Warning about my recent wordpress hacked experience

Hi all,

I wanted to let everyone know in BHW about the last two days (today and yesterday). I'm with an excellent webhost (servint) and they have a ticketing support system, well out of the blue yesterday I received an email about an 'admin issue' so I logged in and read that a report had been made about a phishing site was running from one of my domains, I checked it out and sure enough there were the files and folders and I could see in my logs victims had been visiting from emails to these files.

I quickly deleted them and made the support team know that I wasn't involved in this and helped them where I could.

Earlier today all my domains started acting up out of the blue, I made support aware of it then this evening I received another admin email, stating that another phishing attempt was running on the same domain as before. I checked and there were files for more than one phishing site in my domain. I have password protected my root folder so anyone visiting my site will see a request for username/password. I'm being told that it is related to not updating my wordpress installation to 3.01

It was already updated to 3.0 but not the very latest one. I'm sure there are people out there looking for vulnerable wordpress installs and I know many BHWers use Wordpress so I wanted to share this with you, as it is a real threat.

I'm not so worried because I've already given a months notice with this host and already planned on shutting my sites down in 3 days time. My domains will be used for email redirection and domain redirection only from my domain provider so there will be no site to phish from.

Hope this message helps prevent this happening to at least one of you.

All the best.

P.

looking at my google analytics, i noticed that my contact us email address has been ranked #1 under my traffic sources keywords.....

Reminds me of the old AOL days........

That's good to know. Did you find out how they hacked your sites? What exactly was the security risk in wp 3.0
Curious

IIRC correctly the 3.01 release was not security related. There are other attack vectors, especially if you are on shared hosting, running other scripts on the server, run outdated versions of software, or have the wrong permissions set for directories or files.

or got your password stolen.

Thanks for the valuable info. I'll be more aware now to keep my wordpress blogs updated.

When my blog got hacked the hacker changed my admin password and email address the put up a black screen stating that I'd been hacked. I had cpanel access so I just deleted the lot.
Posted via Mobile Device

ruworth said:

When my blog got hacked the hacker changed my admin password and email address the put up a black screen stating that I'd been hacked. I had cpanel access so I just deleted the lot.
Posted via Mobile Device

Click to expand...

hahaha... "awesome" hack, hacker! what was that supposed to accomplish?

Not sure if bad behaviour plugin would help in this situation, but give it a try. It has helped me keep the idiots out from a tinymce hack etc.