up vote 3 down vote favorite
share [g+] share [fb]

My Website has been Hacked by Black Jaguar... Help?

link|improve this question
14  
Unfortunately this situation is so common we now have a slogan for such questions: "Nuke it from orbit, and restore from backup; it's the only way to be sure" – Chris S♦ Sep 10 '10 at 14:11
possible duplicate of My server's been hacked EMERGENCY – Tom O'Connor Apr 17 at 14:50
feedback

migrated from stackoverflow.com Sep 10 '10 at 13:43

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 42 down vote accepted

Take it down now and assume all data has been compromised. Restore from a known-good backup; if you have been storing sensitive/private data, assume the hacker also has them; respond accordingly.

If your site was hacked through a vulnerability in your code, you may want to close that before you put it back online - else it will get hacked again and again.

link|improve this answer
1  
I wish I could upvote this twice. – keithwarren7 Sep 10 '10 at 13:43
5  
@Keith - Now it's been migrated I think you literally can! – Martin Smith Sep 10 '10 at 13:45
2  
Also, check the log files to find the hacker's point of entry (if you can) and fix it. – Chris Nava Sep 10 '10 at 14:22
1  
looking at the automated script-kiddie like results from a quick google search of the hacker, i'd stick my neck out and say it'll be an automated SQL injection. did your site use sql at all, or any large sql based projects (which were out of date maybe?) ? – Sirex Sep 10 '10 at 14:26
1  
Yea, id give them a heads up. They should be able to wipe the slate clean and give you a decent idea that the new platform is secure. you need to assume they gained root access to the system. was joomla, sqp server etc all up to date at the time ? – Sirex Sep 15 '10 at 7:03
show 3 more comments
feedback
up vote 0 down vote

I was just hacked by the same creep. I have several pretty plain wordpress sites, nothing special except for some automated content being posted. Could something like wp-o-matic have loaded a virus/hack via a post?

link|improve this answer
2  
You were probably running an old copy of wordpress, or using some insecure scripts. Its really a good idea to keep that stuff up to date. – Ryan Gooler Sep 30 '10 at 1:02
feedback
up vote 0 down vote

...any solution yet how they gained access? I've got joomla too - they uploaded php/pearl files to my temp or images folder...

php version 5.2.14

Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a

no idea how those digheads came on my server

link|improve this answer
1  
As for "why", three words: Automated vulnerability scanners. The attackers usually don't care what your site is, they only care that they can convert it for their evil plans. – Piskvor Oct 29 '10 at 9:41
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.