Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a russian site.

I'm assuming that one of the many, many wordpress installs has a plugin with a security flaw.

Two questions:

  1. Is it possible for a security hole in one plugin to allow someone access to other sites on the same server?
  2. What would a security flaw look like that might give someone access to the .htaccess file a directory or two above?

It's possible that the issue was someone else, that Dreamhost (my host) has bigger issues. But, I'm exploring the option that it's my fault.

Thoughts?

share|improve this question
    
Turns out it was a hack through the timthumb security hole. or at least i think it was. thanks for you help –  hookedonwinter Aug 24 '11 at 17:47
add comment

2 Answers

up vote 4 down vote accepted

Personal Opinion: I had the same thing with (mt) mediatemple twice last year. They told me/us that it was a wordpress issue, but it wasn't. I heard the same from dreamhost last year. So: don't think about it too much, just remove the hack and blame your host (again).

Anyway: You could read this thread. If your DB got "infected": There's also a link to the plugin I wrote to remove the inserted links from my database. Give it a try.

share|improve this answer
    
Thanks, I'll give it a read. –  hookedonwinter Aug 23 '11 at 2:32
add comment

I agree with kaiser , that MT hack was a bit of a fiasco, and often a host is not willing to spend the $$ to find the attack vector so they start laying blame around. Proprietary host systems make it hard to figure out on your own (unlike hosts that use cpanel, webmin, phpmyadmin, etc ).

To answer your questions:

  1. Might be possible, but this depends more on your host configuration than any specific WordPress exploit. Compromised sites should not allow any directory traversing.

  2. Impossible to say but my hunch is root access through a compromise on your own computer or your host.

ps. Is this a shared host, VPS, cloud ?

share|improve this answer
    
Thanks. It's a VPS. –  hookedonwinter Aug 23 '11 at 2:31
    
Managed by them (like using cpanel) or a bare bones one? –  Wyck Aug 23 '11 at 2:33
    
Using panel, mostly. I do a few things via shell, but it's mainly done via their admin panel –  hookedonwinter Aug 23 '11 at 2:36
1  
Well they might have comprised your shell access by having a virus or mitm attack on your comp/laptop, another thing you can try is a reverse DNS on your server IP to try and contact other people on your host ( if VPS is shared). Also since you have shell access look at you logs, cycle through the last 20 commands, check for file changes, etc, etc. –  Wyck Aug 23 '11 at 2:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.