tags:

views:

70

answers:

4

I have a WP install, and every few weeks some hackers keep adding some bunk script to the bottom of certain files, making the WP site not function. I've changed the user/pass to WP and this obviously isn't working. I'm thinking since they are effecting files that are not visible via the WP login files (which are just theme files) then does this mean they are getting access to the FTP and making their hacks there? If they are getting into FTP then why wouldn't they just remove all docs?

Any insight would be greatly appreciate it. While I appreciate the billable hours to find/remove this code every few days the client isn't as excited about it as I am.

A: 

Update to latest version.

Shawn Simon
it is running on latest install.
HollerTrain
+1  A: 

You can try installing...

"Akismet" Plug-in

WP-SpamFree

Brant
it is using Akismet. That is only for comments tho
HollerTrain
It could be one or all of 4 things. 1. If you're using an off the shelf theme it could have a backdoor. 2. Your credentials are compromised and you need to reset your WordPress user password. 3. Your ftp credentials are compromised. 4. Your database connection credentials are compromised.
Brant
for 1., how would you be able to pinpoint where the backdoor would be?
HollerTrain
I would check with the database first. I had someone register and then add a comment which injected code into my template. The code then started to add ads/links into my widgets. I removed the user and then added WP-Spam.
Brant
+1  A: 

then does this mean they are getting access to the FTP and making their hacks there?

Likely yes. There are a lot of automated hacks of sites to include scripts/iframes pointing at security hole exploits.

These exploits typically install a fake-antivirus program and other trojans, including, often, FTP password stealers. These compromised FTP accounts are then used to infect other sites in the same way.

So, you need to ensure any and every machine that is used to access the FTP site is totally clean. Don't trust one single anti-virus to say you're clean, because today's anti-virus is utterly useless at catching the wide range of trojans out there today.

Especially don't trust an antivirus that claims to have ‘cleaned’ an infection, because it is very likely it hasn't cleaned everything. If you find a trojan or have at some point recently had an AV find a trojan (that isn't a false positive, another huge problem of today's hopeless anti-virus software), it's time to reinstall the OS because that's the only way to be sure.

Then change the passwords again, worry about all the other passwords of yours it might have stolen, and finally migrate to SFTP for uploading your files. FTP is an insecure ancient relic that nobody should still be using for admin in this century.

(Another possibility would be that the host itself was hacked, if you're sharing a server. Check other sites on the same machine that aren't accessible through your FTP account and see if they're affected the same.)

If they are getting into FTP then why wouldn't they just remove all docs?

Where would be the profit in that?

The vast majority of exploits out there today are from criminal businessmen after users' cash, not hacker kids doing it for fun.

bobince
wait. "it's time to reinstall the OS because that's the only way to be sure." - do they now have access to my OS???
HollerTrain
Well, if the compromise has happened because they're running a trojan on your client machine (which has yet to be determined), then yes, they have admin level access to that machine and at that point you can never be sure that OS installation is clean ever again (there might be rootkits you can't immediately see or other trojans AV cannot find). That means replacing the OS installation with a new install.
bobince
+3  A: 

There's an excellent article (which I'm sure you've already seen) which covers this topic in depth.

Joe