Someone hacked my site

P

Pooky

Garfield's Teddy
Joined
Dec 16, 2007
Messages
24,504
Reaction score
21
Location
Neverland
I don't think they did a very good job of it, but nevertheless, how can I ensure something like this doesn't happen, and how can I fix it?

http://enoki.co.za/

It's where the banner should be, that wall of text...

It says somewhere there "HACKED BY TEAM 755"
 
Pooky said:
I don't think they did a very good job of it, but nevertheless, how can I ensure something like this doesn't happen, and how can I fix it?

http://enoki.co.za/

It's where the banner should be, that wall of text...

It says somewhere there "HACKED BY TEAM 755"
Click to expand...

I think your Wordpress version may not have been up to date. I think they probably found a security breach and exploited it. If they had access to your server or root, they would simply have replaced your whole front page.

I suggest that you look at downloading the latest versions of Wordpress and continuously upgrade it. Always look at security reports or patches when they are released. If your Wordpress installation and security updates were up to date, your hosting company need to look at their server software.
 
Last edited:
You are using Wordpress, on a shared hosting server.

1) Always make sure you system is up to date. This includes plugins and themes. If its 1 version out of day it can be hacked
2) Use a system like cloudflare for your DNS
3) Use plugins like: Wordfence, Acunetix Secure WordPress, Secure Wordpress and Code Guard
4) Always make sure you back up, chances are you will be hacked again pretty easily
5) Use a host that keeps backups of your system (I see you are with domaincheap.co.za and they keep 90 days worth of incremental backups -login to cpanel, click on the bat icon)
6) Make long hard passwords for everything! (database, admin login)
7) Try not make your db appendix wp_ change it to something else
8) Make sure you have decent permissions setup
9) Delete your admin (at least change its ID) user as per: http://www.socialmediaexaminer.com/5-steps-to-ensure-your-wordpress-blog-is-secure/
10) Try make sure the first couple of usernames are not admin usernames http://www.inmotionhosting.com/supp.../change-wordpress-admin-username-for-security

More instructions here: http://codex.wordpress.org/Hardening_WordPress\

I run many WordPress websites. If you harden them you can secure them, and unless you are extreme on your hardening and updating, expect to get hacked every several months or so.
 
Last edited:
Looks like they tried to inject some javascript into the HTML looking for content="" and title="" tags. They failed miserably though. Searching +ADw on the interwebs sees some more attempts by what could be other groups. Looks like an automated spider of some sorts.

How did you secure your wordpress site? Looks like you'd need to grab your db backup if you have one... and secure your site properly.

If you don't have a backup, I would:
1. Check through your database and remove the offending text.
2. Check through your php files to make sure they didn't get into those.
 
abzo said:
You should be flattered that they'd even bother.
Click to expand...

I followed the Team 755 development of their hack. It is an automated program they are using that has the potential of searching and finding thousands of random websites, and exploit those possible, in a matter of a few minutes. So, this was not one or two or even 10 hackers, but rather a program that did all the work.
 
badgers.jpg
 
House said:
I followed the Team 755 development of their hack. It is an automated program they are using that has the potential of searching and finding thousands of random websites, and exploit those possible, in a matter of a few minutes. So, this was not one or two or even 10 hackers, but rather a program that did all the work.
Click to expand...

Bad luck pooky. Gets hacked...by a bot.
 
Thanks a lot guys I will read through all those steps.

Would it be better to start from a fresh install? There's really not much on the site so it would be really easy to...
 
LOl good guy Team 755 leaves his email addresses so you can contact them lmao
 
Only backups of the last two days it seems...

Think I will just start again.

EDIT: Scratch that, I logged in to wp-admin, and that rubbish is just copy pasted into the site title. Just removed that.
 
Last edited:
Pooky said:
Only backups of the last two days it seems...

Think I will just start again.

EDIT: Scratch that, I logged in to wp-admin, and that rubbish is just copy pasted into the site title. Just removed that.
Click to expand...

That is fine.

The best you can do now is to update your WP version as well as all your plugins.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X