{"id":207474,"date":"2017-04-19T12:54:03","date_gmt":"2017-04-19T10:54:03","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=207474"},"modified":"2017-04-19T12:55:47","modified_gmt":"2017-04-19T10:55:47","slug":"hackers-nail-unsecure-websites-on-afrihost-server","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/207474-hackers-nail-unsecure-websites-on-afrihost-server.html","title":{"rendered":"Hackers nail unsecure websites on Afrihost server"},"content":{"rendered":"

In mid-February, hackers were able to access several websites hosted on one of Afrihost\u2019s shared hosting servers, and started defacing them.<\/p>\n

Calling themselves Y3AR6.ORG and Myrido on the Mirror-H<\/a><\/strong> hack reporting service, the attackers appear to have targeted\u00a0the server since 17 February – when they defaced six sites.<\/p>\n

The server in question has the IP address 197.242.144.253, which hosts 524 domains according to ViewDNS.<\/p>\n

Initially, the attackers uploaded a calling card to the sites they hacked – a page that mocks the “system administrator\u201d for their poor security.<\/p>\n

Defacements continued until 25 February, using the same calling card with the message: \u201cWuRK\u00e2C-T\u00e9\u00e2M \/\/ HaCKeD MyRido\u201d.<\/p>\n

\"Afrihost<\/a><\/p>\n

Fresh wave of attacks<\/h3>\n

The attacks stopped until 23 March, when the hackers returned to deface several sites by changing their title tags to malformed text.<\/p>\n

On a handful of sites, the hackers wiped the home page and left a message in text: \u201cHACKED MYR\u00ddDO KARAHAN KARTAL\u00dd – MYR\u00ddDO – BY_AGENT – BY_UMUT CONTACT: www.facebook.com\/zbay11\u201d.<\/p>\n

Mirror-H reports that the Afrihost server was hit 197 times. In total, 83 unique domains were hit over the course of five weeks.<\/p>\n

Afrihost’s server was not hacked<\/h3>\n

Afrihost said it is important to distinguish between a\u00a0server being hacked and a\u00a0website being hacked.<\/p>\n

\u201cOur server was never compromised,\u201d said Afrihost.<\/p>\n

\u201cWe are investigating the specifics of the reported website intrusions, but can confirm that most, if not all, of the sites that were compromised were WordPress sites.\u201d<\/p>\n

Afrihost said its sets WordPress installations to force automatic upgrades.<\/p>\n

\u201cHowever, this only affects the WordPress core. All the sites we\u2019ve checked have on average over five updates available for plugins and themes,\u201d it said.<\/p>\n

\u201cWe suspect that is the point of intrusion.\u201d<\/p>\n

Afrihost said it does its best to scan for compromised sites and generally it becomes aware of them before clients do.<\/p>\n

\u201cHowever, we do rely on clients to work with us to report any compromised sites so that we can quarantine them and minimise the risk to other clients in the same environment.\u201d<\/p>\n

\"Afrihost<\/a><\/p>\n

\"Afrihost<\/a><\/p>\n

Now read: Anonymous nailed 3,392 sites on Webafrica \u2013 this is how they got in<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

Unsecure websites on one of Afrihost\u2019s shared hosting servers were hit in a series of defacement attacks.<\/p>\n","protected":false},"author":15,"featured_media":145911,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[1669,35,20039],"class_list":["post-207474","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-afrihost","tag-headline","tag-website-hack"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/207474"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=207474"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/207474\/revisions"}],"predecessor-version":[{"id":207532,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/207474\/revisions\/207532"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/145911"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=207474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=207474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=207474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}