Hacked twice in one day, grrr
Discussion
Help! My site has been hacked twice in one day. Both times, it's from the same 'people', but the index.php page that has replaced mine has been different.
I'm a newbie to this what can I do to stop them taking over my index.php? The site it's coming from is sibersavascilar.com which I can't get onto anyway (username/password required). I think my php install is up to date, is there anything I can look at/do as I'm sure they'll be back? Nothing else gets changed except the index.php. I think it's an exploit rather than them knowing my username/password (which has been changed anyway).
I'm a newbie to this what can I do to stop them taking over my index.php? The site it's coming from is sibersavascilar.com which I can't get onto anyway (username/password required). I think my php install is up to date, is there anything I can look at/do as I'm sure they'll be back? Nothing else gets changed except the index.php. I think it's an exploit rather than them knowing my username/password (which has been changed anyway).
Are you using wordpress? There's a recently acknowledged flaw in it, and the stable versions of wordpress haven't got it sorted yet....
www.securityfocus.com/bid/21318/info
www.securityfocus.com/bid/21318/info
First of all do you have any idea how they gained access to your system? Because without knowing how they are exploiting your site/web server you will have bugger all chance of stopping them getting back in.
Is the site hosted by you? if not then report it to the hosting company
What defensive measures do you have?
Do you have or know anyone savy enough to help you?
Have you changed anything recently in the configuration that may of opened your site up to an exploit?
How long has the site been up? Do you patch your webserver at all?
Is the site hosted by you? if not then report it to the hosting company
What defensive measures do you have?
Do you have or know anyone savy enough to help you?
Have you changed anything recently in the configuration that may of opened your site up to an exploit?
How long has the site been up? Do you patch your webserver at all?
aranell said:
Are you using wordpress? There's a recently acknowledged flaw in it, and the stable versions of wordpress haven't got it sorted yet....
www.securityfocus.com/bid/21318/info
www.securityfocus.com/bid/21318/info
Erm, the link points that the flaw is in Wordpress 1.5 and fixed in 1.5.1.
Current Wordpress version is 2.0.5 with 2.1 being released shortly.
To the OP. What is your site running in terms of version numbers and software?
Thanks for the replies everyone.
Yes, I'm on a shared host.
Yes, that part of the site uses Wordpress.
What do you mean by defensive measures?
It depends what needs doing as to 'savvy'. I only know a little php but I can do some techie stuff.
Nothing has changed in the config recently.
The wordpress bit of the site has been up for about 3 months, and it's the latest stable version. Editted to say it's v2.0.5
Yes, I'm on a shared host.
Yes, that part of the site uses Wordpress.
What do you mean by defensive measures?
It depends what needs doing as to 'savvy'. I only know a little php but I can do some techie stuff.
Nothing has changed in the config recently.
The wordpress bit of the site has been up for about 3 months, and it's the latest stable version. Editted to say it's v2.0.5
Edited by mynameismud on Wednesday 13th December 19:22
Edited by mynameismud on Wednesday 13th December 19:23
Ok.
Talk to your vendor, was anyone else hacked as well?
What version of PHP?
What version of Apache?
What version of MySQL?
What other applications are you running (phpBB, phpmyadmin, awstats, etc, QMail,) and what versions?
The plug-ins for Wordpress are generally safe, they'll usually blow themselves up or knock Wordpress out of comission until deleted as opposed to opening up vulnerabilities.
Personally, I am happy to declare Wordpress as safe, I'm running 2.0.4 and whilst not generating major traffic (and having a .htaccess that kills most spammers) I've not had anything odd happen.
Talk to your vendor, was anyone else hacked as well?
What version of PHP?
What version of Apache?
What version of MySQL?
What other applications are you running (phpBB, phpmyadmin, awstats, etc, QMail,) and what versions?
The plug-ins for Wordpress are generally safe, they'll usually blow themselves up or knock Wordpress out of comission until deleted as opposed to opening up vulnerabilities.
Personally, I am happy to declare Wordpress as safe, I'm running 2.0.4 and whilst not generating major traffic (and having a .htaccess that kills most spammers) I've not had anything odd happen.
My website was recently hacked as well - almost certainly because I run a php based flash gallery package.
The problem with PHP is that a badly written application can allow a hacker to inject their own code into other files, thus taking over your index file. Any of the items you have listed here that use PHP could be to blame for this.
There were no documented issues with the gallery package I had, but it had to be the cause nonetheless since it's the only thing on my site!
I upgraded the gallery package to the latest version, and also renamed or removed any unwanted files and folders, all I can do now is cross my fingers it doesn't happen again.
The problem with PHP is that a badly written application can allow a hacker to inject their own code into other files, thus taking over your index file. Any of the items you have listed here that use PHP could be to blame for this.
There were no documented issues with the gallery package I had, but it had to be the cause nonetheless since it's the only thing on my site!
I upgraded the gallery package to the latest version, and also renamed or removed any unwanted files and folders, all I can do now is cross my fingers it doesn't happen again.
Unless they did you any kind of financial damage beyond defacing your page and wasting a bit of your time, I wouldn't hold out too much hope of prosecuting them - and even then only if they are in the same country as you.
Best bet is find the IP they connected from and report them to their ISP as having hacked you, this might then get them disconnected...
Best bet is find the IP they connected from and report them to their ISP as having hacked you, this might then get them disconnected...
I'm glad you are making progress with this problem.
If the hacker is worth anything he will have protected his IP with proxies etc. If he hasn't and is in the UK it will still take a court order to find his identity or if he is in another country you would have to find their legal standing with obtaining his details through the ISP.
IMHO its all pretty pointless trying to get some retribution unless the hacker has caused serious damage or stolen data.
Did he post it on Zone-H by any chance? This place seems to be a favoured place for defacements to be posted.
Learn from it and move on, these little toe-rags will always be a problem.
You may want to take a look at this: www.met.police.uk/computercrime/
If the hacker is worth anything he will have protected his IP with proxies etc. If he hasn't and is in the UK it will still take a court order to find his identity or if he is in another country you would have to find their legal standing with obtaining his details through the ISP.
IMHO its all pretty pointless trying to get some retribution unless the hacker has caused serious damage or stolen data.
Did he post it on Zone-H by any chance? This place seems to be a favoured place for defacements to be posted.
Learn from it and move on, these little toe-rags will always be a problem.
You may want to take a look at this: www.met.police.uk/computercrime/
Edited by __LEE__ on Wednesday 13th December 22:08
__LEE__ said:
Learn from it and move on, these little toe-rags will always be a problem.
Indeed. The irksome thing is, it's probably a 13 year old with far to much time on his hands running one or more 'attack-bots' the amount of skill required is often zero as they're point n' shoot affairs.
GRS? GCR? Ohh... god forgotten the guys site, did a dissection on a reasonably privative DDoS bot a while back and traced it back to the 13yr old and then managed to find the person who originally wrote it.
ThePassenger said:
__LEE__ said:
Learn from it and move on, these little toe-rags will always be a problem.
GRS? GCR? Ohh... god forgotten the guys site, did a dissection on a reasonably privative DDoS bot a while back and traced it back to the 13yr old and then managed to find the person who originally wrote it.
Thats impressive.
DDOS's are incredibly common these days due to many bot nets aren't they? There are also a number of shared bot nets which seem to be getting more and more common.
Did you threaten to knee-cap the 13 year old to find the writer of the bot and then go around his house and introduce him to mr baseball bat? Seems the banks like to take this approach since the law is a complete waste of time for these attacks.
__LEE__ said:
Did you threaten to knee-cap the 13 year old to find the writer of the bot and then go around his house and introduce him to mr baseball bat? Seems the banks like to take this approach since the law is a complete waste of time for these attacks.
www.grc.com/dos/drdos.htm is the guy's site. Steve Gibson, the bloke who does ShieldsUP! and SpinRite.
I think he went to the FBI and they went to talk to the 13yr old, it wasn't until he was poking around that he found the original bot and went from there; at least that's what I remember.
Either way it's a good read.
I agree, legally speaking the law is incapable of doing anything other than giving a warm fuzzy feeling. You're often attacked from multiple countries and continents at once, different ISP's and law enforcement agencies to contact who may or may not be willing to chase down someone and may or may not understand the evidence your presenting them. Hell in some countries DDoSing is legal (or at least not specifically illegal).
Alas if you're running an exploitable version of an open source product you will invariably continue to be exploited until such time as your remove / upgrade / fix the exploitable product.
The benefit of you having a VDS is that your hacking will only affect your site, and likewise, anyone else's VDS that's hacked will only affect their site..
For now, I'd simply suggest you upgrade your Wordpress and Forums and, where possible, lock down access to the aforementioned with HTAccess / passworded access.
By all means re-raise a support ticket if you have any further queries.
J
The benefit of you having a VDS is that your hacking will only affect your site, and likewise, anyone else's VDS that's hacked will only affect their site..
For now, I'd simply suggest you upgrade your Wordpress and Forums and, where possible, lock down access to the aforementioned with HTAccess / passworded access.
By all means re-raise a support ticket if you have any further queries.
J
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff