5

Because of the identity of the website, I don't want to give too much identifying information about the actual organization, but I can try to provide as much server background information as possible.

I am managing a Word press site and all seemed to be going well until this past August when the site first got hacked. Because of the quantity of compromised files, it appeared that there was some sort of vulnerability that allowed a robot to mass inject code into all of the php files. Before each opening <php? tag, there was a block of encrypted code that I have shown here.

The above link shows the tidied up php code, depicting the workflow of the script. If I further attempt to decode the strings, it becomes more legible, but it seems very difficult to discern exactly what it does.

Here is a bit decoded with unphp's "Eval + gzinflate + Base64" tool and here is a but decoded with unphp's "Recursive De-Obfuscating" tool that seems to be an html advertisement for someone else's website.

The contents, though, is relatively unimportant. After this initial hack, I restored from a back up on github and made sure the site was clean of any script. I also made a new user with a new password and changed the domain's root file to this new user.

I thought this solved the problem, but the website has been hacked in a very similar fashion 2 more times. Each time I've resorted a back up from Github and made sure the directory was clean.

At first I thought maybe the hacks correlated with Word press updates and they were Wordpress vulnerabilities, so I made sure I kept the site up to date in terms of Plugin and Wordpress updates. In the end, that is seeming like it wasn't the problem.

OS: Debian 3.1.9

Hosting Provider: Dreamhost

It is also worth noting that I inherited administration of the site from someone, so there is a lot of legacy code that is kind of sloppy.

tl;dr My question is how can I diagnose this? What steps can I take to find the source of the vulnerability? I am really at a loss right now and really frustrated that this keeps happening.

Thank you for any advice or support you can offer, I am desperate at this point.

UPDATE:

In the time since this post, I attempted a restore. About two hours afterwards the site was compromised in the same way. The differences this time around are that I had secured all file permissions and deleted a suspicious user from the wp_user table. Clearly, neither of those things seemed to help.

  • 3
    The solution to so many problems: upgrade. Fast! – William Edwards Oct 9 '14 at 6:06
  • 1
    Pretty sure Dreamhost has migrated all of the shared servers off Debian and onto Ubuntu at this point. Are you running a VPS or Private server? If so, those tend to lag behind in terms of patches and upgrades but hollering at DH support can work wonders... – JCL1178 Oct 9 '14 at 19:51
  • @JCL1178 I've tried to deal with dream host support before, it was an absolute nightmare. They offered very vague support even though they had access to the site and could have easily determined the source of the problem. – Wold Oct 9 '14 at 20:03
  • That's not been my experience. I have a dedicated server with DH and I've always had above-average response and assistance when I've contacted them. – JCL1178 Oct 9 '14 at 20:18
2

Several things to check/consider when self-hosting WordPress:

  1. Are your plugins safe? Did you get them from the wordpress.org repository or elsewhere? If elsewhere are these known-good developers (e.g. Gravity Forms) or something off Envato/Themeforest?
  2. Same questions about your theme. Where did it come from? Has it been checked thoroughly for security problems with the Theme Check plugin and other tools?

The two questions cover the majority of WordPress-generated security problems. It's almost always a poorly coded plugin or theme (or sometimes one with a deliberate backdoor) that is the vector for the attack. Aside from not just installing any random theme and plugin and really researching everything else, I strongly recommend installing BruteProtect (soon to be bundled with Jetpack) and WordFence. Both are free and will help keep you protected. If you are willing/able to spend money, a subscription to Sucuri (especially their firewall product) or StopTheHacker will go even further in preventing drive-by style attacks.

As the other answers indicate, it could also be poor server security that gets you. If the attacker can compromise a shell user, all sorts of nastiness ensues and WordPress, by virtue of its popularity, becomes the target for script-based attacks because you are virtually guaranteed to get the most effect out of a script targeting WordPress. If your server gets nailed over and over again, perhaps it is time to consider a switch in hosting? The dedicated WordPress hosts (including Dreamhost's own offering, WP Engine, Rackspace, Page.ly, Synthesis) will handle security for you in return for an increased monthly fee and for some people, that's really the best option.

  • My theme is custom-designed, so it is certainly possible that there are security loopholes. The only thing is that the site has been running with that theme for the past two years without ever being hacked. Anyway, could you link to the specific Theme Checker plugin you are talking about? – Wold Oct 9 '14 at 20:08
  • @Wold Sure, should have done that initially. Answer is edited. – JCL1178 Oct 9 '14 at 20:15
  • Rolling your own theme is usually pretty secure (unless you do something you shouldn't) because you are doing less than what off-the-shelf themes are doing. When you roll your own, you tend to only include as much functionality as you need to get the job done. An off-the-shelf theme has to bundle more features in order to be a one-size-fits-all solution and that can be where the problems start. – JCL1178 Oct 9 '14 at 20:17
  • the problem with these wordpress security plugins is that I am having difficulty using them when I can't access wp-admin whatsoever. Would Sucuri be able to scan the site and investigate into the wordpress files? – Wold Oct 9 '14 at 20:30
  • 1
    You can use them in conjunction, the warning from BruteProtect means that if you are using WordFence to block brute force logins, BP's database of attacking IPs isn't getting updated. So you can either disable WF's brute force protection and let BP handle that or just do nothing and rely on other users to submit updated attacking data to BP. Personally, I use WF to monitor for file changes and leave all brute force monitoring/prevention to BP so they get the data they need. But there's nothing wrong with doing it the other way. – JCL1178 Oct 13 '14 at 18:25
3

Honestly, there may be a true virus on your site. These exist solely to hack Wordpress websites and no amount of re-installing and re-deploying will stop it short of a complete anti-virus scan including rootkit and possibly wiping the hard drive and starting over if necessary.

As well, make sure that ALL of your software is fully up to date especially Wordpress. Wordpress is the single most hacked software there is. None come close. Also, make sure that all unnecessary services are stopped and there are no open ports except the ones you intend. FTP and DNS are particularly dangerous because of reflection attacks. This does not mean that you cannot use them, just make sure you have them in "jail" if possible and up to date.

  • I'm thinking I might migrate to a new server and start with fresh installs of basically everything. It might be possible I keep restoring the hacked code from my backup because its inconspicuously placed somewhere, but that seems unlikely. Is there any alternative to migrating, because that would be my last resort. – Wold Oct 9 '14 at 16:45
  • I do not know WP. I just know that there is a virus specific to WP that gets in via a route outside of WP and operates outside of WP. There are some good answers below regarding specifics. I would check these out and see if anything exists. If your host installed WP, it is possible that their install is vulnerable. I would not be surprised by this. See if any of the advice below gives a clue before you perpetuate any issue. It seems like these guys know specifics that may help. – closetnoc Oct 9 '14 at 16:54
3

There is a good chance the problem has nothing to do with a user/login, but with the permissions set to the files. If one php-file has too many rights, and they know how to abuse it, you've got a breach like you've described.

In normal settings, directories should be 0755 and files 0644.
Directories which have changable content (need to put files in it) 0777 and files 0666.

Also, make sure all files have the proper owners (eg: NEVER root).

Some (maybe) handy commands for the commandline/shell:

find -type d -exec chmod a+x -R {} \; // set dirs +excecute
find -type f -exec chmod a-x -R {} \; // set files -excecute (only dirs are exce.)
find -type f -exec chmod a-w -R {} \; // set files -writable/changeble
chmod a+rw -R ./somedir // will set all files and dirs (read- and) writable
chown username.username -R ./somedir // will set ALL owners to username

Also, there are various tools and sites describing how you lock up you WP-site, which files are vulnerable, etc. I'm not a WPer myself, but we host some WP sites.

  • I have little experience with the linux command line, what series of commands would I need to run in order to secure all of the permissions? – Wold Oct 9 '14 at 17:15
  • 2
    Would be a bit much to fit in this comment, I suggest some research. There are sites explaining this more clearly than I could :) – Martijn Oct 10 '14 at 7:24
  • Good to know: You mentioned that the files have changed. This means they're writable (0666). Removing the writing priviliges will make them 0644 and then they're no longer changeble by code (ftp still works the same). – Martijn Oct 10 '14 at 7:26
2

I've had WordPress sites on Dreamhost get hacked as well. I was using their shared hosting package, and I'm assuming you are as well. The hackers got in by compromising another user on the server, then reading my wp-config.php (which had 0644 permissions, so world-readable), accessing the database and creating their own admin user in the wp_users table. Once they're an admin, it's a lot easier for them to find a way to run PHP code as your user (installing plugins, writing to the theme files, etc).

Since Dreamhost runs under suEXEC/suPHP (as your user that you use for FTP), you can change the permissions on the wp-config.php to 0600 or 0640. I would also change the permissions on your home directory to disallow any user to list the contents of it, which is probably how they found it in the first place. So chmod 710 ~. You may notice Dreamhost has similar permissions on the /home directory since you can't do ls /home. The hackers can however do cat /etc/passwd to get a list of users to target, which is probably how they found yours. You should also check to see if there are SSH keys installed in ~/.ssh/authorized_keys (there was for me, which is how they got in a second time).

  • So I've found a suspicious row in wp_user, how do I go about deleting the user and removing their permissions securly? – Wold Oct 9 '14 at 17:11
  • 2
    Deleting the row from the database will remove the user. If you have a backup of the database, restoring from that would be a safer option (be careful not to delete any client data, and make a backup of the current database to be safe). You should also change you database password as well. – Matt Barry Oct 9 '14 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.