5

I host multiple domains with this very popular hosting provider and I just went into one of my sites and … I see a black page with the message "Hacked by...". I checked and all my sites with the provider are showing this same page.

Inside of the file system I have seen the hacker placed all default.* and index.* files with this message. So the hacker overwrote all index pages, placed new pages and that is under every, I say again, every folder. Cleaning this up will be close to a most horrible job.

(Right now I am awaiting the restore of files from hosting provider.) What to do? How to prevent this? Whom to blame?

|improve this question
8

What to do (right now I am awaiting the restore of files from hosting provider)?

  • Fix the holes that caused you to get hacked in the first place. If it was a result of the web host's neglect then find a new host.

  • Keep backups of your site so you don't depend on your host for this.

How to prevent this?

  • If you write your own code you need to write it securely and keep up on the latest web security news

  • If you use third party software you need to keep up with their releases especially if they include security fixes.

  • Make sure your host keeps up with the server's software patches.

Whom to blame?

  • If it was your code that was exploited, blame yourself.

  • If it was the hosting company's server that was hacked, blame them.

  • If it was a third party's software that was exploited, blame yourself (it's up to you to keep it updated).

|improve this answer
  • Thank you but your response is very generic. Perhaps my questions is too. Check how many sites were affected google.com/search?q=Hacked+by+DR-MTMRD – Vad Nov 22 '11 at 21:26
  • 2
    If you were looking for something more specific edit your question so we all can update our answers accordingly. – John Conde♦ Nov 22 '11 at 22:01
4

To answer your question about "how somebody can write new files into my hosts" there are three ways I've seen this happen.

First, FTP account hijacking. The worst case I had to deal with on my sites is when a hacker gained access to either a root level or high level account that allowed them to overwrite the index pages of all of the sites on that shared host server. Brute force attacks, botnets and other such techniques are how they pull this off. Once they're in they can do whatever they want.

The second, which is also FTP related, is leaving a public anonymous FTP area open with full privileges. This allows the hacker to upload a script and execute it. The script could then copy files or perform other kinds of mischief. Typically they'll delete the files after the run so you won't see the evidence. Some hosts are bad about not locking down anonymous FTP access so always check for yourself.

The last I've had to deal with is SQL injection on WordPress sites. In this case, the hacker uses injection to gain access to the WordPress admin panel and then replaces the active theme with their hacked version. There are various things you can do to lock down WordPress installs better than they are by default. Look around and find one that fits well with your needs.

|improve this answer
  • another one, if your site has any file upload functionality, hackers could use them to replace your scripts with their own and execute the script by visiting the related page. Make sure to validate the filenames of the uploaded files (so it doesn't contain stuff like '../', etc) and never give execute permission to uploaded files. – Lie Ryan Nov 23 '11 at 9:11
0

John Conde's answer is an excellent one and should be accepted as the correct one, but I wanted to address something you mentioned in your post that maybe deserves more than a comment.

To ease the cleaning up you can run commands in linux that will delete just certain filenames and types. (You can run rm with parameters, for example)

I don't want to post a code snippet here because each server is setup slightly differently and I don't want to bugger up your sites even more, but your hosts should be able to do this very quickly.

|improve this answer
  • Thank you, I may end of doing that depending on what provider does. However, I do not understand how somebody can write new files into my hosts. Script injection? Don't providers take care of it? – Vad Nov 22 '11 at 21:31
  • @Vad if you have PHP hosting then chances are you are able to write files to the server. If you have a security hole that allows the attacker to run arbitrary PHP they can probably change the permissions on many files and overwrite them. – DisgruntledGoat Nov 23 '11 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.