BonJecker
Forum Replies Created
-
Running the site through sucuri revealed that cPanel is outdated. The site is hosted with a 3rd party host, so I will try to convince our client to move their site to our secured and updated server.
There are over 700 IP address ranges that were added so the total number of IP addresses whitelisted is pretty large.
Here are a few for your reference:
64.233.160.*
64.233.161.*
64.233.162.*
…
74.125.*.*
…
64.4.0.*
…If you would like the full list, please provide a method for me to send it over to you.
Thanks for your response. What prompted me to look into the settings for iTheme was due to my receiving email notifications that ‘all’ of the user accounts were getting locked out due to failed logins. Further inspection reveals that the invalid user logins started on our about 5/5/2015.
If someone had access to modify the database, it would have been easy for them to create their own admin user account, or change one of the users’ passwords.
Therefore, it’s my concern that these IP address ranges just showed up suddenly on their own.
Forum: Hacks
In reply to: Hack? Please help me, don't know what to doEach of our sites is hosted within its own account with its own security credentials so infection was on a site by site basis. None of our sites use MailPost or WPTouch plugins. All infected sites use different themes and plugins and there is no common plugin used on all sites, so I would rule out the source of the infection from an outdated plugin.
The only thing I have found common is that all sites were not on v3.9.1
Is anyone able to confirm their existing v3.9.1 site was infected?
Forum: Hacks
In reply to: Hack? Please help me, don't know what to doAfter reviewing the link you provided and how about 80% of our sites were compromised, I see this is a pretty wide – spread issue. However, so far I disagree with the thought that they are coming in through a vulnerable plugin as I have not found a common plugin to all of the affected sites.
One common aspect found so far is that all of the sites compromised were not on version 3.9.1 when they were first compromised. The one site I mentioned that was infected again a day later was not hardened immediately after it was cleaned and updated to v3.9.1 I have since been hardening WordPress v3.9.1 using iTheme (formerly better WP security) and so far the sites have remained clean (keeping my fingers crossed).
Will post more details and updates regarding the cleaning process once I feel confident the hole has been patched properly.
Forum: Hacks
In reply to: Hack? Please help me, don't know what to doNone of the sites have open user registration and almost every site of ours was hit by this. Thanks for the feedback. I hope this isn’t a widespread issue…
Forum: Hacks
In reply to: Hack? Please help me, don't know what to doYes. The blank user Administrator with ID 1001001 is consistent with all of the sites that have the code added to the top of each PHP page. We are cleaning up all of the code from the files and trying to figure out some commonality between the affected sites. If anyone can help us decipher what this code actually does, we would be happy to provide it. We have found several variations of the code which generally looks like garbage… but it must be doing something… just not sure what.
Forum: Hacks
In reply to: Hack? Please help me, don't know what to doYes Helptourists… It appears your site may have been hacked.
We had this same problem on one of our client sites on June 30th, 2014. What appeared to be malicious code was added to the top of every php file within the client root directory on our live server. I would like to reiterate: this code was even added to .php files that were outside of the WordPress directory (WordPress is installed in /blog/ and PHP files in the root client folder (index.php) were also modified).
We have not been able to figure out what the code does exactly because the site appears to function normally until you log in to wp-admin and visit the Plugins page. After WordPress kicks out the error no valid header and plugin deactivated, the site no longer functions correctly due to the missing plugins.
We have analyzed the code added to the top of the pages but have not figured out what it does as of yet. There is no base64 encoding. A random string is generated and then a php function is created. One of our other developers here analyzed this and said the result that he arrived at was a number… like 120 or something which doesn’t make sense.
I restored the site files from backup but retained the SQL database because it didn’t appear that it was compromised with the exception of the blank Administrator user which had an ID of 1001001 which I deleted.
I changed our Administration login password, the MySQL password, I reset the Salt key in wp-config.php, updated WordPress to 3.9.1 and updated all plugins, and added iTheme Security (formerly Better WP security) and enabled most security including removing the admin user, changing the database prefix, etc.
Just the other day, I enabled the function in iThemes to monitor files for changes and a few days ago I received an email notifying me that many php files were changed on July 1st, 2014 (the day after I cleaned everything up). I downloaded a few .php files from the live site and see they have all been compromised again.
The only password that wasn’t changed was the web server password for the client site, so I suspect they either got in using the same SiteWorx password, or one of the other Admin User’s local computers was compromised and not cleaned.
I can provide the code if anyone wants to take a stab at this.
Unfortunately, we manage about 20 – 30 WordPress sites for our clients and late Friday when I found that this one site had been compromised again, I went through to check some of the other client sites and so far have found five other sites that are infected with this same issue.
Trying to find some commonality by adding to the original post so hopefully we can find a solution. Unfortunately, I have a feeling we are in the early stages of a new WordPress vulnerability that has been found and exploited, but not yet patched.