I am hosting a few websites for customers, and a bunch of them have been hacked today. The hack consists of a simple .htaccess file that redirects to adf.ly.
This is the second time I have been affected by this. What malware does this?
-
I could imagine an entire book about how to secure your servers from hacking.– Stephen Ostermiller ♦Commented Jan 14, 2015 at 16:03
-
A vulnerable WP site can gain access to other sites depending on the situation. Do not make any assumptions. Update all software. Run anti-virus on all your hard drives including rootkit. And clean any database you have and change all user passwords to strong passwords all-mass. Also, if you run FTP on any of these servers, move it to another server and use ACLs and make it strong. Do not run your own externally available DNS server especially on a web server.– closetnocCommented Jan 14, 2015 at 16:10
-
@StephenOstermiller Thanks a lot for reminding me why I usually stay away from Stackexchange sites.– madsmaoCommented Jan 14, 2015 at 16:33
-
@closetnoc Thanks for actually taking the time to provide me with something I can use– madsmaoCommented Jan 14, 2015 at 16:33
-
@StephenOstermiller is very right about how vast this question is, however, I suppose that a good catch-all (lack of a better term) answer(s) should exist if it does not. There are some standard things to do and some understandings that should be stated. If an answer does not exist, I would happy to help start one and others can chime in. That way, people can at least find a good starting point when they really need help.– closetnocCommented Jan 14, 2015 at 16:38
|
Show 11 more comments
1 Answer
I'm not aware of any specific identified malware that can be attributed to for this attack, however this kind of behaviour is not uncommon from malicious code inserted into third-party plugins for popular CMS's such as WordPress. People download and install these plugins for the advertised features they offer to sometimes later find that the plugins had been adapted from their original state, and malicious code inserted giving attackers the ability to take over your website. Since redirectly all your visitors to adf.ly generates a revenue stream for them it fuels the creation of more and more adapted or patched plug-ins.
How to avoid this?
Only download third party plugins from trusted websites, i.e. the official WordPress repository, or directly from the vendor's website for premium third party plugins.
Check through the source code of any third party plugins before you install them to ensure malicious code has not been inserted. To help, try searching for add_action, base64_decode, curl_exec, eval, gzinflate, mail, set_role, wp_create_user, wp_mail. Use of these does not necessarily mean malicious intent but could warrant closer inspection of the source code.
Regularly check your web server software and CMS software is kept patched up-to-date to ensure your website is protected from known vulnerabilities.
Suggested reading: Securi Blog - Unmasking Free Premium WordPress Plugins
-
1Very good advice. WP is the most hacked software period for a reason. It is not that WP is bad. In fact, it is quite the opposite. Because of it's popularity and the availability of so many plug-in and themes (let's not forget themes) that can all be vulnerable along with any changes to WP, it has become the #1 target. As a result, any WP site owner has to work that much harder to make sure their site is not vulnerable. One up-vote. BTW- I would am curious to hear how the OP is getting along on this. I would like to hear good news. Commented Jan 16, 2015 at 4:10
-
Been sick for a couple of days. Thanks a lot for all the input in this thread.– madsmaoCommented Jan 16, 2015 at 6:45
-
It was quite easy to fix the issue by simply removing the .htaccess files that redirected to adf.ly. However, I am still not any closer to figuring out where the hack came from in the first place. Ideally, I would look through all the WP sites on our server to look for clues, but that is such a time consuming process, and I have a hard time finding the time for that at the moment.– madsmaoCommented Jan 16, 2015 at 6:50
-
One of my tricks is to maintain a database table of genuine published and end-user intended page URLs for a website, and then I have an hourly cron script that analyses the last hour's worth of HTTP traffic in the access_log and error_log files often found in /var/logs/httpd/ (depends where you configure them to be in httpd.conf), ignoring any lines where the requested URLs have an entry in the database, and emailing me with the information available from the log entry for any unrecognised URLs, and a link in the email allows me to quickly whitelist the URL if appropriate. Commented Jan 16, 2015 at 13:57
-
Maldet antivirus software is very good and quick at picking up possible malware code on a website so a lot of hosting providers will run Maldet once a day across all their servers. Software developer and use any encryption or obfuscation to try and protect their source code from reverse engineering and human readability will often find their code gets quarantined by Maldet the day after installation, unless the hosting provider white-lists that particular folder or files affected. Installing Maldet may help prevent malware infections from spreading quickly on your server. Commented Jan 16, 2015 at 14:04