Beware WordPress users!!

0

0perat0r

Newbie

Mar 12, 2012

18

6

• May 12, 2012

• #61

problem is the cracked themes that using timthumb.php, this script is dangerous. Just change image search codes to direct links and delete this timthumb.php thats the best solution. And dont use every plugin.

if you want to use timthumb.php then change these in the file
$allowedSites = array ( ?flickr.com?, ?picasa.com?, ?blogger.com?, ?wordpress.com?, ?img.youtube.com?, ?upload.wikimedia.org?, ?photobucket.com?, );
to this
$allowedSites = array ();

also there's another issue in footer.php its like that:
$o = ?23r2o3hro2h3flkh2oı3hf2hj3foıj234ıfu23ğf23r23okcaşlskfsker23fwfsdfkfk3op4kf
3k4fk34fk3o4kfo3k4opgk34opgk3o4g3k4gk34gk3op4kgo34kgop3k4go3k4pgk34op?; eval(base64_decode(?23j23jp2j3ok2??));

that is the evil code to include shell into your site. you have to decode it first. then take the necessary html code for your theme then you are ok!
here you can decode it : ​ottodestruct()com/decoder.php

 

R

rwtbkk

Newbie

Nov 3, 2010

15

5

• May 12, 2012

• #62

I have been hacked several times. Each time I learn a bit more. Right now I run wp firewall2, Bulletproof security pro ($39 for unlimited sites and worth it). I also after the last big one subscribed to Sucuri. Great service, send in service request and 30-45 mins later site is cleaned on back in biz. They scan the site every 6 hours and send you and email if something is up. BP pro gives you specific lock down instructions on .htaccess and folder permissions. Also I use a twinning plugin so I can get back up right away if needed. And NO caching plugin. And also use Cloudflare. So takes a pretty determined hacker to breach it all and I can be back up in a matter of minutes.

 

nonhacker

Regular Member

Dec 26, 2008

255

65

• Aug 2, 2012

• #63

I use Wordpress File Monitor
http://wordpress.org/extend/plugins/wordpress-file-monitor/
it will email you as soon as any file is changed on your wordpress site.
Saved me a few times...

 

R

randolph60

Junior Member

May 13, 2011

191

50

• Aug 2, 2012

• #64

It happend to me to. It seems that they attacked the admin account so i suggest to rename it.

The second attack was very strange. Not even cPanel Login worked for me.

 

D

darkhat99

Regular Member

Mar 2, 2012

488

37

• Aug 2, 2012

• #65

Yup...thank you..I will keep in mind your information...

 

blogbd1

Power Member

Apr 19, 2008

590

374

• Aug 2, 2012

• #66

This sort of vulnerability with show up time to time. Thats why I prefer to use custom built php sites. They can be far more SEO friendly than wordpress.

 

WebDev

Regular Member

Oct 31, 2010

384

503

• Aug 2, 2012

• #67

blogbd1 said:

This sort of vulnerability with show up time to time. Thats why I prefer to use custom built php sites. They can be far more SEO friendly than wordpress.

Click to expand...

Do you market your site building scripts?

I'm mostly using silomatic/thematic and xsitepro to build silo sites - php would be nice

 

FstQuik07

Junior Member

Sep 5, 2011

106

27

• Aug 2, 2012

• #68

So I've got this weird situation..

I'm jumping back into the game and I found THIS in my site.

Funny thing is, hostgator says they were unable to find anything malicious?

Is this a false positive? It certainly doesn't look like it..

 

Attachments

• 
  C9urJ.jpg

  41.8 KB · Views: 6

FstQuik07

Junior Member

Sep 5, 2011

106

27

• Aug 2, 2012

• #69

Well.. apparently my site checks out guys

Here's what helped..

http://sitecheck.sucuri.net/scanner/
http://www.google.com/safebrowsing/diagnostic?site=www.example.com (replace www.example.com with your website)

Not sure how effective it is, but all the research I did put my mind to rest

 

gundamwing

Supreme Member

Sep 18, 2008

1,294

935

• Aug 2, 2012

• #70

what ever your themes
or exploited inside . code etc
the point is all hacker need to login

so you should protect your login
how ? just use htaccess password

what ever bugs exploited timthumb etc,
the hacker cannot login