a software package really) to work is a BIG NO NO!

ozbon · Aug 29, 2008

noidea said:
just a general/random note to other users chmod 777 to all files to get a script (well more of a software package really) to work is a BIG NO NO!

Or at least, to chmod to 777 and then fail to chmod them back to something rather more secure.

[cynicism]Don't you just love learning experiences like that?[/cynicism]

noidea · Aug 29, 2008

ozbon said:
Or at least, to chmod to 777 and then fail to chmod them back to something rather more secure.

[cynicism]Don't you just love learning experiences like that?[/cynicism]

Obviously what I mean't! lol

For installation some scripts require 777 but not all directories (and their files), besides many packages require certain files at different chmod values so chmod everything back to what they were can cause problems.

Aug 29, 2008

Interconnect IT said:
Often it's just people trying to get links back - often porn or medicine, but there's other hacks around. Sometimes it's just kids messing about.

It's not strictly necessary to upgrade, though it's advisable. You can 'harden' WordPress and the server it's on quite easily. We've had to do it with a few sites which can't be readily upgraded.

A few little tips would be useful on how to doubly protect our WP blogs

I had an old joomla site (only a domain holding one, done ages ago, never looked at since) hacked last week, but it was coming down this week anyway, to make room for something else. What it did do tohugh, was to make me consider my security on others, and tighten it where necessary.

I found the following article which had some useful info...

http://herselfswebtools.com/2008/05...-be-hacked-and-how-to-avoid-being-chosen.html

and this thread on a webmaster forum had some decent tips too...

http://forums.digitalpoint.com/showthread.php?t=408106

stugster · Aug 29, 2008

And finally, there's not installing WordPress at all

Gillie · Aug 29, 2008

stugster said:
And finally, there's not installing WordPress at all

So useful an insight there Stuzie!! Such a help to me in during my dire times!

stugster · Aug 29, 2008

You know I'm always helpful

noidea · Aug 29, 2008

There are many tips I personally suggest:

-- ALWAYS KEEP A BACKUP (Not just if you are hacked, the database is more important thing on your blog or forum etc.)
-- ALWAYS APPLY UPDATES (sounds obvious, but always upgrade within a month of a release)
-- Don't display your wordpress version! (most don't bother checking anyway, but it helps against those who hate you, your blog or company)
-- never choose "admin", "root" or "administrator" as administrator username
-- lock out your wp-admin directory to just your IP address (if static), or better still rename it (you'd need to modify a few files as well though)
-- Not overdoing the chmod (which is a reason why most deface happens)
-- (if you are really clever) stick the files outside the public_html or htdocs directory, and either via script or htaccess make it accessible via the public accessible directory.
-- (if not an exploit) make sure you have strong passwords and get a mod that blocks attempts after 3 unsuccessful attempts.

I am sure there are many more...

Stationery-Direct · Aug 29, 2008

These may help for next time:

http://www.bad-neighborhood.com/login-lockdown.html

http://www.askapache.com/wordpress/htaccess-password-protect.html

Interconnect IT · Aug 29, 2008

Good advice all-round.

One tip - if you can edit your theme from within WordPress, your installation isn't particularly resilient and you're more likely to run into problems.

noidea · Aug 29, 2008

Interconnect IT said:
Good advice all-round.

One tip - if you can edit your theme from within WordPress, your installation isn't particularly resilient and you're more likely to run into problems.

Yeah I always have to do that via file manager or FTP as I don't bother setting the permissions so they are writeable.

Interconnect IT · Aug 29, 2008

One thing that's interesting is the user levels assigned to the ftp user as compared to the Apache user (assuming *nix). Ideally an ftp user is in a completely different group to Apache. Apache should only be able to read most things, and only have write permissions to the bare minimum.

Some hosts have the same user for the Apache instance as for the ftp users - that's quite scary to me, but appears to be quite common. However, I try and keep as far away from consumer grade hosting as possible - whenever clients come with it ready-brought it's always a painful story.

Aug 29, 2008

I grasped most of that, but please give us it in laymans terms

I would like to see some good tips on this thread useful to all of us in keeping ourselves safe from these hackers.

I hope that all hackers get bed sores

Interconnect IT · Aug 29, 2008

Erm - I don't think I can use laymens' terms!

But unless you're configuring your own servers (something I was horrified to find a client's hosting agreement expected us to do) you shouldn't really have to think or worry about it. And you probably can't do much about it anyway - fiddling with Linux security is, without a doubt, one of the easiest ways to lock yourself out of your own server I've ever come across. I have a little Linux machine that serves the house (a QNAP for those who are interested) and it's wonderful... my colleague has the same. He started playing around and experimenting and... had to completely reinstall everything. I've left mine a bit more alone and it Just Works - which is how I like it

Gillie · Aug 30, 2008

Well thanks to those who have suggested ways to prevent it happening again ... am implementing most of them as we speak, sorry type ... I am tired ... got half a site now but its hard work having to completely re-build it!

Aug 30, 2008

So our host should really have this all configured on our behalf then?

But, from a site-owners perspective, what would you suggest WE do to ensure we are protected? Anything other than the passwords/usernames, robots.tct, index pages, etc that have already been mentioned?

noidea · Aug 30, 2008

you mean robots.txt I presume.

That is a good method but many bots looking to hack you wont bother checking for these rules or if they do they do it to find out the directories you don't want indexed.

It helps for bots that use google, yahoo and msn etc. to look for websites to attack though I must say.

Aug 30, 2008

Yep, a small typo

Agreed, though there are quite a few good tips on this thread now for people to look into.

These hackers are another of the plagues t'internet brings with it.

Interconnect IT · Aug 30, 2008

If you're looking after your own security, you're going to have to learn it yourself. I can't tell you what to do on your server, besides setting permissions correctly - but if I say use 755 for a directory then on one server that'll work and on the other it won't.

One of the best things to do is to let go of control and leave it in someone else's responsibility. It's like trying to do accounting - is it worth becoming an expert in accountancy or should you just leave it to your accountants?

deepakrana · Aug 31, 2008

Its most of the time related to the server end,

If you are using Linux server, tell your host to add APF Firewall. This will help you a lot.

- Deepak

stugster · Aug 31, 2008

Not if it's a vulnerability in the website itself... SQL injection, etc.

deepakrana · Aug 31, 2008

Yea, SQL Injection is one form of it as well. replacing table prefix may help as well.

stugster · Aug 31, 2008

I agree that the server needs to be secure as possible, but in my experience, most localised site hacks are done because the hacker has taken advantage of the site in a vulnerable state.

http://www.mysql-apache-php.com/basic-linux-security.htm

Is a useful guide for setting up a Linux server securely (of course, this should be taken with a pinch of salt!)

Looking at the issue, an easy to spot vulnerability within the vBulletin the forums run on is that users can sign up with the same password as their username, e.g. stugster, stugster.

This would be an ideal situation for someone who wanted to "hack" or take advantage of such poor security. Sift, update

deepakrana · Aug 31, 2008

stugster said:
I agree that the server needs to be secure as possible, but in my experience, most localised site hacks are done because the hacker has taken advantage of the site in a vulnerable state.

Is a useful guide for setting up a Linux server securely (of course, this should be taken with a pinch of salt!)

Looking at the issue, an easy to spot vulnerability within the vBulletin the forums run on is that users can sign up with the same password as their username, e.g. stugster, stugster.

This would be an ideal situation for someone who wanted to "hack" or take advantage of such poor security. Sift, update

Excellent link stugster, very informative.

noidea · Aug 31, 2008

stugster said:
Not if it's a vulnerability in the website itself... SQL injection, etc.

Yes but in my eyes SQL injection is a vulnerability in the website...

If your scripts filtered and blocked out any exploits tried in your variables then you have safe site, otherwise, it is vulnerable!

Not having a stab at you - just saying to everyone else - they are ways and means of preventing them starting at your scripts...

stugster · Aug 31, 2008

That's what I was saying?

noidea · Aug 31, 2008

stugster said:
That's what I was saying?

Not woken up yet.... lol

Cookie Consent

Essential

Analytics

Marketing

Sites Hacked

worlddom

worlddom

worlddom

ozbon