{"id":343,"date":"2011-03-20T08:43:51","date_gmt":"2011-03-19T21:43:51","guid":{"rendered":"http:\/\/www.howden.net.au\/thowden\/?p=343"},"modified":"2011-03-20T08:43:51","modified_gmt":"2011-03-19T21:43:51","slug":"wordpress-hacked-and-issues-that-raised","status":"publish","type":"post","link":"https:\/\/howden.net.au\/thowden\/2011\/03\/wordpress-hacked-and-issues-that-raised\/","title":{"rendered":"WordPress Hacked and issues that raised"},"content":{"rendered":"

Wow!\u00a0 It’s been a week of WordPress hacking MySQL backups and google trawling.<\/p>\n

Late last week I was working on oscMax and getting along quite well when I went to write a blog entry and discovered that my blog pages had been converted to some islamic protest site.<\/p>\n

Now just to make one point clear I am indifferent to religion, whatever works for you is fine, just dont try to force me to follow you because you must be right!<\/p>\n

That said, this entry is about the crippling effect of a hack and links to what I read and used to rectify it.<\/p>\n

Things I did wrong:<\/p>\n

    \n
  1. WordPress was out of date an older 2.8.6 mu install (multi user because at one time I was going to host other blogs, but that has not happened)<\/li>\n
  2. MySQL backup had been failing for some weeks after I did a password change (I knew what it was but let it go as a minor concern that I would get to, eventually)<\/li>\n<\/ol>\n

    Things I had done right:<\/p>\n

      \n
    1. The area of the site that could be accessed was a sub-directory and the uploaded rubbish was contained within one directory<\/li>\n
    2. I have rsync backups of the application directory running on a schedule<\/li>\n<\/ol>\n

      So I firstly closed up the site, renamed the compromised directory and contacted my ISP support to check logs. Their logs rotate to quickly and one of the security team was over-zealous and ‘helpfully’ removed all the files that were compromised….\u00a0 without noting the date\/time stamps on the files for me to be sure of when the hack occurred. I had noted that the files I saw were consistent with only being in place within the previous 24 hours but as he did not keep a list I dont know what else(if any) he found and deleted.<\/p>\n

      I’ll write up some separate blogs on the various topics I encountered on this week long journey elsewhere, for the moment these are the references that I have used this week that I found helpful. Most from WordPress codex: <\/p>\n

      Have a read of this first (dont do anything, read & think first): WordPress FAQ My Site Was Hacked<\/a><\/p>\n

      Download the latest version of WP from WordPress Download<\/a><\/p>\n

      For multi-user equivalent do this after installing WP: Create A Network <\/a><\/p>\n

      When it does not work: Debugging a WordPress Network<\/a><\/p>\n

      Noting that I updated this section with one of my issues: Debugging a WordPress Network \u00ab Other Lesser Known Issues<\/a> <\/p>\n

      Have a read through this for ideas: Hardening WordPress \u00ab WordPress Codex<\/a><\/p>\n

      There are others that I am still reviewing, in particular the security oriented plug-ins, filter for the WordPress category for my latest posts on this topic.<\/p>\n

      My site is still not working the way I want and I found that the latest version for MU (or Network as it is now called) is apparently very dependent on Apache or other server settings. On SME Server it will not work (yet) while on my hosted site it works first time. Lost around 3 days on that issue alone.<\/p>\n

      Trying to reinstate the WordPress 2.8.6 mu from the WordPress Archives fails because the mu archive is the same as the WP archive. I’ve manually extracted the database tables\/entries that I needed. <\/p>\n

      And of course I have changed lots of passwords and done lots of chmod’ing to tighten up the access.<\/p>\n","protected":false},"excerpt":{"rendered":"

      Wow!\u00a0 It’s been a week of WordPress hacking MySQL backups and google trawling. Late last week I was working on oscMax and getting along quite well when I went to write a blog entry and discovered that my blog pages had been converted to some islamic protest site. Now just to make one point clear […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14,24],"tags":[],"class_list":["post-343","post","type-post","status-publish","format-standard","hentry","category-security","category-wordpress-links"],"_links":{"self":[{"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/posts\/343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/comments?post=343"}],"version-history":[{"count":0,"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/posts\/343\/revisions"}],"wp:attachment":[{"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/media?parent=343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/categories?post=343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/howden.net.au\/thowden\/wp-json\/wp\/v2\/tags?post=343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}