rossagrant
Forum Replies Created
-
It’s okay, I’ve found this. I must have accepted tracking, then turned it off.
Turning it back on in the main WP SEO dashboard sorted it out!
Thanks Brian, that’s super helpful and I have passed it on to my host.
I have now set the wp-config.php permissions to 600 and also moved them up one level to root, so hopefully they are well locked away now.
Will keep everyone posted here when I hear back from my host.
Thanks again!
Out of interest, I am on a kind of ‘shared’ dedicated server.
It’s a decent server but there are 12 of us on it, not hundreds like you usually get.
Would a VPS stop any of the cross site scripting?
I think I want my host to move me to a VPS as opposed to the current setup. Would that be even more secure?
Hey Brian,
My host also said this regarding sum link:
I have double checked that symlink if owner match is enabled and set to on in default Apache web server configuration, according to the recommendation in the post. Mind you this is a setting that was present before the WP database injection techniques were discovered, and is a configuration in cPanel present in the server administration WebHost Manager by default. As for the permission model, this server uses PhpSuExec meaning it can not serve PHP files having world writeable flag, or an error 500 is generated and script not executed. This forces a more sane permission model where users are discouraged into doing anything permission related since the web server already has write access by default permission levels, and open basedir protection restricting each PHP instance to its homedir is enforced too.
It’s a bit over my head, but does this cover what you have queried above?
I guess I can change my wp-config permissions to 600 no problem.
Let me know if that is all I need to do.
I have already updated passwords absolutely everywhere.
Thanks so much for your time.
Forum: Plugins
In reply to: [BuddyPress Album] Generated warningNice one Foxly, really appreciate you coming back to me on this.
I’ll wait for the next version to patch this then. I only see the error once every now and again!
Ross 🙂
Had some news back from my hosts who point towards the code being passed through comments perhaps in WP.
They mention:
“The WP issues are merely a modified operation of the WP alone, due to unclean processing of invalid requests facilitated by UTF sub-set usage and argument passing. These are not server problems contrary to the common belief expressed in WP blog discussion. The 403 pages were just a coincidence, and were the results of permission model issues outside web server operation completely.
I think the widget substitution and cross site scripting is a vulnerability in WordPress only, which is either facilitated by themes or comments related PHP functionality. It is well explained here:
https://en.wikipedia.org/wiki/UTF-7#Security
http://wordpress.stackexchange.com/questions/77108/if-a-hacker-changed-the-blog-charset-to-utf-7-does-that-make-wordpress-vulnerablBasically it is a way of passing malformed URLs to WordPress, which then does some unexpected unreasonable changes to its database storage as UTF7 escapes internal arguments filtering, and this allows a cross site scripting attack to be exposed on the web site front end that triggers browsers through JavaScript into including remote code.
It is by no means a server created problem, but a way of fooling WordPress into accepting invalid data that bypasses its internal sanitation. It should be enforced in HTML headers to use the correct encoding and it should be prevented by proper theme coding to not allow any PHP output before HTML has finished the header sections.”
Anyone got any examples of what should be present in a secure header in WP?
Kyunaga, search your DB for the entry widget_text in the wp_options table and remove the script that has been injected into it or drop it entirely.
That is where the script should be hiding.
Brilliant, keep us posted!
Who do you host with Yannik?
And are you saying that even your non-Wordpress sites got hacked too?
That’s brilliant Esmi and the best way to go for sure. Great stuff! 🙂
Yeah it’s wishful thinking Esmi I know! Haha!
I’m pretty convinced it’s the server 99%. It’s not just my host, I’ve seen 8 others reported over the weekend, but I have a feeling that me and Lubi host with the same host (possibly even on the exact same server).
Our host is currently digesting what has happened, and I will post the info here to conclude before this thread can be closed.
Once again thanks for your patience, it’s much appreciated.
Hey Lubi, I can tell from your response that the host you are with is the same as mine.
Does it begin with J and end in e by any chance.
So this looks certainly like it was a server issue, perhaps the entire hack.
Esmi, I got onto my host the second this happened and it was them that pointed towards WP scripting which is what started this whole debate on here.
I would still love the hacker to post how he did this, so we could know 100% the servers can be patched to prevent it happening again.
Thanks to everyone taking time out to post here, I know it isn’t normal forum protocol but we we had no other way to communicate and hate reading forum posts that don’t come to a conclusion.
I will post final info from my host here later so we can box this off and other WP users can let their hosts know if they come a cropper to this in the future.
As a quick update, I did an entire restore of DB, fresh install, changed all DB, FTP, SQL passwords and totally removed traces of this hack.
Site was fine all yesterday and this morning.
Just now my hosts entire server where my ite and 15 other VPS’s reside has been taken out and is only displaying 403 forbidden messages.
Not sure if it’s an update gone wrong or a result of this supposed server vulnerability hat led to this hack.
Anyone else experienced this?
This is becoming a bit childish now.
We didn’t come here to argue the toss, just to get some impartial advice.
Thanks for the collaboration from those other posters in the same boat.
If I discover any more, I’ll be in touch.
The FTP access log that I mentioned in my post shows all FTP connections on the day it happened. They are all from known IP addresses, so it’s not happened through FTP.
My site is on a VPS with security in place that should stop code injection from other sites sharing the same space.
I’m not blaming WP here, you sound like you think I am. There is no need to be so defensive of it. I’m just trying to explore options for the good of the entire community. I make my living through WP, it’s VERY important to me.
Yeah it’s not an FTP leak as I have full FTP access logs but it doesn’t rule out security at the server level.
My hosts have always been overly cautious with security, so I was surprised when this happened.
It has been spreading the last few weeks and yesterday there were over 40 sites reportedly hacked on here.
Today a few folks have also had multiple sites hacked.
It’s something that is being triggered in certain environments, but must be a common exploit as it has affected a fair amount of sites.
Until we get an access log for the day someone notices (or the hacker explains what he has done) we’ll struggle to get a definitive answer I think.