Hackers on my website

Hi, first time poster here, hope I'm in the right thread topic!

I need some help here!

Yesterday morning a hacker somehow got into my index page of my website (www.hotrodmama.com) and changed it to their page. It said "Hacked by Warrior, everythingforTurkey". Thankfully I had a backup of my index page and uploaded it back into my ftp site and overwrote their coding. Everything seemed fine, I ran Norton on my website and it all checked out okay.

This morning I woke up, only to find that they had hacked it again. This time a different picture of a communist flag was on there, but the same wording "hacked by warrior", etc. Again, I overwrote their coding with my backup and it's all fine again. Also, I noticed that when I do a websearch for hotrodmama.com, the first thing that comes up is this 'hacked by warrior, everythingforTurkey" link. Only it links to my website.
I also did a websearch on the hacked by warrior, and hundreds of sites they hacked came up.


My site is my livelyhood for me and my 2 children. When it is not working, or if a customer tries to view my site and this hacker stuff is up there, I obviously don't make any sales. Also with the websearch on my site saying 'hacker', I am sure that that isn't good for my business either.

So my question, and I am VERY desperate, is if there is some sort of free html or script code I can enter on my index page so they can't hack it again? I am not very computer smart, but I did my site with basic html coding using homesite 5.0.


Any ideas on what I can do to prevent the hackers from doing more of the same damage, or any way to make it where I don't have to check my website every 5 minutes to make sure everything is running okay?



Thanks so much for listening to me vent!

Coco :)

Are you hosting the site yourself, on your own equipment or is your site hosted by a web hosting provider?

Sounds like the attacker is using a flaw in an unpatched server to gain access and 'own' the page...

My server is www.isgcomm.com, been with them since 1998 and this si the first problem I have even encountered with them.

I changed my passwords on my ftp site and on my account page on isgcomm.com too. I wasn't sure if that had anything to do with anything.

Quote:

---

Originally posted here by misscoco
My server is www.isgcomm.com, been with them since 1998 and this si the first problem I have even encountered with them.

I changed my passwords on my ftp site and on my account page on isgcomm.com too. I wasn't sure if that had anything to do with anything.

---

Changing your account passwords was my next suggestion, so I'm glad you did that. Now, let me ask you this, is it possible that the workstation you use to build and upload your webpages has been compromised? You said that you ran Norton on your website - do you mean your local PC? If your local PC has been compromised, it is possible that there is a keylogger running and sending information back to an attacker - if this was the case, then changing your passes, etc. would be useless because the new passes would be sent right back to the attacker.

Have you contacted your webhost and informed them of the issue yet?

Also check if there are newer versions of any third party scripts you are using, things like shopping carts, phone book type things are often used as exploits.

For example the miscreant may have used a known exploit in a shopping cart php script that allows him to upload files to your directory on your webserver.

This guy seems pretty popular so I wouldnt take it personally...

Contact your web service provider as well and let them know, it could be something on their end that needs to be patched and is something they need to be informed of.

I took a quick look at your site and it seems to be all html. This to me means that it probably isn't any of your code that is allowing the attacker to get in.

I'd take mavericks suggestions to check out everything on your end first so that you don't have egg on yoru face later. Then I would contact the hosting company and tell them they had an intrusion on their server and toss the ball in their court. Chances are you don't have access to much on the box that its hosted on and thus don't have much control over the security there. You are responsible for secure code and a secure password. The remaining security of the box is up to the hosting company. If they decide its not their problem, then I'd find a new hosting company.

I just purchased the new homesite 5.0 program about 3 weeks ago, and I haven't updated my website for several months. My current computer was purchased in march of this year and I haven't added any new programs other than the homesite and my ftp pro uploading program. BUT, when I purchased the new ftp software and installed it, all of my old information was still on it from the previous version I had of it on my old computer. make sense?

When I ran Nortons, I did a complete scan on my computer and also on the saved html pages that I have in my ftp program. This computer has never had a virus, BUT my old computer died in march (I'm sure it could still be fixed, I just wanted a new computer) from what I believe was spyware (endless pop-up ads everywhere), I'm not sure though as I never had it checked out.

I sent 2 emails to my host, one yesterday, one today, neither have been responded to yet.


Thanks for listening to me babble!!

hopefully, if its a server-side issue, they will fix it quickly.

This being your livelihood, i'd hate for it to have a drastic effect on current and future clientele.

That's what I'm hoping!! That it's the servers issue and not mine!!


I'm going to email my host again and see what's up over there.

Oh, i forgot to add that my shopping cart is paypal. If that means anything!

misscoco, with your permission...would you mind me running a few security scans/audits on your website? I can reply back to a private email address with the results. Note, I will NOT alter anything on the website, nor take down the website. As always, no charge ;)

Hello,

The most off the top explaination I can give after checking out your server is that they may have cracked your FTP servers user and password and then changed things around. Hopefully you are well aware that you have an FTP server running (at least it is attatched to the domain name you provided) and I assume that you use it to remotely change things on your website.

If a hacker has access to someones FTP server it is very easy for them to modify your webpage that you are hosting. My recommendation would be to change your username and password and lock it down by limiting the number of connections, disableing annoymous accounts, etc... The FTP server that your running (WS_FTP 1.0.5) IMO Isn't the greatest, try Serv-U instead if your running Windows, it's user friendly and is easy to lock down.

Also after you have done that run some type of tool that checks for rootkits (tools that hackers use to get into your system, kinda like putting a backdoor entrance to your house). I hope that helps and good luck. I'm sorry this happened to you.

Also, to chime in on what Radical is saying (good points), I would recommend using a secure password as well and not an easily guessed password (dictionary based). For example, instead of using a password of "password", use the password of "P@ssw0rd" instead. Note, do not use this actual password as it too is easily guessed.

Best wishes.

A weird one,

I have done a bit of research, and the vandalised sites seem to be scattered all over the place, with no apparent content similarity or connection; hell, they even hit my hometown's good pub guide? (in the middle of Yorkshire, UK)

They seem to be a Turkish emigre outfit based in the UK?

http://s2.phpbbforfree.com/forums/?mforum=ksteam

misscoco your "communist flag" is, in fact, the Turkish flag :D

Turkish intelligence suggests that WaRRiOr is known to them but is not the sharpest tool in the shed. Errrrrrrrr he/she is not in the top 50 ;) I would guess some sort of Bot to collect vulnerable sites then attack a few in each country. Interestingly, the sites all seem to be in NATO/SEATO/EU aligned countries.

This makes me wonder if it is not an attempt by one group of website defacers to implicate/discredit another. I have heard that there is great rivalry between some of them.

I guess that you were just unlucky.



:)

Hi nihil,

Or is it Sherlock Nihilholmes :D

Eg ;)

DAMN! No kiddin! Someone did their homework :)

Hi Folks,

I tried the usual Whois and Traceroute scans, but all I seem to get to is an outfit in NYC, and Traceroute shows a lot of "bogus rDNS", "fraudulent rDNS" and "no rDNS" at the end of the trail.

I don't believe a word of it :D

Hmmm...I see what you are saying nihil
Im getting
12 32 ms 33 ms 32 ms o3-2bd1.dfw002ap01.yipes.com [66.7.141.42]
13 33 ms 31 ms 31 ms 66.7.165.37

Yipes.com...hmmm..who that be?

Hi Wildred,

OrgName: Yipes Communications, Inc.
OrgID: YIPS
Address: 114 Sansome Street
City: San Francisco
StateProv: CA
PostalCode: 94104
Country: US

NetRange: 209.213.192.0 - 209.213.223.255
CIDR: 209.213.192.0/19
NetName: YIPES-BLK1
NetHandle: NET-209-213-192-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.YIPES.COM
NameServer: NS2.YIPES.COM
NameServer: NS3.YIPES.COM
Comment:
RegDate: 2000-04-13
Updated: 2001-06-29

TechHandle: IY10-ARIN
TechName: Yipes Communications, Inc.
TechPhone: +1-877-788-4662
TechEmail: [email protected]

OrgAbuseHandle: ABUSE21-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-303-785-4450
OrgAbuseEmail: [email protected]

OrgTechHandle: IY10-ARIN
OrgTechName: Yipes Communications, Inc.
OrgTechPhone: +1-877-788-4662
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2005-08-18 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

This stuff is all over the place..............proxies, owned or whatever I guess?

Here is a fraudulent rDNS:

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

ReferralServer: rwhois://rwhois.level3.net:4321

NetRange: 63.208.0.0 - 63.215.255.255
CIDR: 63.208.0.0/13
NetName: LEVEL4-CIDR
NetHandle: NET-63-208-0-0-1
Parent: NET-63-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.LEVEL3.NET
NameServer: NS2.LEVEL3.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1999-05-28
Updated: 2001-05-30

TechHandle: LC-ORG-ARIN
TechName: level Communications
TechPhone: +1-877-453-8353
TechEmail: [email protected]

OrgAbuseHandle: APL8-ARIN
OrgAbuseName: Abuse POC LVLT
OrgAbusePhone: +1-877-453-8353
OrgAbuseEmail: [email protected]

OrgTechHandle: ARINC4-ARIN
OrgTechName: ARIN Contact
OrgTechPhone: +1-800-436-8489
OrgTechEmail: [email protected]

OrgTechHandle: TPL1-ARIN
OrgTechName: Tech POC LVLT
OrgTechPhone: +1-877-453-8353
OrgTechEmail: [email protected]

It seems to leave London (UK) hit San Francisco, then go to this place in Colorado (?) then go back to San Francisco?

I am glad I am not paying the taxi fares :D

LOL Shoot Im so cross-eyed in tracert that I forgot what the hell the original domain name was :) ahhh sleep is a good thing....now if only the wife would give me a backrub lol

Wow nice tracing. How do you do that? Al I can do is whois someone by there ip.
(talking to the owner of that site now) Seems to me that you got attacked by a defacer. Maybe its a try out for a group or just showing of theire skills. If nothing else happend they will quite in a while. I would let wildred do some scans and testing. I don't know much about server but maybe you can install it with a firewall if thats possible. By the way are your log files deleted?

Quote:

---

Seems to me that you got attacked by a defacer.

---

Uh wow...

Quote:

---

Maybe its a try out for a group or just showing of theire skills. If nothing else happend they will quite in a while.

---

This guy claims to have been defaced twice.

Quote:

---

I would let wildred do some scans and testing. I don't know much about server but maybe you can install it with a firewall if thats possible. By the way are your log files deleted

---

This person has already mentioned that they aren't the ones hosting.

Here you go DakX... http://www.smartwayreading.com/

Nihil

Your "Fraudulent rDNS" records are not normally fraudulent. Sam Spade etc. reports them as that because the rDNS record is not resolved by the authoritative DNS server for the netblock. For example, internally I resolve xxx.xxx.xxx.xxx to firewall.mycompany.com yet the IP address is owned by my ISP. When I do a tracert in Sam Spade it reports that the first hop is "firewall.mycompany.com fraudulent rDNS" because the resolving server is one within my network and is not the authoritative server for the netblock. It's not fraudulaent - but it could be.... ;)

Wow, me being part turkish, am ashamed that they would stoop so low...

I don't suppose trying to find them is gonna help, even if you do, and he's in turkey, the turkish government won't likely do much...

What you should do, and they have been repeated 14 times already, is:

1 Change FTP password to a secure password... Names, birthdays, sports teams, etc, are not secure passwords...

2 Full PC scan with AV and Anti spyware/adware...

3. Contact Hosting Service and ask them to install all updates and patches!!

Good luck!

BTW, the reason your page on google is still messed up is because google's spiders have spidered the hacked content and not your fixed content... Time will fix this when google spiders your site again...

It was probably a botnet attack, and they nailed the same server twice since they didnt patch whatever exploit the first time....

Specialist: Is that GG Allen? awesome.

I did a Google search. It returned this:
http://www.google.com/search?q=%22Ha...thingforTurkey

This hacker has been pretty busy lately. And many of these sites haven't even been repaired, apparantly. I wonder if those other sites are also hosted by your webhost. If that is the case, there's nothing you can do about it because THEY are hacked, not you...

Hacking into a webhost isn't very difficult, btw. One method for a hacker would be to register for a website on that host themselves. Or they just hack into an existing webpage on that host. Once they have access to a web account, they can install certain files on this host in an attempt to gain more control over it. In the worst case, they can use their single web account to defile everything hosted on this webserver. And they will also be able to remove all traces of their actions too.

While using a webhost for your site will save you the trouble of serving the site yourself on your own computer, there is of course an additional security risk in this all. It's just a matter of attacking the weakest link. No matter how secure you make your own site, if another website on that server happens to have a very weak security then it will happen again.

Anyway, be glad that this hacker just defiled your page. They could have done something that's a lot worse...

WOW for someone who just got 0wn3d...misscoco sure replies fast....NOT:)