Urgent : Gamtrak check your site

[GCG]

It looks your site is hacked.

[mojo]

Looks that way here too.



I'll send her a pm too.

[GamTrak]

Oh great! Thanks for the heads up. Janet had mentioned a problem this morning, but I did not see anything.

EDIT: Thank goodness I have a good backup procedure, web host and experience with this (I've been hacked before with no method to recover) and am prepared. Wonder why someone would want to mess with lil ole me? hehe

[GamTrak]

BTW Rick,

I tried to PM a thank you to you, but your box is full and not able to accept any more message.

[GCG]

Good 2 see you have a good backup procedure maybe I must do that too next to a zillion other things.............

[sparky1]

Glad you got it back up Robin and didn't have to go through what you went through last time when the goofball from the UK hacked your site and we know who that was don't we?....shame he is a certified member to boot!

[GFPC]

who? lol

Glad you got it back up Robin and didn't have to go through what you went through last time when the goofball from the UK hacked your site and we know who that was don't we?....shame he is a certified member to boot!

[mojo]

Wonder why someone would want to mess with lil ole me? hehe

I think they secretely have a crush on you and don't know how to properly express their feelings.

Glad it was an easy fix!

[Simmo!]

Keep an eye on scripts that allow users or admins to upload files. I recently had a wordpress hack that exploited this and a friend of mine using eCommerce software too so I researched it.

If you use any off-the-shelf package or a 3rd party CMS of some kind (ie: WP, vBulletin, osCommerce etc) the hackers have a head start. I read a suggestion to do things like rename directories from the default /admin to something else, and remove, rename or secure file upload procedures (images, attachments etc) whther they are user facing or admin backend.

Once a hacker knows you are using, say, Wordpress or vB, they know exactly whats in that package and how to access it etc but the above precautions and making sure the latest patches are applied is good for security.

Oh and another thing...what might look like an obvious hack might go deeper. The hackers often use the sites to hide code used in cc scams and phishing emails. After a hack, look for all files that were change or uploaded on the date of the hack and check they aren't altered or added by the hackers. If you don't spot these then eventually your site could be red-flagged and removed from SERPS so it's well worth a thorough scan. I found exactly these on my friends eCommerce site after a day or so. Unfortunately I didn't discover their way in properly and a week later the phishing files were back.

And finally don't put references to sensitive files or directories in robots.txt as it's easily visible.

Cheers

Simmo!

[Daera]

I'm sorry to hear about this Robin. Have you changed hosts or are you still using the same as me?

Did you find out how they hacked it? Should I be worried?

[GamTrak]

Well it's 2 am and I'm wide awake and wondering what to do next. lol

@casinobonusrus - That bring back some nightmare memories for sure. It certainly gave me a wakeup call on the biz. Good thing they rarely post here so I don't have to be reminded of it that much anymore.

@GFPC - I'll message you on that. I've had enough drama for the month. lol

@mojo - That or they want me to stfu and disappear! hehe It's to bad I have more than one 'suspect' to choose from. LOL

@Simmo - Thank you for bringing that to my attention! After sleeping on it and reading what you posted I'm almost certain that there was something more to this than them just replacing my index file. I recently added a blog and had the htaccess file changed, but that may have nothing to do with this. I'm clueless when it comes to scripts and stuff like that.

What do I do now? Do they have companies that will check this type of stuff and fix it? I've never understood how someone would use skill to do evil crap! Make me wonder why I even bother.

@Daera, thanks girly. I'm with the same one and even though they had issues before they seemed to have gotten back on track with the support.

I did not think to ask how or who as I may never know (must have been in shock). I'm gonna just go into defense mode and hope for the best. BTW thanks so much for that information on our host awhile back (great sluething ) because it sure came in handy!

Hubby was more upset than I was and I think it was only because I have some photos of him that he wanted me to delete years ago. lol

I will contact my host today to see if they can give me more details and then post if I find out anything. If anyone has any more helpful suggestions please let me know.

[GamTrak]

Looks like they were also after my paypal account as I got this a few days ago after trying to withdraw funds to my bank. I have to now go and change about 100 site passwords which sucks! The good thing is I use Roboform to log into all websites OR is that a good idea? If not then I may as well find a new gig as keeping track of passwords is terrible.

Dear GamTrak,

As part of our security measures, we regularly screen activity in the PayPal system. During a recent screening, we noticed an issue regarding your account.

We have reason to believe that your account was accessed by a third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive PayPal account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.

Wonder if they can help me identify the hacker?

[Simmo!]

@Simmo - Thank you for bringing that to my attention! After sleeping on it and reading what you posted I'm almost certain that there was something more to this than them just replacing my index file. I recently added a blog and had the htaccess file changed, but that may have nothing to do with this. I'm clueless when it comes to scripts and stuff like that.

What do I do now? Do they have companies that will check this type of stuff and fix it? I've never understood how someone would use skill to do evil crap! Make me wonder why I even bother.

If you added a blog, one thing you should do is check for injected links. A quick and dirty way is to simply visit the homepage, "View Source" and search for all "http://" links and check they are what you expect. I would do that and also to be safer, I would download the linkchecker Xenu and run a check on the site incuding outbound links (Xenu will also lead you to all your internal broken links which is always good )

If you (or someone who helps you out) and uses FTP, all they have to do is go in to your sitevia FTP and visit each file directory checking the last modified date (ftp programs show this easily) of the files therein and make a list of those that have been modified on or since the hack that you know weren't done by your staff (remember FTP will let you sort files by Last Modified Date too which wil save you a lot of time ). These are the ones that need to be checked.

A bit of Googling will lead you to the filenames of upload scripts for packages like Wordpress and vB that should be secured I would suggest, although I'd guess the latest releases of both packages will probably have plugged any holes found so far so upgrading to the latest versons is probably the best way.

[grem]

this is scary news

hoping this didn't cause you too much damage.

[Renee]

I'm glad you had a quick fix Robin..

It's pretty disappointing that someone within the industry would try something like that on you previously.

[Tony]

Sorry Robin I know they change your index and they add permissions with redirects to sites in your .htaccess, few more things they do, is add JavaScript in the header and a iFrame on the footer of your site they also do the same thing to your stat programs "awstats" "modlogan" and "webalizer" and like Simmo told you any free CMS, Forums, Blogs….. Are easy to hack And NEVER use just plain old FTP use SFTP is safer. One more thing change your passwords and check your PC make sure is malware-free, Good luck.

[GamTrak]

Thanks guys. I appreciate the kind words and feedback.

Tony, I will begin checking out that stuff today and act accordingly. I have a lot more to do as this hacker may still be doing things, but I don't want to say what just yet.

This is jacked up! I feel like I've been violated and the more I think about it the madder I get.

Universal4, if you see this and have time can you please message me? I would feel much better if I could call you and chat about some things.

[Lee-Ann]

What an awful thing to have to go through (once is enough - but twice you say?)

Glad that it's all been sorted

[Chips]

Hate to bring on more bad news but your blog posts are returning a 500 error.

When attempting to go to a single post:

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator, webmaster@addr.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.
More information about this error may be available in the server error log.

[GamTrak]

Hate to bring on more bad news but your blog posts are returning a 500 error.

When attempting to go to a single post:

Thanks Chips.

I just completed my analysis of my html source and it seems to be ok. I have uploaded new files to the server. Next i'm gonna run that link checker then I will work on the blog.

What should I do about that error? Do you know? I'm almost thinking of scrapping the blog as it's been a pain from day one finding a skin, setting it up, permalinks not working and now the error.

Edit to say it looks like my host may not be as bright as I think they are. They set up my blog. Check out that contact addy?