0

We are a hosting Company for customers and never had problems. Now, the second customer site was "hacked" in one week. Our passwords should be safe and we change them often, instead I think there were backdoors used. One site was an old Joomla! Version. (from 2010). We've shut that down, but now we've got an abuse mail from our provider, because another site was "hacked". This is a wordpress installation (pretty new version, maybe 2-3 months old. As far as I see there has a zipfile nca.zip been injected to the root folder, and that has been extracted somehow. All Wordpress files are still there.

Does anyone know how to prevent this?

Improve this question
7
  • 7
    How to prevent it? Get out of the hosting business.
    – EEAA
    Sep 19, 2016 at 13:37
  • @EEAA What a qualitative answer from a moderator, beautiful. We're not really hosting, just providing webspaces for small local customers. So instead of being a d*ck, you could maybe give me a more helpul answer, thanks.
    – xTheWolf
    Sep 19, 2016 at 13:41
  • 2
    It wasn't an answer. It was a comment. And it was honest. Hosting companies (which you are, even if small) have entire teams of people to deal with this sort of thing, and they shut down customers with reckless abandon when they're discovered to be compromised. Whenever you let customers run their own applications on your infrastructure, you will have to deal with this.
    – EEAA
    Sep 19, 2016 at 13:43
  • Maybe it was a bit unclear. We're not letting them run their own applications, we are setting everything up by ourselves and provide them tools with restricted permissions. Maybe you got me wrong, it's not like we ignored every basic security rules but instead I was just wondering what one could use in order to check for joomla/wordpress backdoors etcetera.
    – xTheWolf
    Sep 19, 2016 at 13:46
  • 4
    We're not letting them run their own applications, we are setting everything up by ourselves and provide them tools with restricted permissions. and One site was an old Joomla! Version. (from 2010). Then you f*ed up yourself...
    – Sven
    Sep 19, 2016 at 13:51

2 Answers 2

Reset to default
7
  1. Keep your applications updated. This doesn't include just the core application itself, but every third-party plugin you use as well. Vulnerabilities are very frequently found and exploited in these third-party modules. You should quite literally be checking for updates and applying them every day.
  2. Join security-related mailing lists for the applications you're using.
  3. Put each customer in their own VM to minimize collateral damage in case one gets compromised.
  4. Install a IDS/IPS system on your network and/or web hosts. This can help detect and block odd or unexpected traffic on your hosts.
Improve this answer
6

Do what the attackers are doing and scan you customers for common popular and often exploited packages that are out of date/unmaintained by the site owners. Take those off-line before they cause problems.

A better strategy might be to offer a hosted version of such products that your engineering team keeps up to date and current. That shifts the burden from your often not as tech-savvy customers to your staff, who, in theory should be better equipped to respond quickly to security alerts and upstream updates.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .