Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My website was taken down a day back - got a message form the host saying that they recieved a complaint from the Bank of America that my website was being used for phishing customers. I managed to bring my site online and found a number of weird code snippets and files on the site that I didn't put there. They were definitely put by a hacker but now I'm scared with regards to how did the hacker get into my site and put his files there.

What can I do to prevent something like this happening again!?!?!?

share|improve this question

migrated from stackoverflow.com Sep 10 '09 at 19:51

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 6 down vote accepted

If the hacker has managed to upload code to run, he probably has comprimised the server rather than the app. (this is just an initial hunch - he could have comprimised your server because of your app...)

Some basic pointers and things to do:

First off, change your passwords - All of them - Control panel, ftp users etc. Pick strong passwords that will be less vulnerable to dictionary / rainbow attacks. (use non alpha numeric characters, upper & lower case etc)

Check that no other users have been set up on the domain - if they have remove them immediately.

Pull all your code from the site and restore it from a fresh backup that you know is safe. Redeploy from your private source control if possible.

Ask your host to check that all security patches and updates have been deployed to your server.

Finally - time for a code review - need to check for SQL injections, XSS attacks, XSRF Attacks.

share|improve this answer
    
Additionally, don't use FTP on public, or unsecured wireless networks. Credentials sent via FTP are sent in plain text. If you can, use SFTP (ftp over ssh). –  Cypher Sep 20 '10 at 5:27

If you use phpBB or Joomla or something like that, you always must have the latest version installed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.