website hacked :(

D

djs

Messages
727
Name
Daniel
Edit My Images
Yes
Hi, another problem.

I logged into google webmaster tools today as I haven't checked in a while, and found a message from Google saying my website is being used as part of a phishing attack?!

So I checked the URL that google had said is dodgy.

website.co.uk /~baixar/blog/wp-content/uploads/paypal.fr/online-securise/fr_cgi-bin/webscrcmd=_login-run/

But there was no content at the address! It seems that there used to be content at that address, but it's recently been deleted.

I've checked the logs, and theres been around 650 people attempt to access that URL, but failed due to nothing being there.
But I think this content was uploaded back in September, but deleted this month.

The hacker seems to be using a proxy, with odd user-agents.

I'm not sure how to check who's logged into the FTP. But I'm not great with this kind of stuff, so I may just be looking in the wrong places.
[edit] the FTP logs are empty? Doesn't even show myself logging in.

I've changed the password, and blocked the I.P that was being used.
I'm using Mac, so it's quite unlikely that I have a virus or anything.

What I'm wondering is.....

Does a hacker need to have my password to change/upload files to my FTP, or can it be done via some sort of dodgy script?
Tbh I'm not sure I know what I'm talking about.
 
How is your site hosted? Are you using some open source software for a gallery etc?
 
djs said:
Does a hacker need to have my password to change/upload files to my FTP, or can it be done via some sort of dodgy script?
Tbh I'm not sure I know what I'm talking about.
Click to expand...

Either method.

The script method is unlikely as someone would have to send you something which you then ran. Possible but less likely.

The password method is most likely. People often use rubbish passwords or the same password across multiple systems. Alternatively they have a really good secure password then having "What is your favourite colour" as a security question?
 
cowasaki said:
Either method.
The password method is most likely. People often use rubbish passwords or the same password across multiple systems. Alternatively they have a really good secure password then having "What is your favourite colour" as a security question?
Click to expand...

The password that I've been using was a randomly generated one.

However, I've been having a look through the cPanel, and in the FTP account section, there are 3 accounts:

Mine
Anonymous (which can't access the files)
and 1 more called "FTP". I'm wondering whether this was a default account. I've changed the password on this account, I've no idea what it was originally. But it won't let me delete the account, so changing the password is the best I can do.

Stumped. I guess the best thing I can do is just keep an eye on the logs for now.
 
I'm looking at the recent Error logs right now, and the hacker is still trying to access the site.
I blocked the IP address about an hour ago, so this came up in the

[client 209.147.127.214] client denied by server configuration: /home/jaffahol/public_html/~baixar
 
Is this for Gallery2?
 
Interesting, I've googled one of the IP addresses.

And one of the results was someone having attacks on his site from the same IP.

And someone replied with this:

"More than likely, they did not use FTP to place these files on your server. I recently went through the same thing on my cPanel server but on several domains, in various random folders. The fact is, your cPanel server is not secure. If you are running mod_frontpage or certain versions of OpenSSH, these are most likely the culprit."

Could anyone put this in simple terms, as I am using cPanel, but don't really understand the reply
 
You must log in or register to reply here.
Back
Top