|
raffi
|
 |
« on: September 13, 2006, 07:29:20 PM » |
|
I am in a bit of disbelief that one of my sites on a shared host was hacked THREE times in three days, all the files were deleted, and everytime the password gets reset (with an IMPOSSIBLE to crack new one), the hack my site immediately again. Whatever is wrong has GOT to be obvious, it is clearly serious, and my trouble ticket is just languishing in "medium" priority. It has been days I have been trying to iron this out now and all they've been able to do is occassionally help change the password (not even very often at that). They did offer to restore the backups for $75 a site, without even addressing the issue of how the sites got hacked to begin with!
The hackers are racist and have replaced my front page with racist links - and lunarpages does not seem to care despite my explanation. I don't understand what I have to do to solve this, since it is just not getting solved and by now tens of thousands of visitors on my shared and virtual hosts have been exposed to this racist propoganda instead of my sites.
How on earth are the sites getting hacked?? HEEEEEEELLLLLPPPPPPPPP!!!
|
|
|
|
« Last Edit: September 13, 2006, 07:30:55 PM by raffi »
|
Logged
|
|
|
|
|
GMTurner
|
 |
« Reply #1 on: September 13, 2006, 07:58:29 PM » |
|
The trick is figuring out how they are getting in... if they are getting in through a flaw in a script changing the password will not fix the problem. If you delete everything from within public_html and they still get in to create an index file for your site, then they are obviously not using a flawed script to do it... make sure your cpanel and FTP passwords are changed... it might be that the cpanel password is changed, but an older FTP password is still stuck in memory somewhere...
|
|
|
|
|
Logged
|
The above post was made at a time when I gave a dang and doesn't necessarily reflect my current views or opinions. For those no longer with us ...  Turner's Lounge |
|
|
|
GMTurner
|
|
« Reply #2 on: September 13, 2006, 08:00:27 PM » |
|
Oh, and make sure they haven't uploaded something outside of the public_html directory which might be giving them access in someway... and that no cron job has been setup to automatically create the hacked page...
|
|
|
|
|
Logged
|
The above post was made at a time when I gave a dang and doesn't necessarily reflect my current views or opinions. For those no longer with us ... Turner's Lounge |
|
|
|
oxsley
|
|
« Reply #3 on: September 13, 2006, 08:21:32 PM » |
|
Sorry about your hacking problem. I checked out your hacked home page.... bummer. I also did a Google search of your site and looked through some of Goolge's cached pages of your site and see you had quite a few user-input applications.... a discussion board, chat, blog, etc. There's a good chance they found some exploit in one of the scripts you installed.
I know you are probably not too happy right now, but in my humble opinion, web site security is really the responsibility of the webmaster, not the web host. It can be tempting to start going install-happy with all the cool, free scripts available, but I personally shy away from things like forums, blogs, etc. It seems to happen time and time again that some 3rd-party tool becomes popular, then a bunch of crackers try to find a hack, and as soon as one is found, the hack is posted on a zillion discussion boards, and then you have an army of people searching for sites to exploit.
For example, it seems there was an issue with a version of phpBB a while back. As soon as a hack was discovered, all it took was to search Google for "phpBB" to find every forum that was ripe for hacking (afterall, most 3rd-party scripts have a signature at the bottom making hackable sites easy to find). Of course, this is just my opinion of things.
I hope recovering your site goes well. But as GMTurner eludes too, you best find how they are hacking your site, or it will just get hacked again.
|
|
|
|
|
Logged
|
|
|
|
|
raffi
|
|
« Reply #4 on: September 13, 2006, 08:26:25 PM » |
|
No, no, there were no scripts. The blogs were on blogger, and the discussion board/classifieds/chat were long gone or in the case of chat hosted on ICQ.
Passwords all were changed.
I dunno...
|
|
|
|
|
Logged
|
|
|
|
|
oxsley
|
|
« Reply #5 on: September 13, 2006, 08:27:39 PM » |
|
You say you had 2 sites hacked? What is common between them? That might give you a clue as to how it's getting hacked.
|
|
|
|
|
Logged
|
|
|
|
|
oxsley
|
|
« Reply #6 on: September 13, 2006, 09:07:34 PM » |
|
Any user-input form/field is susceptible to injection attacks if the user input is not properly scrubbed. For example, on Armeniapedia.org I see this: Welcome to Armeniapedia, an online encyclopedia about Armenia that anyone can edit. On Cilcia.com, I see this: Cilicia now focuses on interactive things like chat, boards, classifieds, logs, etc. Often, form input is processed by PHP or some other script. For example, you might have a form with a text field that asks for a person's name. Then, the user submits the form, and on the next page it says "Welcome John Doe" (or something like that). The PHP code would be something like: <?php echo "Welcome " . $_POST['name']; ?> But if instead of entering "John Doe", what if a user entered "John Doe; $file = fopen("index.html", "w"); fwrite($file, "<html><head><title>HACKED</title></head><body><h1>This site has been hacked !!!</h1></body></html>"); fclose($file);"If that user input is unfiltered, that input might actually get executed by PHP and actually write over your index.html file. By inserting a semi-colon and some more PHP commands, it's possible for a user to do a lot of damage. This type of attack does happen. The key is scrubbing any and all user input before processing it. For example, you might limit a user's name to be only so many characters long and only contain alpha characters. And again, there have been plenty of 3rd-party scripts that have had this kind of security hole. I'm not sure if that's the type of hack that is happening to you, but it's a possibility. |
|
|
|
|
Logged
|
|
|
|
|
JeremyD
|
|
« Reply #7 on: September 13, 2006, 09:21:21 PM » |
|
What ossley is true..
What web software do you run? I can do a search on a few hacker sites I know and see if any exploits turn up for them.
Your best bet is to upgrade everything and start protecting
doing things like changing your php.ini file to disallow register_globals and fopen_url will do termenous help agaisn't hackers..
|
|
|
|
|
Logged
|
|
|
|
|
akchuck1960
|
|
« Reply #8 on: September 13, 2006, 09:55:22 PM » |
|
I am sorry to hear about it, really sorry. Your problems are part of the reason I am hesitant about upgrading my page at all.
I know some codes can allow you access to a site, I don’t have the foggiest what they are or how they work. So you can imagine I am not too excited about adding any codes to my pages.
I saw your corrected (unhacked) page and it really looks great. I can tell you’ve really taken a lot of time with it. Let us know if you find out what’s going on.
|
|
|
|
|
Logged
|
|
|
|
|
raffi
|
|
« Reply #9 on: September 13, 2006, 11:32:47 PM » |
|
I really don't know what exactly happened. I do know there were scripts over a year ago which I removed because they were getting hacked. These were scripts provided by lunarpages which sometimes got hacked even before I was informed I should upgrade due to security flaws. But I haven't used them in a long time.
My suspicion is this: I think they got some exploit worms on the server and let them sit a long time. Then they decided to hack it and left some scripts on the root directory which were broadcasting to them new password logins.
So I think I have cleared everything out and I hope it is over now. It does amaze me that these big popular scripts can leave such critical security flaws, and that people waste so much time exploiting them. In this case it was racist Azerbaijanis who were attacking out of ethnic hatred.
Thanks for your help with these things, I will see how it turns out and be much much more wary of forms, scripts, etc...
|
|
|
|
|
Logged
|
|
|
|
|
cemedia
|
|
« Reply #10 on: September 14, 2006, 04:42:37 AM » |
|
my rough guess is, check your PC
you might have some nasty software on your PC else I have no clue how they get access to your cpanel even after PW changes.
I'm almost possitive you have somewhere a keylogger on your system installed if this happens over and over again.
SQL and html injection is also possible if your scripts aren't secure.
|
|
|
|
|
Logged
|
|
|
|
|
SteveW
|
|
« Reply #11 on: September 14, 2006, 05:41:08 PM » |
|
But I haven't used them in a long time.
If form handlers and other scripts that were exploited are still on your server with their original names, they can still be exploited even if they aren't used by any of your site's pages. So a good rule is, if you aren't using them, delete them or at least rename them. My suspicion is this: I think they got some exploit worms on the server and let them sit a long time... Yes, they could have done that, too. Something to let them back in even if you discover and fix the main part of the hack. So I think I have cleared everything out and I hope it is over now.  Any folders that you didn't empty (including above root) should be checked file by file for anything that looks suspicious. |
|
|
|
|
Logged
|
|
|
|
Tristan
Resident Alien
Administrator
Berserker Poster
 Offline
Posts: 9110
nihil sunt omnia
|
|
« Reply #12 on: September 14, 2006, 09:12:26 PM » |
|
Hi, My suspicion is this: I think they got some exploit worms on the server and let them sit a long time... We do not let exploits sit on a server for the server itself. In fact, sites that are exploited can't get scripts the hackers put into the global /tmp partition to run as /tmp partition has noexec for it (so scripts can write to it since PHP sessions usually need to write the files to /tmp, but processes can't actually run from /tmp). Since shared customer accounts do not have jailed or regular shell, they run as their own users and can't go about in the normal course affecting other people's sites, so yes, raffi's could have had exploit files sitting there in the account itself (not the global portion of the server, but the customer's own site files) that weren't cleaned out and they re-exploited via those files, but no, we do not have exploits sitting around on the server itself outside the customer's account going about for ages then periodically attacking 1 customer out of hundreds (if something were exploited in that manner, it wouldn't be 1 person but a bunch on the same server posting here about it in fact). Additionally, accounts are pretty well jailed from interacting with other accounts. Although there are php shell scripts that used to be able to run to grab customer information like username (only username, not passwords), we scan for those and have begun adding security rules to disable them from even running to get such information. Finally, I wanted to give an example from the other day, although this happens frequently. There was an exploited customer who noted he didn't run any scripts at all 2 times in a ticket, yet he was exploited and wanted his account restored. When we performed the restoration of the account back to the state prior to the exploit, we checked it over and found a bunch of php scripts, including one with no security that was used to delete files (the exploit had deleted most of his public_html content). I wrote back asking that these scripts be secured. Since that script had a path to another one of his scripts, and was dated from way before the exploit, it appeared apparent this was his script not a hacking one, but it could easily be hacked into (and it was never denied in the email for being his script either). The point is that many people say they have no scripts and upon checking the account, it usually has many scripts in it, some that are self-written even and not the hacking scripts at all but ones on the account prior to the hacking--scripts used as the entry point for the attacker. Have a Blessed Day |
|
|
|
|
Logged
|
|
|
|
|
Dilber MC Theme by HarzeM