davidjamesca
Forum Replies Created
-
Forum: Fixing WordPress
In reply to: Have I been hacked? Username: “amin”Hi w8lifter2000,
In this specific case, the attacker modified footer.php inside the wordpress themes directory to add a hidden iframe. The attack was cloaked using base64_decode and only showed up in the HTML the first time a visitor was on the site.
The attacker also added a C99 shell to the website, also cloaked using base64_decode. The C99 shell was added both to the root directory of the website and to the wordpress directory.
In the database, the attacker edited the most recent post on the website to add a hidden script include. It referenced http://zlu.emapis.org/js/jquery.min.js, which interestingly returns different content depending on the number of times you have loaded the page. The first time you load the javascript from a particular IP address, it returns the suspected malware script content; after the first load, it then returns an innocuous script. I saved the suspected malware version of the script at http://pastebin.ca/1882657 for further analysis in case anyone wants to take a closer look at the attack code.
Forum: Fixing WordPress
In reply to: Have I been hacked? Username: “amin”w8lifter, to answer your question, when I was looking at a Rackspace account that had been compromised, I spotted a few hacks beyond the creation of the amin user account:
1. The attacker installed malware into both the wordpress database and into the wordpress source code. This allowed the attacker to distribute malware to site visitors. Some of these attacks were trickily hidden.
2. The attacker created a C99 shell server. This helps the attacker launch further attacks on affected sites. (In this case, the server was named “l.php”, but note that they can name this file anything they want.)Forum: Fixing WordPress
In reply to: Have I been hacked? Username: “amin”Looks like Rackspace has upgraded their phpMyAdmin software to 2.11.10 now. Hopefully this will help!
If the attacker created backdoor accounts or installed trojan software onto the servers, he’ll still be able to cause trouble. Hopefully, Rackspace will watch for this and prevent further damage.
Forum: Fixing WordPress
In reply to: Have I been hacked? Username: “amin”Rackspace Cloud currently uses phpMyAdmin 2.11.3 [1], which has critical security holes [2]. Until Rackspace upgrades their version of phpMyAdmin, it’s likely that your sites will continue to get hacked.
[1] https://mysql.websitesettings.com/Documentation.html
[2] http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php