0

We are a hosting Company for customers and never had problems. Now, the second customer site was "hacked" in one week. Our passwords should be safe and we change them often, instead I think there were backdoors used. One site was an old Joomla! Version. (from 2010). We've shut that down, but now we've got an abuse mail from our provider, because another site was "hacked". This is a wordpress installation (pretty new version, maybe 2-3 months old. As far as I see there has a zipfile nca.zip been injected to the root folder, and that has been extracted somehow. All Wordpress files are still there.

Does anyone know how to prevent this?

  • 7
    How to prevent it? Get out of the hosting business. – EEAA Sep 19 '16 at 13:37
  • @EEAA What a qualitative answer from a moderator, beautiful. We're not really hosting, just providing webspaces for small local customers. So instead of being a d*ck, you could maybe give me a more helpul answer, thanks. – Scarwolf Sep 19 '16 at 13:41
  • 2
    It wasn't an answer. It was a comment. And it was honest. Hosting companies (which you are, even if small) have entire teams of people to deal with this sort of thing, and they shut down customers with reckless abandon when they're discovered to be compromised. Whenever you let customers run their own applications on your infrastructure, you will have to deal with this. – EEAA Sep 19 '16 at 13:43
  • Maybe it was a bit unclear. We're not letting them run their own applications, we are setting everything up by ourselves and provide them tools with restricted permissions. Maybe you got me wrong, it's not like we ignored every basic security rules but instead I was just wondering what one could use in order to check for joomla/wordpress backdoors etcetera. – Scarwolf Sep 19 '16 at 13:46
  • 4
    We're not letting them run their own applications, we are setting everything up by ourselves and provide them tools with restricted permissions. and One site was an old Joomla! Version. (from 2010). Then you f*ed up yourself... – Sven Sep 19 '16 at 13:51
7
  1. Keep your applications updated. This doesn't include just the core application itself, but every third-party plugin you use as well. Vulnerabilities are very frequently found and exploited in these third-party modules. You should quite literally be checking for updates and applying them every day.
  2. Join security-related mailing lists for the applications you're using.
  3. Put each customer in their own VM to minimize collateral damage in case one gets compromised.
  4. Install a IDS/IPS system on your network and/or web hosts. This can help detect and block odd or unexpected traffic on your hosts.
6

Do what the attackers are doing and scan you customers for common popular and often exploited packages that are out of date/unmaintained by the site owners. Take those off-line before they cause problems.

A better strategy might be to offer a hosted version of such products that your engineering team keeps up to date and current. That shifts the burden from your often not as tech-savvy customers to your staff, who, in theory should be better equipped to respond quickly to security alerts and upstream updates.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.