Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story -
I was using an older version of wordpress and probably this person caught me from google. I think it was a script attack. Its difficult to say how and when the security was actually compromised, it came to my notice on Nov 5, 2009. While I took some safety measures at that time (described below) but there's always a possibility that I missed out rechanging wordpress passwords when I formatted my work computer.
Now I've deleted all unrequired php scripts from hosting, made administration part accessible only to my IP, blocked a particular IP range that belongs to vietnam. Daily backups and other stuff. The thing is that there are so many variables involved and its too difficult to keep track of each and everything. Main lesson is be prepared for it. :)
I'm on a shared hosting plan by GoDaddy and run a WordPress website. My website was hacked for the first time on Nov 5, 2009. At that time, the hacker replaced my ads with his own. I thought it happened because of my laziness with security, but I was so wrong.
I formatted my computer and setup everything again. Replaced ESET NOD32 with Microsoft Security Essentials. Upgraded to the latest version of WordPress. Changed all passwords. Setup a new database. And other security related stuff I read here and there. Things worked well for a while until my site was hacked again today.
Last time, the guy played with a lot of files and specifically changed footer.php and all ads related files. But this time he just went to the right place and replaced with following code -
Looks like that person isn't interested in manipulating database etc. but just place code and make quick money. Godaddy forwarded my ftp logs and there was an unauthorized access from IP - 220.127.116.11. This IP belongs to Vietnam and also http://blackberryrss.com has some connection to Vietnam.
There is no SSH access to my account and I connect to FTP using FireFTP. This was GoDaddy's response last time -
Upon reviewing your account we have found your FTP account has been compromised either due to malware on your local computer or a weak FTP/Hosting password.
But I had changed all passwords, deleted accounts etc. but nothing seems to work. I'm clueless at the moment. Please tell me what to do? How can I prevent unauthorized access to my account??????
- Strength of password is just Strong but not Best.
- I personally use Windows XP SP3, Windows Firewall etc. After first attack I've learned to work using a user account and avoid administrator account.
- When I see FTP logs for the first attack, its quite clear that person is manually doing all of this.