Hacked

  • Hi,

    Two of my client’s websites were hacked today with just a post added to their site with the title ‘Hacked By SA3D HaCk3D’. I did a search for this on Google and dozen of results come back with the same post title of other sites with the same injected post.

    As far as I know my client’s sites are secure with tried and tested plugins etc. and because of the amount of sites with the same posts this makes me think it’s a WordPress security issue? Has anyone else had the same issue and has the vulnerability been found as would love to know what caused this?

    Regards,

    Jim Isles

Viewing 15 replies - 1 through 15 (of 20 total)
  • Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    That particular hack is usually the result of failing to update to 4.7.2 after the problem in 4.7.1 was announced on Feb 1 (a week after 4.7.2 was released).

    Did you delay updating to 4.7.2?

    See https://www.ads-software.com/news/2017/01/wordpress-4-7-2-security-release/ and https://make.www.ads-software.com/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/

    Thread Starter jesseslam

    (@jesseslam)

    Hi Steve,

    Ah OK glad that’s the cause wasn’t sure if it was a plugin or something. I tried to find something out about this hack but am just getting 100’s of other hacked site back in the results.

    I’ve set up and host a lot of WP websites so not done them all yet. A lot do the auto update but I always disable this for my more complicated site as auto update causes massive issue with plugins and breaking sites etc. Will get them updated ASAP.

    Jim

    hi!
    is this problem from email? or this hack is with full access to the wordpress and i must change all passwords like WP and SQL?
    THX

    I just had a website with the same issue. I am doing some more investigating.

    Following post.

    I had the same problems with two of my websites. I updated wordpress and the extension. Did you know if the hacker put some bad codes on your websites ?

    Yes it looks like he did, however after the update to the latest version of WordPress, i rescanned with SiteLock and the scan found no malware (presuming it was taken care of).

    I hate people who do this kind of thing, although it is fascinating at the same time.

    @stinger101, the course of recovery can vary from case to case. We’ve seen that some sites were able to recover the previous version of the overwritten post (typically post ID ‘1’) by restoring a previous revision from the edit post menu. However, most cases require a database rollback to a prior backup in order to restore the full integrity of the defaced post, as the data has actually been overwritten in the database in most cases (the data no longer exists in the live site).

    @veredico, the iterations we’re seeing from this particular defacement appear to have originated from a vulnerability in the REST API in WordPress 4.7 and 4.7.1 involving unauthenticated permissions escalation. The silver lining to an UNAUTHENTICATED permissions escalation is that credentials aren’t used in the execution of the attack, so passwords are unlikely to have been compromised. One caveat to this is that we are aware of a separate attack (not the SA3D iteration) through this same vector that has been identified as able to capture database credentials and a number of other pieces of information. To cover the bases, call this password change day and give everything a shuffle for good measure!

    [ Signature moderated ]

    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Jan Dembowski.

    @logankipp So should I do a rollback of the database AND site files? it doesn’t look like any of my posts are messed up or overwritten, but i’m not sure if there are hidden things in the php that i’m not seeing. Any way I can check? I also submitted a ticket to you guys to help look into this and address.

    THANK YOU for your help!

    @stinger101, since you’re a SiteLock customer there are a number of factors I am able to determine through your subscription that allow me to provide this informed suggestion (I want to be clear that this may not be the best course of action for others). I am offering this assistance in good faith and without warranty.

    In your case I recommend that you:
    – BACKUP your current files and database.
    – Initiate the update to WP 4.7.2 if you have not already.
    – Once updated, perform an audit to see if any issues have emerged from patching (usually evident in the look and feel of the website).
    – Perform a quick overview of your posts and pages, with special attention to the post with ID ‘1’.
    – If any posts have been overwritten, visit the edit post menu to see if you can restore to a previous clean revision.
    – If no clean revision is present, restore from your last clean database backup. Current data suggests that backups prior to February should be clean.
    – Login to /wp-admin/ and initiate any database clean-up you are prompted to perform (you may not be prompted).

    Please let me know if you have any trouble.

    [ Signature moderated ]

    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Jan Dembowski.

    @logankipp THANK YOU SO MUCH! I’m SO glad I got a SiteLock subscription. I actually only renewed a couple months ago and i’m VERY glad I did now.

    I’ll perform the tasks you outlined and will let you know if I have any issues. I’ve already done a lot of those things, and so far so good – I think the update wiped it out.

    I had the same problem. As far as I know it was only on one page, but I’m still checking. I have also changed my PW and updated to 4.7.2. Hopefully, that will be the end of it. Except does anyone know who this moron is so I can go set him/her/it on fire?

    Same here. That stinker hacked through 4.7.1 on a blog post. There was no identifiable user account. Update to 4.7.2 and you should be good.

    I’m being told this will take hundreds of dollars to clear up and get my protection back up and working again. Is there a tool or something or do I need to hire someone to help clean it up?

    @leapfrogva, if the extent of the damage is limited to the defacement of a blog post or two, first back up the current database and files, then initiate the update to 4.7.2 if you haven’t already.

    Visit the impacted posts from the edit post screen to see if there is a revision history with the original content still present. If so, restore from there. If the original content is missing from the revision history, see if you have a database backup from before February. Your hosting provider may be of assistance in locating a backup if you do not have any backup plugins or services from a third party. Restore the pre-February database backup to the product site and login to /wp-admin/ to run any database clean-up you may be prompted for. In most cases this will resolve the issue with the defacement.

    Please let us know if following these steps were successful. If you’re not up to doing this yourself, there’s many vendors that offer remediation for this problem, including my employer SiteLock and several others listed at the codex’s FAQ My Site Was Hacked article.

    • This reply was modified 7 years, 9 months ago by Logan Kipp.
    • This reply was modified 7 years, 9 months ago by Logan Kipp.
Viewing 15 replies - 1 through 15 (of 20 total)
  • The topic ‘Hacked’ is closed to new replies.