Hi canadianpolitics – how exactly was your site hacked?
My new WP blog has also been hacked with a giant red font:
hugorumens.com/blog
I only discovered this a few hours ago and I’m looking into
it now. Was this the same as happened to you?
I’ll post here if I find a solution.
– Hugo
Yep – that’s exactly what was on mine (also the start page of my website but that was easy to fix). I tried to upload a new index.php file but that didn’t work – but atleast i don’t have to look at that mess anymore.
Who’s your hosting company, btw? I’m with sitelutions.com. I’m just curious if more than one hosting company was hit. I’m going to be switching to a Canadian based hosting company, i think…
I personally recommend you get a new webhost. Or at least be put onto a server that wasn’t hacked. Once a hacker gets in, it really takes quite an effort to resecure the server with any confidence.
There are two main things you really want. First is the mysql database. Ask your host if they have a backup. Get them to send you a copy if they do. If they don’t, and you don’t, the written content of your posts is lost.
As well, anything that was in the wp-content dir is something you also need. It contains your theme (which could be reacquired, not essential), but will also likely contain any uploaded pics and such.
You can likely reinstall brand new wordpress files and restore from your database if you have the mysql, and replace your pictures files if you have those. Make sure there is nothing in there pretending to be a picture that isn’t one. A hacker type might leave behind something that shouldn’t be there.
Ideally, if you have an original on your drive, use that. If you don’t, try and recover from your existing files. But wherever you can’t replace with new stuff.
We are looking into new hosting but that doesn’t address the immediate problem. I’ve heard back from the company and they’re referring my case to the tech people to see if they can’t fix things at their end. I’ll see what happens with that.
I do have a backup of the database from a couple of months ago – from when i upgraded to the latest version of WordPress (not the update that was just announced a couple of weeks ago – the one before that). I have access to the mysql and stuff but i’m really not comfortable messing around with that stuff because i don’t understand it.
It’s appropriate for your host folks to have first crack at restoring your site. You can always refer them to this forum if they have their own wordpress specific questions, and perhaps offer to do some research for them.
I’m unsure about what you mean by your immediate needs? I was describing the things you need to get your site back up. There may not be a short cut around them. I would hate for you to leave a backdoor in place that a hacker comes easily come back in with again.
I would look for a web host that does nightly backups. It makes restoring much faster!
Yes, I am on sitelutions as well – I opened a support request with them and they are currently working on restoring the server (omega).
Even more worrying than the WP defacement is that various
files and directories from a different site hosted there appear to have been deleted.
I know about PHP and security issues but no idea how the hacker managed this at this point.
Hopefully it will be restored soon – as manstraw was saying though, it doesn’t exactly give you confidence.
– Hugo
[moderated – keep the political commentaries in your own blog!]
If you are interested canadianpolitics, I found this through google:
http://izumino.jp/Security/def.html#2006/07/21
some japanese site that lists recent hacks, my sites are there (search the page) – thanks to ‘A-S-T’ it seems.
Ta. My site’s there too – the Arab Security Team have been busy…
