My Website has been Hacked by Black Jaguar... Help?

migrated from stackoverflow.com Sep 10 '10 at 13:43

This question came from our site for professional and enthusiast programmers.

  • 14
    Unfortunately this situation is so common we now have a slogan for such questions: "Nuke it from orbit, and restore from backup; it's the only way to be sure" – Chris S Sep 10 '10 at 14:11
  • possible duplicate of My server's been hacked EMERGENCY – Tom O'Connor Apr 17 '12 at 14:50
up vote 43 down vote accepted

Take it down now and assume all data has been compromised. Restore from a known-good backup; if you have been storing sensitive/private data, assume the hacker also has them; respond accordingly.

If your site was hacked through a vulnerability in your code, you may want to close that before you put it back online - else it will get hacked again and again.

  • 1
    I wish I could upvote this twice. – keithwarren7 Sep 10 '10 at 13:43
  • 5
    @Keith - Now it's been migrated I think you literally can! – Martin Smith Sep 10 '10 at 13:45
  • 2
    Also, check the log files to find the hacker's point of entry (if you can) and fix it. – Chris Nava Sep 10 '10 at 14:22
  • 1
    looking at the automated script-kiddie like results from a quick google search of the hacker, i'd stick my neck out and say it'll be an automated SQL injection. did your site use sql at all, or any large sql based projects (which were out of date maybe?) ? – Sirex Sep 10 '10 at 14:26
  • 1
    Yea, id give them a heads up. They should be able to wipe the slate clean and give you a decent idea that the new platform is secure. you need to assume they gained root access to the system. was joomla, sqp server etc all up to date at the time ? – Sirex Sep 15 '10 at 7:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.