Toggle sidebar

Sites Hacked

Sort by date Sort by votes
Gillie

Gillie

Free Member
Apr 12, 2006
13,065
1,461
North West England
Word to the wise ... make sure you are all secure and up to date with latest updates of software and sites and everything else.

Mine was done at lunchtime today and what seemed an innocent removal of the home page turned into the whole thing just not being accessible and eventually dying on its feet!!

I have heard of half a dozen now in the last week who have all suffered with hackers getting backdoor access.
 
Bad luck Gillie. Is there no back up?

2.2.1 release is over 12 months old and will inevitably have some security issues
 
Upvote 0
As I said, timing is bad bad bad ... got an article via Smallbizpod on Fox News today and just think of all that possible traffic I won't get!

Should be up and about at the weekend though, if all the stops are pulled out!
 
Upvote 0
worlddom said:
Why not roll back to your backup in the meantime? Should be a 2 minute job.
Click to expand...

No access to anything, its a reload of the whole lot but yes I aim to get everything reloaded tomorrow and then work on it as version one was not a wordpress theme, just adapted to work on it, so its a tweaked thing that only works with early versions of wordpress, and version two, also does not work without a lot of manipulating with latest wordpress ... I never do anything the easy route!
 
Upvote 0
Who hacked your site then? As when you get hacked, you inevitably get a message from the delightful hacker! Seen enough of them happen recently.
 
Upvote 0
Often it's just people trying to get links back - often porn or medicine, but there's other hacks around. Sometimes it's just kids messing about.

It's not strictly necessary to upgrade, though it's advisable. You can 'harden' WordPress and the server it's on quite easily. We've had to do it with a few sites which can't be readily upgraded.
 
Upvote 0
just a general/random note to other users chmod 777 to all files to get a script (well more of a software package really) to work is a BIG NO NO!
 
Upvote 0
noidea said:
just a general/random note to other users chmod 777 to all files to get a script (well more of a software package really) to work is a BIG NO NO!
Click to expand...

Or at least, to chmod to 777 and then fail to chmod them back to something rather more secure. :)

[cynicism]Don't you just love learning experiences like that?[/cynicism]
 
Upvote 0
ozbon said:
Or at least, to chmod to 777 and then fail to chmod them back to something rather more secure. :)

[cynicism]Don't you just love learning experiences like that?[/cynicism]
Click to expand...
Obviously what I mean't! lol

For installation some scripts require 777 but not all directories (and their files), besides many packages require certain files at different chmod values so chmod everything back to what they were can cause problems.
 
Upvote 0
Interconnect IT said:
Often it's just people trying to get links back - often porn or medicine, but there's other hacks around. Sometimes it's just kids messing about.

It's not strictly necessary to upgrade, though it's advisable. You can 'harden' WordPress and the server it's on quite easily. We've had to do it with a few sites which can't be readily upgraded.
Click to expand...

A few little tips would be useful on how to doubly protect our WP blogs ;) :)

I had an old joomla site (only a domain holding one, done ages ago, never looked at since) hacked last week, but it was coming down this week anyway, to make room for something else. What it did do tohugh, was to make me consider my security on others, and tighten it where necessary.

I found the following article which had some useful info...

http://herselfswebtools.com/2008/05...-be-hacked-and-how-to-avoid-being-chosen.html

and this thread on a webmaster forum had some decent tips too...

http://forums.digitalpoint.com/showthread.php?t=408106
 
Upvote 0
There are many tips I personally suggest:

-- ALWAYS KEEP A BACKUP (Not just if you are hacked, the database is more important thing on your blog or forum etc.)
-- ALWAYS APPLY UPDATES (sounds obvious, but always upgrade within a month of a release)
-- Don't display your wordpress version! (most don't bother checking anyway, but it helps against those who hate you, your blog or company)
-- never choose "admin", "root" or "administrator" as administrator username
-- lock out your wp-admin directory to just your IP address (if static), or better still rename it (you'd need to modify a few files as well though)
-- Not overdoing the chmod (which is a reason why most deface happens)
-- (if you are really clever) stick the files outside the public_html or htdocs directory, and either via script or htaccess make it accessible via the public accessible directory.
-- (if not an exploit) make sure you have strong passwords and get a mod that blocks attempts after 3 unsuccessful attempts.

I am sure there are many more...
 
  • Like
Reactions: Comspec
Upvote 0
Interconnect IT said:
Good advice all-round.

One tip - if you can edit your theme from within WordPress, your installation isn't particularly resilient and you're more likely to run into problems.
Click to expand...
Yeah I always have to do that via file manager or FTP as I don't bother setting the permissions so they are writeable.
 
Upvote 0
One thing that's interesting is the user levels assigned to the ftp user as compared to the Apache user (assuming *nix). Ideally an ftp user is in a completely different group to Apache. Apache should only be able to read most things, and only have write permissions to the bare minimum.

Some hosts have the same user for the Apache instance as for the ftp users - that's quite scary to me, but appears to be quite common. However, I try and keep as far away from consumer grade hosting as possible - whenever clients come with it ready-brought it's always a painful story.
 
  • Like
Reactions: Comspec
Upvote 0
I grasped most of that, but please give us it in laymans terms :)

I would like to see some good tips on this thread useful to all of us in keeping ourselves safe from these hackers.

I hope that all hackers get bed sores :)
 
Upvote 0
Erm - I don't think I can use laymens' terms!

But unless you're configuring your own servers (something I was horrified to find a client's hosting agreement expected us to do) you shouldn't really have to think or worry about it. And you probably can't do much about it anyway - fiddling with Linux security is, without a doubt, one of the easiest ways to lock yourself out of your own server I've ever come across. I have a little Linux machine that serves the house (a QNAP for those who are interested) and it's wonderful... my colleague has the same. He started playing around and experimenting and... had to completely reinstall everything. I've left mine a bit more alone and it Just Works - which is how I like it :)
 
  • Like
Reactions: Comspec
Upvote 0
Well thanks to those who have suggested ways to prevent it happening again ... am implementing most of them as we speak, sorry type ... I am tired ... got half a site now but its hard work having to completely re-build it!
 
Upvote 0
So our host should really have this all configured on our behalf then?

But, from a site-owners perspective, what would you suggest WE do to ensure we are protected? Anything other than the passwords/usernames, robots.tct, index pages, etc that have already been mentioned?
 
Upvote 0
you mean robots.txt I presume.

That is a good method but many bots looking to hack you wont bother checking for these rules or if they do they do it to find out the directories you don't want indexed.

It helps for bots that use google, yahoo and msn etc. to look for websites to attack though I must say.
 
Upvote 0
Yep, a small typo :)

Agreed, though there are quite a few good tips on this thread now for people to look into.

These hackers are another of the plagues t'internet brings with it.
 
Upvote 0
If you're looking after your own security, you're going to have to learn it yourself. I can't tell you what to do on your server, besides setting permissions correctly - but if I say use 755 for a directory then on one server that'll work and on the other it won't.

One of the best things to do is to let go of control and leave it in someone else's responsibility. It's like trying to do accounting - is it worth becoming an expert in accountancy or should you just leave it to your accountants?
 
Upvote 0
Its most of the time related to the server end,

If you are using Linux server, tell your host to add APF Firewall. This will help you a lot.

- Deepak
 
Upvote 0
I agree that the server needs to be secure as possible, but in my experience, most localised site hacks are done because the hacker has taken advantage of the site in a vulnerable state.

http://www.mysql-apache-php.com/basic-linux-security.htm

Is a useful guide for setting up a Linux server securely (of course, this should be taken with a pinch of salt!)

Looking at the issue, an easy to spot vulnerability within the vBulletin the forums run on is that users can sign up with the same password as their username, e.g. stugster, stugster.

This would be an ideal situation for someone who wanted to "hack" or take advantage of such poor security. Sift, update :p
 
Upvote 0
stugster said:
I agree that the server needs to be secure as possible, but in my experience, most localised site hacks are done because the hacker has taken advantage of the site in a vulnerable state.


Is a useful guide for setting up a Linux server securely (of course, this should be taken with a pinch of salt!)

Looking at the issue, an easy to spot vulnerability within the vBulletin the forums run on is that users can sign up with the same password as their username, e.g. stugster, stugster.

This would be an ideal situation for someone who wanted to "hack" or take advantage of such poor security. Sift, update :p
Click to expand...

Excellent link stugster, very informative.
 
Upvote 0
stugster said:
Not if it's a vulnerability in the website itself... SQL injection, etc.
Click to expand...
Yes but in my eyes SQL injection is a vulnerability in the website...

If your scripts filtered and blocked out any exploits tried in your variables then you have safe site, otherwise, it is vulnerable!

Not having a stab at you - just saying to everyone else - they are ways and means of preventing them starting at your scripts...
 
Upvote 0
You must log in or register to reply here.

Latest Articles

Top Bottom
Back