UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual people that read and helped (instead of trying to enforce seemingly arbitrary "rules" for what should or should not be posted here).
UPDATE: Despite this being tagged as a duplicate, this question is trying to figure out HOW a site could have been compromised in this situation, NOT asking a generic question about how to secure a server.
I was recently alerted by Dreamhost that a few of my websites directories had been compromised with 3 letter php files written into them. Decoding them, I have discovered that they are files that send out spam when executed. When I started looking into the problem, I noticed some very strange things that make me question how I could have been hacked if the server itself (shared space with who knows how many other websites) was not hacked at the root level.
Here are some of the details and oddities:
- Only six directories out of more than 50 had these files written into them.
- 4 of the directories contain WordPress, but only 3 of those are even being served at the moment.
- None of the directories had openly writable permissions (777) on anything in them
- All the files were written into the top level of each website directory, nothing lower down that I can find.
So I am let wondering how this could have happened and with the following questions:
What are the possible vectors for attack here? Since some of the directories were not even web accessible, it seems unlikely that web access was the vector. Since some contain static files, it seems unlikely that this is related to one of the recent WordPress vulnerabilities.
Is it possible or likely that there has been a root server level hack on the Dreamhost server, giving the attacker access to all directories and accounts?
I suppose it is possible my shell account password was hacked, but if so, why would only 6 of the directories be written into? (and in random order as far as I can tell, there are many other directories in the alphabet between them and they are not in order of date modified or created either). In any event, I have changed my shell password just in case.
I am not a system admin, much more of a web designer and developer, but I would like to figure out how this could have happened so that I can better protect against this type of attack in the future. Thanks for any advice!