Our site was hacked somehow and blacklisted by Google. I have submitted the site for review again after removing the malicious content, but I want to make sure that I do everything I can to make our site secure once more.
I have changed the password and deleted any pages that contain login forms and also removed the scripts folders.
Does anyone else have any other suggestions?
The code that was inserted was
Cheers!
iframe injection, normally happens via SQL injection, cms editors with insecure uploaders, or remote include vulnerabilities.
Thank you for your reply Stephen.
We do have several temporary MySQL databases that run some of the sites currently under development. Is there something I can search within these databases to make sure there isn’t something hiding in there that can possible re-infect our site?
the databases arent really the issue, it is the code that interacts to them that allows the injection
So if I remove the code that allowed the injection (the login form) I remove the threat of being attacked again?
Either remove it or code it so it strips out HTML etc.
remove or fix. If you look on google for sql injection + php (or asp or asp.net etc) you will find a lot of tips and tricks that help prevent it before it can happen.
Hi, our sites got hacked as well. All of them under Win2. It looks like they were able to delete our index.* file and replace it with their own.
Is there a way to check how they got access? Should I change my password and stuff (or should I submit a ticket)?
This is what they posted
[code]
Ownz! by Cyber Operations Team[Turkish Hackers] - CyberGrup.Org
Sizin ile Bizim Aramizdaki En B Fark 酨te Bu !
CyberGrup.Org
Unlimited Hacking Platform
liming, sent you a PM with some info. I had your user on file for customer only forum so its a bit easier to lookup for you 
Had one of my sites hacked today (running punbb) - replaced index.php file with one line of text.
Still waiting on info from support ticket.
I’m trying to clean up one of my workstations after a pretty nasty virus attack. X( This particular strain of ugly has as one of its features an attack on any local php, html and asp files it finds; it’ll insert an iframe payload on the local file, in the hope that the file will eventually be uploaded to a public server – once live, it’ll continue the fun game of infecting others.
So you may want to check if the problem is with an infection on one or more of the computers that you use for web editing. YMMV.
ticket id?
Hacks happen daily, in some sort or another, many times itis hidden which is just as bad since they try to run phishing scams off of it 
We have seen this variety as well, it is bad as it comes via legit FTP from the users IP even(we’ve shown some logs to get them to believe it, then run full current AV scan and found it)
Thanks Stephen!
I’m curious, if they hack 1 site, how are they able to figure out all the other connected sites?
Is it a script that simply finds all the domains under my FTP?
And if that’s the case, why doesn’t it infect the entire Win2 server?
one site can affect all under the same user due to group permissions, since other users on the server dont run under the same permissions group as yours they can’t get to other users.
GSU-39455-286
Thanks Stephen
Sites Hacked - All Domains
Something seems to have been able to spread throughout all my domain folders, replacing index / default files with their ‘hacked page’.
Could someone at Jodo please look into this and advise?
Ticket ID BCI-63310-902
Re: Sites Hacked - All Domains
OJM,
This was explained in the other thread, i am merging the thread as well.
infected networks scan the internet every second of the day looking for vulnerable pages, upon finding them they do multiple POST requests, they also look in google for indexed pages containing keywords of known vulnerable app, upon finding them they hit hard with injections, remote includes, file uploads to unprotected uploaders, etc.
There are many varieties of these attacks but they all stem from an insecure piece of code in an account that then can deface all pages on the account.
They scan in ranges of IPs, I have seen such infected machines as a few VPSes have gotten to be a part of their network for a short time before having to be shutdown temporarily until cleaned up(these come mostly from bad passwords).
Thanks for the info, however I would appreciate an update to my tickets, with possible info on how the infection occurred - ie, starting from which domain etc.
GSU-39455-286 - Opened March 12th - No update since 14:00 GMT on March 12th
BCI-63310-902 - Opened March 13th - No update since opening it at 19:30 GMT
Yep we are working on that for you looking in logs etc. it is time consuming and I am heading this up, just because no reply doesn’t mean no action. i have the other staff generating logs all the time :rolleyes: