All my sites hacked

[Xaviers]

I've been trying to get in touch with some moderators about this. The first

guy I gave a free site to yesterday hacked all of my websites. I mistakenly

sent him my sql files for all my sites instead of the just the 1 he bought. His

skype is nicobottema. So anybody know of any premium wordpress security

plugins I can use to deal with this? Or somebody I can hire to combat this?

 

[forwardedlandlines]

I've been trying to get in touch with some moderators about this. The first

guy I gave a free site to yesterday hacked all of my websites. I mistakenly

sent him my sql files for all my sites instead of the just the 1 he bought. His

skype is nicobottema. So anybody know of any premium wordpress security

plugins I can use to deal with this? Or somebody I can hire to combat this?

Dude wtf.. I didn't do a thing. I have no interest in the contents of that SQL nor would I have a clue on 'hacking' (nor do I have the mentality. I construct, I don't steal or destroy). BTW passwords are stored in databases in useless MD5 hash encryption. So you're better off not presuming that 'the guy who got all your databases' hacked your site, and find a real cause and method of reparation instead.

 

[iwantl00t]

Check out - http://codegarage.com/

Peter should be able to fix this.

 

[LakeForest]

You mistakenly gave a client all your databases? That's pretty extensive willful neglect...

As for 'hacking' your sites: change your passwords and make sure anonymous ftp id disabled.

if your client did screw around where he wasn't supposed to because he got curious and went looking at the other databases and played around a bit and didn't know the mess that would get caused...apologize. You have a chance, right now.

 

[Xaviers]

Dude wtf.. I didn't do a thing. I have no interest in the contents of that SQL nor would I have a clue on 'hacking' (nor do I have the mentality. I construct, I don't steal or destroy). BTW passwords are stored in databases in useless MD5 hash encryption. So you're better off not presuming that 'the guy who got all your databases' hacked your site, and find a real cause and method of reparation instead.

That's what namecheap said i wouldn't just guess it was you i don't even know you. They said it was specifically because i emailed my sql files to you. Personally I'm not concerned with arguing with you about it. The facts are my sites were hacked and i need solutions. You can feel how you need to i don't care. I stated the situation as it was presented to me.

 

[Xaviers]

Yea it was screw up on my part. Whatever happened it closed all my sites with a bunch of errors and installed a bunch of backdoors according to namecheap tech support.

 

[dario111cro]

He is right. Wordpress saves all passwords in md5, which is almost unbreakable (still, there is a chance with rainbow tables). Can you explain in which way are you sites hacked? Do you have injected code, no admin access, sites deleted...?

 

[cosmotheory]

change your ftp and cpanel account passwords, contact with your hosting provider to restore your sites from backups. easy..

 

[Xaviers]

He is right. Wordpress saves all passwords in md5, which is almost unbreakable (still, there is a chance with rainbow tables). Can you explain in which way are you sites hacked? Do you have injected code, no admin access, sites deleted...?

It was injected code all the passwords were compromised. From what i gather during the time we were changing the sites the just kept installing more malicious code and back doors. They're all supposedly fixed but now I'm looking to maintain protection against such an attack in the future and or scanning regularly to make sure it's completely taken care of.

 

[Giuni]

instal a free plug in called "Wordpress Firewall 2" and it will protect you from the most known attack possibilities. i have a dude from Ukraine who is trying to hack my site at least 1 time per week for the last 2 months and i always receive an email telling me how he wanted to hack my site. this plugin gives me also the IP from where the attacker is

 

[Envyliciouz]

instal a free plug in called "Wordpress Firewall 2" and it will protect you from the most known attack possibilities. i have a dude from Ukraine who is trying to hack my site at least 1 time per week for the last 2 months and i always receive an email telling me how he wanted to hack my site. this plugin gives me also the IP from where the attacker is

Hahahah. That's hilarious. Thanks a lot for it. Didn't know that exists such a plugin. Wish I could give you a big +rep.

 

[xealey]

haven't u back-up'ed your sites?

 

[johndoejohndoe]

He is right. Wordpress saves all passwords in md5, which is almost unbreakable (still, there is a chance with rainbow tables). Can you explain in which way are you sites hacked? Do you have injected code, no admin access, sites deleted...?

MD5 encryption is only as good as the password you're using. Some sites have added the use of 'salt' keys for further encryption because of this fact. Either way, when you're creating a password in wordpress, or any other site, it should always be 'strong'.

 

[Xaviers]

instal a free plug in called "Wordpress Firewall 2" and it will protect you from the most known attack possibilities. i have a dude from Ukraine who is trying to hack my site at least 1 time per week for the last 2 months and i always receive an email telling me how he wanted to hack my site. this plugin gives me also the IP from where the attacker is

That sounds great thanks a lot.

 

[Xaviers]

haven't u back-up'ed your sites?

Absolutely.

 

[ionica21]

I've been trying to get in touch with some moderators about this. The first

guy I gave a free site to yesterday hacked all of my websites. I mistakenly

sent him my sql files for all my sites instead of the just the 1 he bought. His

skype is nicobottema. So anybody know of any premium wordpress security

plugins I can use to deal with this? Or somebody I can hire to combat this?

Yeah, had to reformat my PC thanks to you... Although I realized it wasn't your fault. Shit happens I guess, I should've been more careful.

I'm more embarrassed that it happened to me than anything else.

 

[gsy159]

First Check if all the sites on the server got hacked, so the server could be rooted, if not check your log files.

And trust MD5 hashes are easily crackable, I can crack vbulletin hashes which are md5 +salt=MD5, so don't try to tell me it's not possible to crack them

 

[forwardedlandlines]

Yeah, had to reformat my PC thanks to you... Although I realized it wasn't your fault. Shit happens I guess, I should've been more careful.

I'm more embarrassed that it happened to me than anything else.

What, not me I presume! My stuff is virusless, so it's other crap you download that screws up your pc.

 

[dario111cro]

MD5 encryption is only as good as the password you're using. Some sites have added the use of 'salt' keys for further encryption because of this fact. Either way, when you're creating a password in wordpress, or any other site, it should always be 'strong'.

Well, you can always get brute forced, but that is not related to mistake OP unfortunately did. He can hope that his sites got hacked because of this mistake, since otherwise it could be a little bit more complicated to find vulnerability.


PS. To op: scan you PC. It's possible that you have key logger or other kinds of malicious software.

 

[grav6]

If you're using Wordpress, once you have a CLEAN Wordpress site set up, the first plugin you should install and configure is:

http://wordpress.org/extend/plugins/bulletproof-security/

Also, get a proper backup/restore plugin for when you want to sell someone a site, rather than making a rookie mistake in phpMyAdmin (or similar). At least you will just backup/restore that plugin. Avoid nulled themes and instead use one with a good reputation from Wordpress' own site (no backdoors "pre-packed").