My domain got hacked!

A friend called this morning to tell me my domain, http://www.LavenderLounge.com got hacked. When I checked, sure enough, there was an image of a gnarling dog and this text:

.:[ LegijaOne Ownz you! ]:.
.:[ by FDCR3W ]:.
.:[ H3LLdOgz on the NET! ]:.

I opened my ftp program and found that my "index.html" file had been renamed "xxxindex.html" and there was a new file named "index.php" with that image imbedded.

All I needed to do was delete those weird files and re-load the right file, and it seems to be alright for now.

I called my host, Webair, and they are checking for security leaks.

I am curious to find out the how's and why's. Has this happended to any of you before?

Quote:

---

Originally Posted by LavenderLounge

I called my host, Webair

---

There's your problem right there :)

Regards,

Lee

Quote:

---

Originally Posted by Lee

There's your problem right there :)

Regards,

Lee

---

Yup Mark, definitely sounds like your webhost has security problems.

Perhaps you should host with us Mark.

www.dotcomhost.com

Just talked to one of our IT guys and he said to make sure you update all the software you use to run your site. Older versions are exploitable especially on a site that is dynamic like LavenderLounge.com. There are backdoors that hackers can use to access your root files very easily.

Make sure you update all your scripts, there are some very serious hacks out there for old versions of phpbb, autogallery, mambo and lots of other common scripts. What scripts were you running?

If you had no scripts running then its a problem with your webhost. Are you on a shared or dedicated server?

cheers,
Luke

Webair said the same thing about outdated scripts.

My blog is done with Moveable Type, but otherwise the site is just done in very basic html. I wouldn't know php from pcp, they both make me dizzy.

It's a dedicated server, btw.

I used to have a little script on that page from Sex Money that did a redirect from foreign language users. Could that be it?

Lee,

I am surprized at your comment about Webair. I signed up with them on YOUR recommendation!

Quote:

---

Originally Posted by LavenderLounge

A friend called this morning to tell me my domain, http://www.LavenderLounge.com got hacked.

---

I don't know if this helps but you're running Apache 1.3.29, when the latest version is actually 1.3.35. There have been a number of security updates since 29.

Apache is in of itself generally very secure, so I would certainly look at some of the other scripts running on your page as well as suggested above.

it may have been your movable type (I am not sure if they have had any security issues in the past) but if you are not running any other scripts, it could just as likely be your webhost has not updated Apache, PHP, MySQL, kernel, openSSL, SSH, etc...

I am assuming they do up2date runs for you? and kernel upgrades? and control panel updates? and have secured your server with stuff like mod_security, making tmp nonexecutable, installing and running anti-rootkit tools, installing a firewall, etc?

Quote:

---

Originally Posted by LavenderLounge

Lee,

I am surprized at your comment about Webair. I signed up with them on YOUR recommendation!

---

Hi Mark,

I believe Lee wanted to point out that the problem is the hoster in general.


:develish:

Mark, check with your host to see if they can either give you copies of recent logs or if they have been able to track down exactly how they hacked into your site. There is almost always traces of how the hackers got in, its just a matter of finding them. That will help you get things fixed and secured.

Mark:

Change your passwords.

One of those front page replacement robots successfully hacked me once years ago on texascooking.com. I remember that when I first saw my front page I just freaked out..... but like you, the robot did some minor renaming and nothing was erased en masse. I think they just hacked my FTP password. I recall you on here earlier mentioning that your own LL account/pass was posted on that rip-off website that propogates stolen passwords.

Perhaps that pass now out in public and also happens to be your FTP or FrontPage or whatever account that you use to update the site.

About a year ago, I woke up in abject fear of my sites getting hacked. So I set it up so that my webservers root and admin access passwords are not the same passwords that i use to loginto my affiliate programs, like ccBill or DHDmedia. Nor are they associated with my MS Outlook email passwords, which potentially might get snatched by a virus.

We all have lots of usernames and passwords nowadays, especially those of us doing business with online companies. What if an insane imminently-to-be-fired employee stole some company data with affiliaites, and went out phishing for websites they could compromise?

As another paranoid precaution - i took my domain name accounts with the two domain name hosts I use, and I made those even different passwords with letter/number combos. And then (most importantly) I wrote this ALL down in a notebook that I always know where it is, and won't throw away.

Imagine someone hacking your internic domain names and switching the DNS records for your websites. What a nightmare scenario!

Glad your problem turned out to be relatively minor.

Steve

I would personally be VERY concerned. Depending on whether the hacker was just a low-level script kiddie or someone actually competent, you could have backdoors, rootkits, or God knows what else.

Make sure that whomever is checking out your server at your ISP is really well versed in examining a server for security breaches, and not some $8/hr guy who is more interested in what's for lunch than your server issue.

In our case, when we had a security breach sometime back, I had a friend of mine who does IT security and intrusion detection work check out the server AFTER the ISP had looked at it... and he found evidence of a rootkit on the server, complete with full backdoor access giving the hacker root access to the box.

We rebuilt the box from scratch, and restored from an earlier backup. If you're storing any critical information (credit card numbers, etc), that's the ONLY safe way to go.

Desslock, i totally forgot to mention to change all passwords asap!

Chip, you are absolutely correct. After being hacked the best way to know you are on a secure server again is to rebuild it from scratch.

I think I figured out how they got in. I have a vBullitien discussion board on one of my doorway sites. It two installs to get it set up, so the first one was this there, but not active. They hacked the inactive discussion board and put up one of the "we own you" pages. Since it was inactive, I would have never noticed.

I also found an ftp login that I didn't recognize, so I deleted that and created all new ones.

My blog software is also a possible entryway, so I want to upgrade that, but I need help to do it.

Looks like I've got a lot of work to be done beyond my technical knowledge, so I am going to start a new thread looking to hire a techie contractor here in San Francisco. Please pass the word.

Thanks for all the help everybody!

Man, there are a million ways to hack a site. If anyone wants a decent book on basic hacking, try How to Break Web Software link here.

This was actually the text book we used for my web security class. To learn how to defend against attacks, you must learn about how they are attacked. If all they did was change your page, then your lucky. Either way, once there is a security breach, you should rebuild the server to be sure.

If he's got the time to do it, I highly recommend Emil Kasperski at Intercage.com. He's one of the most well-rounded, exceptionally sharp people I know as far as network admin/IT security/server maintenance and admin. He owns and manages Intercage, which is a small ISP based in San Francisco, and I'm pretty sure that he deals with this sort of server security issue. I think that he does consulting jobs (dunno for sure) Message me if you want his phone number...

Here is a tool that can help with scanning websites for exposures. It may alert you of any problems that may exist.

http://www.parosproxy.org/index.shtml

Thanks for the tip, Krusher, but it's beyond my technical capabilities.

I'm a one-man operation juggling a lot of plates, and a very low-tech site. Running that software will only tell me what I already know - my site is vunerable to hacking.

I also live in an earthquake zone, and the Big One is definitely coming. I've had to assume a great amount of "managed risk" about that, too.