New attack on wordpress sites?

dbuck

Registered Member

Dec 14, 2011

55

23

• Jan 15, 2014

• #1

If your WP sites have been hacked. I can help. I had 6 of my WP sites compromised and it was something new. Took me a few hours to figure out. I would suggest upgrading WP and ALL themes if you havent already. It seems to hit the footer.php in your theme and will spread into the plugins... also chmod the themes footer.php to 444. Most my sites are over 4 years old and I have been hit, but not like this.

 

T

tojamie

BANNED

Jan 14, 2013

1,046

240

• Jan 15, 2014

• #2

Never hack my 10+ wordpress sites.

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Jan 16, 2014
• Thread Starter Thread Starter

• #3

Good for you tojamie...This new one puts a Iframe at the end of your footer.php and a few other files. also injects itself into js scripts...pain to clean up, but can be done.

 

T

thraxx

Newbie

Nov 20, 2008

25

6

• Jan 16, 2014

• #4

Any behavior to look for to know if you've been hit?

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Jan 16, 2014
• Thread Starter Thread Starter

• #5

If you use the Wordfence plugin it will alert you. I have Kaspersky and it said the site was not safe. without Kaspersky I would not have new about the Trojan and it would have downloaded into my pc. I did let it download so I could see what it is.
As far as behavior there isnt any. Site might run slower.

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Jan 16, 2014
• Thread Starter Thread Starter

• #6

You can use the Sucuri SiteCheck scanner to check your site for any file changes..just google it. or download the wordfence plugin and run it.

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Jan 16, 2014
• Thread Starter Thread Starter

• #7

Here is the the code it writes into a few of your files.

<iframe name=Twitter scrolling=auto frameborder=no align=center height=1 width=1
I had to leave off the closing brackits so my kaspersky would not go off.

 

V

Vanrithy

Power Member

Jun 11, 2013

730

409

• Jan 16, 2014

• #8

That's too bad when the sites hit by those things; I know the feeling. To leave most of the hassle and loss of my business, I've been using the third party services to protect, monitor and proactive cleaning my sites if they got problems. Event if I must pay more but the result is paid by itself if you're normally having these kinds of problem like me.

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Jan 16, 2014
• Thread Starter Thread Starter

• #9

competition hates competition.
Seems the Iframe makes it look like you have lost all your info on your site. But you havent.

 

HerpDerpSlerp

Power Member

Mar 19, 2013

777

629

• Jan 16, 2014

• #10

and this is one of the great reasons why I won't use wordpress

 

Kuz32

Power Member

Nov 7, 2013

702

148

• Jan 16, 2014

• #11

One of hte most important things you can do is update regularly! EVERYTHING

All themse/plugins and WordPress itself. This is the most important basic thing you can do for security.