4

My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a russian site.

I'm assuming that one of the many, many wordpress installs has a plugin with a security flaw.

Two questions:

  1. Is it possible for a security hole in one plugin to allow someone access to other sites on the same server?
  2. What would a security flaw look like that might give someone access to the .htaccess file a directory or two above?

It's possible that the issue was someone else, that Dreamhost (my host) has bigger issues. But, I'm exploring the option that it's my fault.

Thoughts?

Improve this question
1
  • 1
    Turns out it was a hack through the timthumb security hole. or at least i think it was. thanks for you help
    – hookedonwinter
    Aug 24, 2011 at 17:47

2 Answers 2

Reset to default
4

Personal Opinion: I had the same thing with (mt) mediatemple twice last year. They told me/us that it was a wordpress issue, but it wasn't. I heard the same from dreamhost last year. So: don't think about it too much, just remove the hack and blame your host (again).

Anyway: You could read this thread. If your DB got "infected": There's also a link to the plugin I wrote to remove the inserted links from my database. Give it a try.

Improve this answer
0
3

I agree with kaiser , that MT hack was a bit of a fiasco, and often a host is not willing to spend the $$ to find the attack vector so they start laying blame around. Proprietary host systems make it hard to figure out on your own (unlike hosts that use cpanel, webmin, phpmyadmin, etc ).

To answer your questions:

  1. Might be possible, but this depends more on your host configuration than any specific WordPress exploit. Compromised sites should not allow any directory traversing.

  2. Impossible to say but my hunch is root access through a compromise on your own computer or your host.

ps. Is this a shared host, VPS, cloud ?

Improve this answer
3
  • Managed by them (like using cpanel) or a bare bones one?
    – Wyck
    Aug 23, 2011 at 2:33
  • Using panel, mostly. I do a few things via shell, but it's mainly done via their admin panel
    – hookedonwinter
    Aug 23, 2011 at 2:36
  • 1
    Well they might have comprised your shell access by having a virus or mitm attack on your comp/laptop, another thing you can try is a reverse DNS on your server IP to try and contact other people on your host ( if VPS is shared). Also since you have shell access look at you logs, cycle through the last 20 commands, check for file changes, etc, etc.
    – Wyck
    Aug 23, 2011 at 2:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.