Hacked by badsectqr - Anyone else experienced this?

[cunningstunts]

I wasn't sure where to post this - so posting here.

All 11 sites were hacked by "badsectqr" - the link left on site is imhatimi(dot)org


Just curious how they did this - did they hack each individual wp and joomla site backend?

Or has my PC been comprimised?

Thanks if anyone can advise.

 

[oxonbeef]

They could've got in numerous ways.
Your pc, script in a template, they could
be inside your whole C block.
Have you bought this to the attention of your hosts?
There may be other sites on that server hacked as well.
Now you need to secure yourself and fix any damage.

 

[macdonjo3]

As beef had said already, it could have been a number of ways. I am guessing the most common way: Using a keylogger or istealer or something. What kind of virus softwares are you using?

 

[cunningstunts]

Yes - been onto my hosts - namecheap and they have an internal back up ready to go.

So this is interseting - my anti-virus has been completely removed. PC was left on over New Years Eve.

I've been away for last few days.

Latest software I instaled was AMR.

Not sure what to do - reinstal antivirus software or reinstal OS.

 

[oxonbeef]

Looks like your box is compromised.
If you have nothing on there to loose
by all means reinstalling is simpler than
searching for a virus Avs don't detect.
What AV are you using anyway?
Was the last execution from a legitimate source?

 

[nexozeon]

I personally would blow away the drive and just re-load the OS, actually as cheap as HD's are i would brick the drive and buy a new one and start all over.. Not having a good AV and being on all these sites, is not a good idea.

 

[cunningstunts]

I was using Norton.

Was the last execution from a legitimate source?

You mean the last exe software instal?

It was AMR - Article Marketing Robot

Yeah - will buy new HD and start again. Cheers for the FB.

And Happy New Year!

 

[ivictus]

I got hit once by confirming directory submission emails. The directory site was infected with some java program that started a download in my browser. I immediately shut down Firefox but it was too late. The software was installed and scanned my hard drive for stored password in WS-FTP and Dreamweaver. It then infected my hosting accounts so it could infect who ever visited them.

What a pain. Never save your passwords to your hosting account in ftp programs.

 

[baDsectQr]

The problem , server is not secure
easily reachable your file config , Let give an example command the pull config

ln -s /home/username/public_html/configpath ex.txt

Change the path your config file and encrypt
good luck

 

[aReJay]

The problem , server is not secure
easily reachable your file config , Let give an example command the pull config

ln -s /home/username/public_html/configpath ex.txt

Change the path your config file and encrypt
good luck

This works as long as you have access inside the server. In order for that you need to get access somehow.

The most common way is via faulty Joomla/WP plugins. There are literally thousands (probably tens of thousands) of WP/Joomla sites waiting for me to upload my shell and do what ever I like to your site.

When you have the choice, don't use open source software.
-aReJay

 

[baDsectQr]

This works as long as you have access inside the server. In order for that you need to get access somehow.

The most common way is via faulty Joomla/WP plugins. There are literally thousands (probably tens of thousands) of WP/Joomla sites waiting for me to upload my shell and do what ever I like to your site.

When you have the choice, don't use open source software.
-aReJay

joomla - wordpress makes no difference first index file pulled , require_once or are there ways to include command

 

[Gigusx]

I haven't, it could be your mistake probably.

And change your AV, norton sucks

 

[aReJay]

joomla - wordpress makes no difference first index file pulled , require_once or are there ways to include command

That's a little too obvious and would be the first place that people look for redirects/defacements.

You need to look deeper into your application, and usually the code will be obfuscated with base64_encode which makes it impossible to do an fgrep search for the code alteration.

-aReJay