I’ve been hacked!
Archived post from 2013, recovered from my old blog. The technology described here is probably out of date. Original at the Internet Archive.
A beautiful, sunny Morning in Innsbruck has been suddenly disturbed by a SiteMeter weekly traffic report indicating unusual drop in the number of visits on my blog last week. I nervously navigated to the site and got an empty page with PHP errors.
Page wp-content/plugins/wp-insert/includes/essentials.php could not found wp-content/plugins/wp-insert/includes/pages.php.
No way! It cannot be true. I don’t have any automatic updates enabled, haven’t touch the blog for months (oh yes, sad but true) so how come it just broke? A quick analysis of the files and their timestamps clearly indicates that:
- pages.php is missing indeed
- the essentials.php has been modified 10th of March afternoon
- there is a number of files modified at the same time
- apache logs shows a number of requests to the modified pages from a single IP address
- Geo IP Tool shows that the IP comes from New York
- there is another suspicious set of files modified on 2nd of May last year
I had a feeling similar to that when someone has been in your house while you were out. The plan was quick:
- do a backup of your site
- remove the touched files immediately – that actually fixed the site
- remove the failing wp-insert plugin from the disk
- upgrade WordPress and all the plugins
- install Wordfence, a security plugin for WordPress and configure it
- review Hardening WordPress article and implement some of the advices
- hide in bushes with a binocular and watch…..
An update: the first Wordfence scan report just arrived. Several critial issues have been found including a malicious code placed in PHP files. Files deleted. Back to the bushes….