1

I am glad that Google Search Console informed me via email that there was a new owner a subdomain in my website at: http://ftp.example.com

enter image description here

This domain is now currently hacked, so don't visit it. The hacker uploaded a website to sell game items. My setup:

  • I bought the domain via GoDaddy, my GoDaddy account has 2-step authentication, so I don't think he got access to it via GoDaddy
  • The website at https://example.com just simply links to the Jekyll Github website at: https://github.com/example/example.github.io, this is a simple static Jekyll template website, I don't think that there is any SQL Injections possible.
  • I don't remember if I ever configured the ftp sub-domain in my website, it was a while since I last updated my website due to inactivity in our club during the Corona period.

Here you can find a screenshot of the hacked website: enter image description here

So far, what I did, I entered to my GoDaddy DNS settings and delete the ftp CNAME, but I wondered what else can I do, and to know exactly how this can happen, and prevent further events from happening. Thank you so much in advance.

2 Answers 2

2

Here are a few things to check to get you started:

  1. Ensure your Google, GitHub, GoDaddy and Hosting accounts all have 2-factor authentication enabled.
  2. Review your DNS settings so that all IPs point to the correct server.
  3. Rotate all your passwords and close all remote sessions.
  4. Scan your server for any alterations, backdoors or rootkits.
  5. Review your server logs to try to understand how they got access.
  6. Update/upgrade all your servers' programs to their latest version.
  7. Run scans against your infrastructure to determine if you have any weak spots.
  8. Review and configure some server hardening procedures.
1

I am in the same situation, I used Jekyll SEO plugin, at least I left some Javascript files and someone registered my site with ftp subdomain. I think they either find a way to fake the existence of any uploaded file, and then they can verify the ownership of the domain, or a lot of Godaddy passwords are leaked. I also had ftp. registered in Godaddy and I cannot recall if I did it at all. Of course at Godaddy the domain audit is an extra fee what I didn't ask in the past, so I cannot see if that was me or someone else.

Currently I use this Gemfile, I know they are a bit outdated.

gem "github-pages", "= 228"

gem "jekyll-include-cache", "= 0.2.1"
gem "jekyll-octicons", "~> 14.2"

Also, I noticed that my github pages are not verified, which is weird since I do remember that I set the TXT record. Maybe when github renamed master to main around 2023, those records are removed.

See https://medium.com/@jehy/hijacking-domain-using-github-pages-41c80ac57523

Edited. Later I deleted the ftp CNAME then I registered the http://ftp. in the search console and remove the intruder.

Another of this topic. https://news.ycombinator.com/item?id=19566075

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.