WordPress.org

Ready to get started?Download WordPress

Forums

Website hacked. Please help. (8 posts)

  1. asandler
    Member
    Posted 5 years ago #

    I have a website, alexonlinux.com. It appears that it has been hacked. I found it looking at "What Googlebot sees" in Google Webmaster Tool. My website got associated with porn keywords. All keywords point to single post. The post obviously has nothing to do with porn. It appears intact, as if nothing had happened to it. Comments are also cool. But, searching google for "site:alexonlinux.com <keywords>" finds the post.

    The post is here: http://www.alexonlinux.com/multithreaded-simple-data-type-access-and-atomic-variables
    The keywords are for instance "любительские секс видеоролики" - its in Russian, although my website is in English.

    I already had this problem before (pointing to the same post). Last time however, I found the keywords in spam comments. I removed all spam comments and asked google to reconsider. This solved the problem for a while, but now it seems to be back.

    I am using WordPress 2.7.1. With latest versions of all plugins. Despite that I think I've found a couple of things that can be a problem - my blog was Apache writable and I didn't have a secret key. However, fixing this, changing passwords, etc. will only prevent future hacks. I still didn't find the hack they used.

    I really don't know what to do next. If you have any ideas and can help, please do so.
    Thanks.

  2. whooami
    Member
    Posted 5 years ago #

    Here's *my* standard reply:

    fix advice:
    http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/
    http://wordpress.org/search/hacked?forums=1

    Make sure that your files on the server are clean. If that means deleting and reuploading, than you ought to do that. Files that you dont replace, should be looked at closely.

    Check for files that dont belong, directories that dont belong. Image files with changed timestamps -- look at those. Its VERY common for there to be scripts on sites that are named in such a way to mask the fact that theyre scripts.

    Be suspicious, when youre looking at things.

    Look at your permissions. Do you have world writable files? Any world-writable directories? Are they necessary?

    You need to check your database. Look for rogue plugins being loaded, look for rogue users (specifically look for a user named wordpress). You will NOT see rogue plugins or rogue users in your wp-admin/ area. You need to check your database.

    Make sure ALL of your plugins are current.

    Make sure your wordpress is current.

    Change your mysql password that wordpress uses (update your wp-config.php with that new password). Especiallly important in cases where you see changes to your mysql database.

    Change any admin level passwords on your blog.

    Look at any other software thats being used on your site. Is it current?

    That's just an outline and not a complete list.

    There's quite a bit to do, but it's all necessary.

    If you cant do it all -- by all means dont hesitate to enlist the help of someone who can. Quite a few of us do work on the side.

    Then there's this:

    http://codex.wordpress.org/Hardening_WordPress

    At the very bottom of that page, my own plugin is mentioned. I recommend setting it up, and leaving it up, for a week after the site has been secured, and keeping a close eye on the resultant logfile.

  3. whooami
    Member
    Posted 5 years ago #

    i have to ask tho, after looking at that page as me and as "googlebot" - have you read this:

    http://74.125.95.132/search?q=cache:bOH5b2LM4MMJ:www.alexonlinux.com/multithreaded-simple-data-type-access-and-atomic-variables+%D0%BB%D1%8E%D0%B1%D0%B8%D1%82%D0%B5%D0%BB%D1%8C%D1%81%D0%BA%D0%B8%D0%B5+%D1%81%D0%B5%D0%BA%D1%81+%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE%D1%80%D0%BE%D0%BB%D0%B8%D0%BA%D0%B8+site:alexonlinux.com&cd=1&hl=en&ct=clnk&gl=us

    Specifically, this:

    These terms only appear in links pointing to this page: любительские секс видеоролики

    Perhaps this is a result of the earlier comment that you mentioned? As that is pretty spammy in English.

    Im not discounting what you are saying about being hacked -- just trying to find better evidence of it.

  4. Here's *my* standard reply

    Ought to sticky verbiage like that, it really is boiler plate.

  5. bigfeeder
    Member
    Posted 5 years ago #

    Hi all --

    I've just joined to ask the EXACT same question!

    My websites have been hacked -- but unlike asandler, hackers have left backdoors in my php files to get access again.

    It looks like i'll need to reinstall my blogs - as i could never check every php file.

    I could really do with some advice.

    I'm planning on deleting everything on my server.

    *** Reinstalling wordpress
    *** Downloading my theme again - and reinstalling plugins (including press forum)

    But how would i then get it working again with the old database?

    Would the random phrase not work as it wouldnt be the same?

    Sorry if the question sounds stupid, i've never done this before. I just don't trust myself to check every php/js file. As i could miss somthing.

    (p.s - is there any way a jpg/gif file could have been changed that was used in my theme to let a hacker back in?)

    Regards,

  6. I'm planning on deleting everything on my server.

    But how would i then get it working again with the old database?

    I'll say it three times. Backup, backup, backup before you start this work.

    http://codex.wordpress.org/Backing_Up_Your_Database
    http://codex.wordpress.org/WordPress_Backups

    If you can zap your files and start from scratch, and your database is all good, then you should be fine.

    But if you really make a mistake or "the bad thing" happens, you can put your files and database back the way it was before you worked on it.

    As to what to do, scroll up and read the above, it's really the best course of action. It's a lot of work but you have to perform some clean up.

  7. whooami
    Member
    Posted 5 years ago #

    @bigfeeder,

    (p.s - is there any way a jpg/gif file could have been changed that was used in my theme to let a hacker back in?)

    yes. and its VERY common for backdoor scripts (php root shells) to be named as image files, ie flower.jpg

    you can check that that hasnt been done, relatively easily though.

    as for the rest of your post .. shitcan everything, reinstall, import JUST the tables that have post stuff and comment stuff in them. Dont import the options table the users, or the usermeta table.

    Then do the plugins...

  8. asandler
    Member
    Posted 5 years ago #

    @whooami: Thanks for the reply. Actually I already saw your standard reply here on forum and done 99% of what you suggested to do. But still, I could not find a backdoor.

    I didn't see the cached version of the post before, so the "These terms only appear in links pointing to this page" thing is new to me. Does this mean that my web-site is actually ok and some porn site or hacked blog pointing to my web-site?

    Now I am totally confused. The keywords appear in "external links to your site", in Google webmasters tool->Statistics->What googlebot sees. This backs your findings about cached version of the post. But in any case, does it harm my web-site? Is there anything I can do about it?

    One good thing came out of this already. I turned the web-site upside down securing everything I could reach :-)

Topic Closed

This topic has been closed to new replies.

About this Topic

Tags