Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A site I host was recently hacked. The index page had the following code added to the bottom (just above the closing body tag):

   <script language="javascript">document.write('<div style="font-family:Tahoma,Arial,Helvetica,sans-serif;font-size:12px;overflow:hidden;color:#FF0000;height:' + (325 * 3 - 974) + 'px;width:' + (18 * 786 - 14147) + 'px;font-weight:bold;margin-top:0px;margin-bottom:0px;">'); </script>

Followed by...

Lots and lots of tags going to spammy sites...

Our server has suphp installed, so I don't think it could've happened from another account. This account does have Wordpress installed, so that may be the problem.

Any tips on where to go from here?

Thanks!

share|improve this question

migrated from stackoverflow.com Aug 12 '10 at 18:09

This question came from our site for professional and enthusiast programmers.

3  
I suggest asking at server fault. And not posting the spam code here (or there). –  Scytale Aug 12 '10 at 18:02
    
Scytale, out of curiosity, why not? –  nnyby Aug 12 '10 at 18:05
1  
Yes, by posting the html here you are increasing this person's rank on search engines which is what they're trying to accomplish by hacking your site. You're giving them exactly what they want. –  Andrew Aug 12 '10 at 18:07
    
SO usually has some really quick indexing time on major search engines. By listing those links here, you are 'giving them attention' to the major search engines. And it just looked bad :) –  Tommy Aug 12 '10 at 18:07
add comment

4 Answers

Chnage your Wordpress and MySQL default login names and passwords. By using the default names, you have given the hackers half of the credential puzzle.

Ensure that your services (PHP, WP, MySQL) are all up to date.

Check 3rd party plugins for known vulnerabilities and updates (this includes javascript libraries and plug-ins)

That is a good start. Oh, and you may want to start watching your logs a little closer to see if you can pinpoint how this is happening if it happens again.

share|improve this answer
    
Thanks for cleaning up my post. I checked my logs and discovered the offending file was uploads/2009/06/wp-pass.php. Unfortunately our logs don't go back to as far as that file was created so we have no idea how it go there. Thanks for your help. –  Ian Silber Aug 12 '10 at 21:04
add comment

Your logs are most likely stored in /var/log/apache2. Start searching the access logs. You can do this manually using grep, or use a tool like apache-scalp to search your logs for common exploits.

share|improve this answer
add comment

I'd suggest installing the mod_security Apache module: http://www.modsecurity.org/.

Also, ensure your application code is not susceptible to SQL-Injection Attacks.

Also double-check your firewall rules, and ensure only port 80 is exposed to the public.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.