Sites Hacked

[Gillie]

Word to the wise ... make sure you are all secure and up to date with latest updates of software and sites and everything else.

Mine was done at lunchtime today and what seemed an innocent removal of the home page turned into the whole thing just not being accessible and eventually dying on its feet!!

I have heard of half a dozen now in the last week who have all suffered with hackers getting backdoor access.

 

[OldWelshGuy]

What script are you using?

 

[Gillie]

It was a wordpress site that had been customised!

 

Wordpress I believe...

 

[worlddom]

Bad luck Gillie. Is there no back up?

2.2.1 release is over 12 months old and will inevitably have some security issues

 

[Gillie]

Yep backup, but we are moving on to our third version of it, with a few more tweaks, so perhaps its a blessing, just the timing is bad!!

 

[worlddom]

Be careful not to wait in limbo too long or else you may encounter indexing issues.

 

[Gillie]

As I said, timing is bad bad bad ... got an article via Smallbizpod on Fox News today and just think of all that possible traffic I won't get!

Should be up and about at the weekend though, if all the stops are pulled out!

 

[worlddom]

Why not roll back to your backup in the meantime? Should be a 2 minute job.

 

[noidea]

Is this a wordpress problem or a exploit regarding a modification to it?

 

[Gillie]

Why not roll back to your backup in the meantime? Should be a 2 minute job.

No access to anything, its a reload of the whole lot but yes I aim to get everything reloaded tomorrow and then work on it as version one was not a wordpress theme, just adapted to work on it, so its a tweaked thing that only works with early versions of wordpress, and version two, also does not work without a lot of manipulating with latest wordpress ... I never do anything the easy route!

 

[asonda]

Who hacked your site then? As when you get hacked, you inevitably get a message from the delightful hacker! Seen enough of them happen recently.

 

[Interconnect IT]

Often it's just people trying to get links back - often porn or medicine, but there's other hacks around. Sometimes it's just kids messing about.

It's not strictly necessary to upgrade, though it's advisable. You can 'harden' WordPress and the server it's on quite easily. We've had to do it with a few sites which can't be readily upgraded.

 

[noidea]

just a general/random note to other users chmod 777 to all files to get a script (well more of a software package really) to work is a BIG NO NO!

 

[ozbon]

just a general/random note to other users chmod 777 to all files to get a script (well more of a software package really) to work is a BIG NO NO!

Or at least, to chmod to 777 and then fail to chmod them back to something rather more secure.

[cynicism]Don't you just love learning experiences like that?[/cynicism]

 

[noidea]

Or at least, to chmod to 777 and then fail to chmod them back to something rather more secure.

[cynicism]Don't you just love learning experiences like that?[/cynicism]

Obviously what I mean't! lol

For installation some scripts require 777 but not all directories (and their files), besides many packages require certain files at different chmod values so chmod everything back to what they were can cause problems.

 

Often it's just people trying to get links back - often porn or medicine, but there's other hacks around. Sometimes it's just kids messing about.

It's not strictly necessary to upgrade, though it's advisable. You can 'harden' WordPress and the server it's on quite easily. We've had to do it with a few sites which can't be readily upgraded.

A few little tips would be useful on how to doubly protect our WP blogs

I had an old joomla site (only a domain holding one, done ages ago, never looked at since) hacked last week, but it was coming down this week anyway, to make room for something else. What it did do tohugh, was to make me consider my security on others, and tighten it where necessary.

I found the following article which had some useful info...

http://herselfswebtools.com/2008/05...-be-hacked-and-how-to-avoid-being-chosen.html

and this thread on a webmaster forum had some decent tips too...

http://forums.digitalpoint.com/showthread.php?t=408106

 

[stugster]

And finally, there's not installing WordPress at all

 

[Gillie]

And finally, there's not installing WordPress at all

So useful an insight there Stuzie!! Such a help to me in during my dire times!

 

[stugster]

You know I'm always helpful

 

[noidea]

There are many tips I personally suggest:

-- ALWAYS KEEP A BACKUP (Not just if you are hacked, the database is more important thing on your blog or forum etc.)
-- ALWAYS APPLY UPDATES (sounds obvious, but always upgrade within a month of a release)
-- Don't display your wordpress version! (most don't bother checking anyway, but it helps against those who hate you, your blog or company)
-- never choose "admin", "root" or "administrator" as administrator username
-- lock out your wp-admin directory to just your IP address (if static), or better still rename it (you'd need to modify a few files as well though)
-- Not overdoing the chmod (which is a reason why most deface happens)
-- (if you are really clever) stick the files outside the public_html or htdocs directory, and either via script or htaccess make it accessible via the public accessible directory.
-- (if not an exploit) make sure you have strong passwords and get a mod that blocks attempts after 3 unsuccessful attempts.

I am sure there are many more...

 

[Stationery-Direct]

These may help for next time:

http://www.bad-neighborhood.com/login-lockdown.html

http://www.askapache.com/wordpress/htaccess-password-protect.html

 

[Interconnect IT]

Good advice all-round.

One tip - if you can edit your theme from within WordPress, your installation isn't particularly resilient and you're more likely to run into problems.

 

[noidea]

Good advice all-round.

One tip - if you can edit your theme from within WordPress, your installation isn't particularly resilient and you're more likely to run into problems.

Yeah I always have to do that via file manager or FTP as I don't bother setting the permissions so they are writeable.

 

[Interconnect IT]

One thing that's interesting is the user levels assigned to the ftp user as compared to the Apache user (assuming *nix). Ideally an ftp user is in a completely different group to Apache. Apache should only be able to read most things, and only have write permissions to the bare minimum.

Some hosts have the same user for the Apache instance as for the ftp users - that's quite scary to me, but appears to be quite common. However, I try and keep as far away from consumer grade hosting as possible - whenever clients come with it ready-brought it's always a painful story.

 

I grasped most of that, but please give us it in laymans terms

I would like to see some good tips on this thread useful to all of us in keeping ourselves safe from these hackers.

I hope that all hackers get bed sores

 

[Interconnect IT]

Erm - I don't think I can use laymens' terms!

But unless you're configuring your own servers (something I was horrified to find a client's hosting agreement expected us to do) you shouldn't really have to think or worry about it. And you probably can't do much about it anyway - fiddling with Linux security is, without a doubt, one of the easiest ways to lock yourself out of your own server I've ever come across. I have a little Linux machine that serves the house (a QNAP for those who are interested) and it's wonderful... my colleague has the same. He started playing around and experimenting and... had to completely reinstall everything. I've left mine a bit more alone and it Just Works - which is how I like it

 

[Gillie]

Well thanks to those who have suggested ways to prevent it happening again ... am implementing most of them as we speak, sorry type ... I am tired ... got half a site now but its hard work having to completely re-build it!

 

So our host should really have this all configured on our behalf then?

But, from a site-owners perspective, what would you suggest WE do to ensure we are protected? Anything other than the passwords/usernames, robots.tct, index pages, etc that have already been mentioned?

 

[noidea]

you mean robots.txt I presume.

That is a good method but many bots looking to hack you wont bother checking for these rules or if they do they do it to find out the directories you don't want indexed.

It helps for bots that use google, yahoo and msn etc. to look for websites to attack though I must say.

 

Yep, a small typo

Agreed, though there are quite a few good tips on this thread now for people to look into.

These hackers are another of the plagues t'internet brings with it.

 

[Interconnect IT]

If you're looking after your own security, you're going to have to learn it yourself. I can't tell you what to do on your server, besides setting permissions correctly - but if I say use 755 for a directory then on one server that'll work and on the other it won't.

One of the best things to do is to let go of control and leave it in someone else's responsibility. It's like trying to do accounting - is it worth becoming an expert in accountancy or should you just leave it to your accountants?

 

[deepakrana]

Its most of the time related to the server end,

If you are using Linux server, tell your host to add APF Firewall. This will help you a lot.

- Deepak

 

[stugster]

Not if it's a vulnerability in the website itself... SQL injection, etc.

 

[deepakrana]

Yea, SQL Injection is one form of it as well. replacing table prefix may help as well.

 

[stugster]

I agree that the server needs to be secure as possible, but in my experience, most localised site hacks are done because the hacker has taken advantage of the site in a vulnerable state.

http://www.mysql-apache-php.com/basic-linux-security.htm

Is a useful guide for setting up a Linux server securely (of course, this should be taken with a pinch of salt!)

Looking at the issue, an easy to spot vulnerability within the vBulletin the forums run on is that users can sign up with the same password as their username, e.g. stugster, stugster.

This would be an ideal situation for someone who wanted to "hack" or take advantage of such poor security. Sift, update

 

[deepakrana]

I agree that the server needs to be secure as possible, but in my experience, most localised site hacks are done because the hacker has taken advantage of the site in a vulnerable state.


Is a useful guide for setting up a Linux server securely (of course, this should be taken with a pinch of salt!)

Looking at the issue, an easy to spot vulnerability within the vBulletin the forums run on is that users can sign up with the same password as their username, e.g. stugster, stugster.

This would be an ideal situation for someone who wanted to "hack" or take advantage of such poor security. Sift, update

Excellent link stugster, very informative.

 

[noidea]

Not if it's a vulnerability in the website itself... SQL injection, etc.

Yes but in my eyes SQL injection is a vulnerability in the website...

If your scripts filtered and blocked out any exploits tried in your variables then you have safe site, otherwise, it is vulnerable!

Not having a stab at you - just saying to everyone else - they are ways and means of preventing them starting at your scripts...

 

[stugster]

That's what I was saying?

 

[noidea]

That's what I was saying?

Not woken up yet.... lol