Site hacked

[Brian]

My site got hacked yesterday and they injected p0rn links into some pages and also put 100's of porn HTML and redirects in my DIR's.

NickJ said it was accessed (Cpanel) with these IP's
86.149.17.234
59.161.47.187
212.183.227.130
200.55.109.88
190.72.166.212
81.184.151.235

Are these all proxys or waht ? What can be done to report these guy ? Its a Government (allbeit local Gov) but surely tehy can get punished for it ?

Is there even a wway to change my default FTP port to something obscure that only I would know so they cant upload stuff ?

[WelshTom]

86.149.17.234 - abuse@btbroadband.com
59.161.47.187 - bitbucket@ripe.net
212.183.227.130 - abuse@ono.com
200.55.109.88 - bitbucket@ripe.net
190.72.166.212 - bitbucket@ripe.net
81.184.151.235 - ripe-tech@ono.es

Please use the above contacts for abuse complaints.

[Brian]

Thanks, just got around to doing that.
What about having my FTP on an obscure port ?

[WelshTom]

What type of web hosting do you have?

VPS, shared hosting etc?

[eUKhost.com]

Originally Posted by Brian

Thanks, just got around to doing that.
What about having my FTP on an obscure port ?

This is what I could see from FTP logs on the server :-

Apr 10 02:59:06 hawk pure-ftpd: (clayton@59.161.47.187) [NOTICE] /home/clayton//public_html/downloads/wallpapers/backup/world-record-cock/hotel-allegro-resort-papagayo.html uploaded (30382 bytes, 3.48KB/sec)
Apr 10 02:59:24 hawk pure-ftpd: (clayton@59.161.47.187) [NOTICE] /home/clayton//public_html/downloads/wallpapers/backup/world-record-cock/dildo-butt-plug.html uploaded (29213 bytes, 2.78KB/sec)
Apr 10 02:59:41 hawk pure-ftpd: (clayton@59.161.47.187) [NOTICE] /home/clayton//public_html/downloads/wallpapers/backup/world-record-cock/gay-man-peeing.html uploaded (28854 bytes, 2.64KB/sec)

You had weak FTP password and someone managed to hack your FTP password to download - inject - upload on your website.

[WelshTom]

Originally Posted by eUKhost.com

This is what I could see from FTP logs on the server :-



You had weak FTP password and someone managed to hack your FTP password to download - inject - upload on your website.

Lol, I don't think it's a good idea to post that publicly on the forums :P

[Brian]

All passwords have been changed, so its far from weak now. But I was thinking what if FTP was on a different port would that not make it impossible to upload stuff, no ?

[WelshTom]

Well, this is only possible if you have a VPS or Dedicated Server?

[eUKhost.com]

Originally Posted by WelshTom

Well, this is only possible if you have a VPS or Dedicated Server?

Thats right. FTP port change will stop cPanel File Manager as well. We can set IP based permission for SSH, FTP, cPanel & WHM access on a VPS or Dedicated Server, but such settings cannot be done on a shared hosting server.

[Brian]

OK well I only repaid for my package in Jan so ill see how much I have left in teh budget to do a VPS. Are they hosted in the US too ?

[WelshTom]

Nope, VPS and Dedicated servers are situated in the UK.

Edit: However (although I'm not sure), eUKhost may be able to set you one up in the US if that's what you want.

[Brian]

I can only do US mate.

[Brian]

Spoke to Danny in sales and he said they have some in the US. So off to see the City Manager on monday to see how much we have left in the budget.

[eUKhost.com]

Originally Posted by Brian

Spoke to Danny in sales and he said they have some in the US. So off to see the City Manager on Monday to see how much we have left in the budget.

There should not be any problem on hawk if you keep on changing your FTP password once in a month. Hacker managed to login in first attempt so he must have managed to crack or sniff your password easily. If he had attempted to login with wrong credentials for 3 times then he would have got blocked on the server.

We maintain multiple backups of your account and you can download one backup once in a month from cpanel control panel. please PM your old password as I would like to know how someone could access your account so easily.

[Brian]

PM sent .

[eUKhost.com]

Originally Posted by Brian

PM sent .

got it

There should be at least one upper case character and at least one special character in your password. That makes it impossible for hackers to crack your password.

Passwords with same case and numbers can be cracked easily using Brute Force tools.