So in my quest to solve this mystery, I actually found some script that might be similar to one used to deface our sites: http://pastebin.com/raw.php?i=hcvPE8YV

Now my question is where do they usually run this? Do they run it inside the hacked server or their own PCs?

1 Answer 1


They run it on your server, just like any other script runs (including WordPress).

In the log you provided, it looks like the hacker knew your password. Perhaps you are using the same password on other sites, and he somehow gained access to one of them?

Always set different and complex passwords; combine a large character range; include special characters and so on...

  • I really like to believe he knows the password but these are not my personal sites, these are shared hosting clients' sites. All passwords are different. The logs show they hit wp-login right away like it's being run from a script. It is also worth noting that the root account was never used since I am always notified if there was a root login. The hacker appears to change the password first in the DB before he logs to WP directly through automated scripts not manually. How they edit the database password without root access is a mystery to me. Access logs don't show any trace of their IP.
    – IMB
    Aug 3, 2012 at 19:08
  • The only trace of their IP is only in the logs I provided, nothing more.
    – IMB
    Aug 3, 2012 at 19:12
  • Hacker appears to be a member of indonesiandefacer.org as I saw it as one of the referrers in the logs.
    – IMB
    Aug 3, 2012 at 19:13
  • then you provided partial logs; I don't see anything there that might suggest he changed your password trough another script Aug 3, 2012 at 19:47
  • Yeah that's the thing, there are no more relevant data aside from that.
    – IMB
    Aug 3, 2012 at 19:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.