1

A site I host was recently hacked. The index page had the following code added to the bottom (just above the closing body tag):

   <script language="javascript">document.write('<div style="font-family:Tahoma,Arial,Helvetica,sans-serif;font-size:12px;overflow:hidden;color:#FF0000;height:' + (325 * 3 - 974) + 'px;width:' + (18 * 786 - 14147) + 'px;font-weight:bold;margin-top:0px;margin-bottom:0px;">'); </script>

Followed by...

Lots and lots of tags going to spammy sites...

Our server has suphp installed, so I don't think it could've happened from another account. This account does have Wordpress installed, so that may be the problem.

Any tips on where to go from here?

Thanks!

4
  • 3
    I suggest asking at server fault. And not posting the spam code here (or there).
    – scy
    Aug 12, 2010 at 18:02
  • Scytale, out of curiosity, why not?
    – nnyby
    Aug 12, 2010 at 18:05
  • 1
    Yes, by posting the html here you are increasing this person's rank on search engines which is what they're trying to accomplish by hacking your site. You're giving them exactly what they want.
    – Andrew
    Aug 12, 2010 at 18:07
  • SO usually has some really quick indexing time on major search engines. By listing those links here, you are 'giving them attention' to the major search engines. And it just looked bad :)
    – Tommy
    Aug 12, 2010 at 18:07

4 Answers 4

5

Chnage your Wordpress and MySQL default login names and passwords. By using the default names, you have given the hackers half of the credential puzzle.

Ensure that your services (PHP, WP, MySQL) are all up to date.

Check 3rd party plugins for known vulnerabilities and updates (this includes javascript libraries and plug-ins)

That is a good start. Oh, and you may want to start watching your logs a little closer to see if you can pinpoint how this is happening if it happens again.

1
  • Thanks for cleaning up my post. I checked my logs and discovered the offending file was uploads/2009/06/wp-pass.php. Unfortunately our logs don't go back to as far as that file was created so we have no idea how it go there. Thanks for your help.
    – Ian Silber
    Aug 12, 2010 at 21:04
1

Your logs are most likely stored in /var/log/apache2. Start searching the access logs. You can do this manually using grep, or use a tool like apache-scalp to search your logs for common exploits.

0

I'd suggest installing the mod_security Apache module: http://www.modsecurity.org/.

Also, ensure your application code is not susceptible to SQL-Injection Attacks.

Also double-check your firewall rules, and ensure only port 80 is exposed to the public.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .