Re: hacked!!
| From: | Jim Giner | Date: | Fri, 03 Oct 2014 17:05:48 +0000 |
| Subject: | Re: hacked!! | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-323895@lists.php.net to get a copy of this message | ||
On 10/3/2014 11:20 AM, Richard wrote:
------------ Original Message ------------Two files have been altered and replaced - both index.xxx files. Minor insertion of some js code that called some other site. Normal use of my site is to look at things, no uploads, no downloads, no ftp-ing done except by me at my home. Yes - I can alter my filezilla to use sftp I suppose but I'm still concerned in how to prevent this same attack from occurring again today or tomorrow. Does this mean that I should alter my master pswd for the site as well as any protected folders I have setup in the webtree?Date: Friday, October 03, 2014 11:07:52 -0400 From: Jim Giner <jim.giner@albanyhandball.com> To: php-general@lists.php.net Subject: Re: [PHP] hacked!! On 10/3/2014 11:04 AM, Richard wrote:The simple act of ftp-ing into a host, as you imply you do, (with the default, insecure ftp setup) can expose your credentials. Does this mean someone figured out my site password When looking at logs, start by looking for actions that took place around the time(s) that the files were placed on your system. As there's no guarantee that the file timestamps are accurate, look at the directory timestamps too (assuming you haven't touched things there of late). In web server logs look for actions that are "unusual" (not simple file retrieval, or whatever is standard on your site). In system logs (which you may not have access too), look for ftp logins that come from non-standard locations. This is shared, not virtual, hosting - correct? With shared hosting there can be higher-level issues if the overall hosting isn't secured properly.There are a range of potential vectors, potentially including your php code, so I would suggest looking at the server (both the web server and system-level) logs to see if you can identify the source/manner.I have no files with passwords stored in the web accessible tree. Also, I have no idea what to look for in any logs.- Richard- RichardAll of this is way beyond my pay grade. Yes it is shared hosting that is very reliable usually. First trouble in 10+ years.