Wordpress Hacked!

VonRath · March 4th, 2006, 5:50 PM

Hi,

I'm running a WP blog at http://www.funwithjustin.com/ and I keep getting some type of hack/exploit in which a bunch of pop-up/spam/spyware iframes are inserted at the beginning of my site's code.

Is this a Surpass problem? I've searched and searched to no avail for similar issues on the WP forums.

Please help ASAP!

Thanks,

Justin

**benjamin** · March 4th, 2006, 7:00 PM

I would say no, this isn't a Surpass problem. Usually this is due to WP (or other such systems) not having been updated to the latest version but if you have done this, I'm not sure what more you can do. Maybe one of the local WP experts (ceo & co) will have an idea.

**Kayla** · March 4th, 2006, 7:02 PM

It could very well be due to a recent plugin you've installed. I see you've uploaded something as recently as 3/3. I would recommend inserting a blank index page in your /wp-content/plugins directory until we can help you figure this out completely.

**benjamin** · March 4th, 2006, 7:06 PM

Yay! Kayla to the resue...

VonRath · March 5th, 2006, 1:40 PM

I figured it out, and it's DEFINITELY a surpass problem.

This happened to me a few Saturday's ago too... I've got multiple blogs on the same server, and they all got attacked via code injection.

It seems that somebody is launching an attack on one (or maybe many) of Surpass' servers that looks for writeable files and injects a series of spyware <iframe> tags into the ends of the files once it identifies them as writeable.

I accidentally forgot to fix a bunch of files and update the modes to 644 and these are all of the files that got written into. Again, I know that this is a Surpass problem because it happened to not only multiple blogs, but multiple sites on the same server in which I forgot to update my permission settings.

This has happened to me a few other times too, and I just re-installed WP. It seems to always happen on Saturday during the day.

Hope this helps somebody else.

Thanks,

Justin

**benjamin** · March 5th, 2006, 1:48 PM

It depends on how you look at it. To me, this is a user/permissions-not-properly-set problem, not a Surpass problem. It doesn't matter if you are hosted here or elsewhere, if you don't set permissions properly, you run the risk of being hacked. Not a criticism - this is just my perspective and I am glad to hear you solved your problem!

**twirp** · March 5th, 2006, 4:10 PM

Quote:

Originally Posted by VonRath

I figured it out, and it's DEFINITELY a surpass problem.

This happened to me a few Saturday's ago too... I've got multiple blogs on the same server, and they all got attacked via code injection.

It seems that somebody is launching an attack on one (or maybe many) of Surpass' servers that looks for writeable files and injects a series of spyware <iframe> tags into the ends of the files once it identifies them as writeable.

I accidentally forgot to fix a bunch of files and update the modes to 644 and these are all of the files that got written into. Again, I know that this is a Surpass problem because it happened to not only multiple blogs, but multiple sites on the same server in which I forgot to update my permission settings.

This has happened to me a few other times too, and I just re-installed WP. It seems to always happen on Saturday during the day.

Hope this helps somebody else.

Thanks,

Justin

It's not a Surpass problem.
It's a some script kiddy uploaded a script that finds files that are writable problem.
It's the downside to being on a shared server. Go Dedicated :P
It's a common problem if someone on the server is running a script that allows uploads (most people find forums runing IPB 1.x and exploit that, or sites that allow you to upload anything/rar files)
You can't blame Supass, it's a problem on other hosts as well.

**Suzume** · March 5th, 2006, 6:46 PM

I suggest you check this thread out. It has a more detailed explaination of the problem.

http://surmunity.com/showthread.php?t=17626

You aren't the only one experiencing this, I am as well, along with lots of others. And no, it isn't a Surpass problem. I suggest you make your files (you do mean your theme files, right?) 755 for now, until you need to edit them.

It IS a big problem, but for now all you can do is make sure your scripts are up-to-date and that your permissions aren't world writable (777).

**Bigjohn** · March 5th, 2006, 6:56 PM

Quote:

Originally Posted by VonRath

I figured it out, and it's DEFINITELY a surpass problem.

So you think... but... you say:

Quote:

This happened to me a few Saturday's ago too... I've got multiple blogs on the same server, and they all got attacked via code injection.

That can't be surpass fault - they didn't write or install wordpress for you...

Quote:

It seems that somebody is launching an attack on one (or maybe many) of Surpass' servers that looks for writeable files and injects a series of spyware <iframe> tags into the ends of the files once it identifies them as writeable.

Now, that's not surpass's fault either, is it? That some scriptkiddie has come up with a way to tag WP sites?

Quote:

I accidentally forgot to fix a bunch of files and update the modes to 644 and these are all of the files that got written into. Again, I know that this is a Surpass problem because it happened to not only multiple blogs, but multiple sites on the same server in which I forgot to update my permission settings.

Hmmm... YOU forgot, but that's surpass's problem too?

Quote:

This has happened to me a few other times too, and I just re-installed WP. It seems to always happen on Saturday during the day.

Hope this helps somebody else.

Thanks,

Justin

Well, thanks, Justin. Yes, your alert may help someone else avoid the problems that you descibe... but surely, you have already come to realize that it is not a problem of your host... they did not forget to chmod the files on the software that YOU installed...

Regards,

John

March 4th, 2006, 5:50 PM	#1 (permalink)
VonRath Registered User Fresh Surpasser Joined in Sep 2005 3 posts Gave thanks: 0 Thanked 0 times	Wordpress Hacked! Hi, I'm running a WP blog at http://www.funwithjustin.com/ and I keep getting some type of hack/exploit in which a bunch of pop-up/spam/spyware iframes are inserted at the beginning of my site's code. Is this a Surpass problem? I've searched and searched to no avail for similar issues on the WP forums. Please help ASAP! Thanks, Justin

March 4th, 2006, 7:00 PM	#2 (permalink)
benjamin Sur, pass the salt Excelling Contributor Joined in Sep 2005 Lives in kayla's dvd-rw tray Hosted on Pass44 811 posts Gave thanks: 46 Thanked 54 times	I would say no, this isn't a Surpass problem. Usually this is due to WP (or other such systems) not having been updated to the latest version but if you have done this, I'm not sure what more you can do. Maybe one of the local WP experts (ceo & co) will have an idea. __________________ Benjamin Server: Pass44

March 4th, 2006, 7:02 PM	#3 (permalink)
Kayla Marketing Maven Surpass Staff Joined in May 2003 Lives in Chicago 24,757 posts Gave thanks: 946 Thanked 807 times	It could very well be due to a recent plugin you've installed. I see you've uploaded something as recently as 3/3. I would recommend inserting a blank index page in your /wp-content/plugins directory until we can help you figure this out completely. __________________ Follow Surpass on Twitter and Facebook And there's my own Twitter and LinkedIn

March 4th, 2006, 7:06 PM	#4 (permalink)
benjamin Sur, pass the salt Excelling Contributor Joined in Sep 2005 Lives in kayla's dvd-rw tray Hosted on Pass44 811 posts Gave thanks: 46 Thanked 54 times	Yay! Kayla to the resue... __________________ Benjamin Server: Pass44

March 5th, 2006, 1:48 PM	#6 (permalink)
benjamin Sur, pass the salt Excelling Contributor Joined in Sep 2005 Lives in kayla's dvd-rw tray Hosted on Pass44 811 posts Gave thanks: 46 Thanked 54 times	It depends on how you look at it. To me, this is a user/permissions-not-properly-set problem, not a Surpass problem. It doesn't matter if you are hosted here or elsewhere, if you don't set permissions properly, you run the risk of being hacked. Not a criticism - this is just my perspective and I am glad to hear you solved your problem! __________________ Benjamin Server: Pass44

March 5th, 2006, 1:40 PM	#5 (permalink)
VonRath Registered User Fresh Surpasser Joined in Sep 2005 3 posts Gave thanks: 0 Thanked 0 times	I figured it out, and it's DEFINITELY a surpass problem. This happened to me a few Saturday's ago too... I've got multiple blogs on the same server, and they all got attacked via code injection. It seems that somebody is launching an attack on one (or maybe many) of Surpass' servers that looks for writeable files and injects a series of spyware <iframe> tags into the ends of the files once it identifies them as writeable. I accidentally forgot to fix a bunch of files and update the modes to 644 and these are all of the files that got written into. Again, I know that this is a Surpass problem because it happened to not only multiple blogs, but multiple sites on the same server in which I forgot to update my permission settings. This has happened to me a few other times too, and I just re-installed WP. It seems to always happen on Saturday during the day. Hope this helps somebody else. Thanks, Justin

March 5th, 2006, 6:46 PM	#8 (permalink)
Suzume xx butterfly xx Comfy Contributor Joined in May 2003 Lives in Kentucky, USA 120 posts Gave thanks: 0 Thanked 0 times	I suggest you check this thread out. It has a more detailed explaination of the problem. http://surmunity.com/showthread.php?t=17626 You aren't the only one experiencing this, I am as well, along with lots of others. And no, it isn't a Surpass problem. I suggest you make your files (you do mean your theme files, right?) 755 for now, until you need to edit them. It IS a big problem, but for now all you can do is make sure your scripts are up-to-date and that your permissions aren't world writable (777). __________________ Renee \| Server: Pass33! SacredSecret Livejournal

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Rate This Thread
Rate This Thread: