Call for a Free Website Security Review (619) 479-6637     Hack Repair Testimonials Read more five star service reviews?

Website Malware andHack Repair Services

"Repairing Hacked WordPress Websites since 2012"

blog

Website Security in The New Year 2021 – Are You A Cat Herder?

| | Leave a Comment

As we all head into the new year, if you implement the below strategies you’ll greatly reduce the likelihood your account will be compromised in 2021.

Are You A Cat Herder?

1. Segregation*
2. Monitoring
3. Regular updates
4. Backups

  • If you choose to not segregate your WordPress installations to separate accounts the risk your hosting account will be compromised will be exponentially greater this year.

 

 

Are you still “herding cats” like it was 2006?

 

As an expert cat herder, I can help you with your cat herding problem today.

 

#wordpress #infection #hackrepair #websitesecurity

TVCNet and HackRepair.com Instrumental in Fixing Longstanding cPanel Bug That Renders Server-Based Firewalls Useless

| | Leave a Comment

cPanel CSF Firewall Bug

 

One of the most popular software firewall options for cPanel servers is the ConfigServer Security & Firewall (CSF). In late 2019, a number of web server administrators began noticing that previously filtered ports like SSH, MySQL and others, would inexplicably become open to all.

 
As you can imagine, from a security standpoint randomly opening ports is a very bad thing. The randomness and difficulty in duplicating this CSF bug made the situation all the more frustrating.

This past week, server support staff at TVCNet with the help of HackRepair.com (yours truly), dug further into this reported bug after I had noticed a port that would normally be closed from public access was open and accessible. Below is a snippet of the support email from TVCNet submitted to cPanel:

“Hi,
I wanted to bring this up, as it has personally been driving myself and my coworkers insane for the last year or so, and I’m finally getting some true information about it.

I see this recommended knowledge base article when writing this, and it still refers to this CPANEL-29051 which is listed as fixed in WHM 90 release notes.

https://support.cpanel.net/hc/en-us/articles/360045152533-cP-Firewall-1-INPUT-is-added-to-Iptables-when-performing-modifyacct-API-calls (cPanel Login Required)

Fixed case CPANEL-29051: Add modify_firewall as an optional param to the modifyacct API call.

The above doesn’t appear to have anything to do with this actual issue with account modifications and the like creating this chain cP-Firewall-1-INPUT that opens up everything from SSH to MySQL to the world.”

 
The support ticket goes on to explain to cPanel technicians that when using cPanel and the Configserver Security & Firewall or CSF under certain account modification events, cPanel will unwittingly create a new iptables chain called “cP-Firewall-1-INPUT” and cause filtered ports to be re-opened, including SSH, MySQL, and other potentially vulnerable services.

 Following a lengthy review and demonstration by staff at TVCNet, cPanel staff were finally able to duplicate the bug, resulting in a new cPanel bug ticket, 33772. Below is the final response from cPanel to TVCNet:

Greetings again,
Thank you for your patience.

As a final update, I have published the  following article cP-Firewall-1-INPUT rules can re-open filtered ports when using CSF (cPanel Login Required) with a brief summary of this issue as well as submitted the requested outcome of being able to specify which ports cPanel adds via something similar to Tweak Settings. I recommend following this article for any changes that may be made as a result to this case. Please let us know if we can be of further assistance or if you have any additional questions that we may be able to address

 
Conclusion?
Now that cPanel has a full understanding of this particularly nasty cPanel with CSF bug, this ongoing problem with some cPanel Firewall setups will be corrected within the next week or so thanks to to the diligence of staff at TVCNet in running this bug to the ground.

What’s a Web Shell and Why Is My Website Being Repeatedly Hacked?

| | Leave a Comment

“What’s a web shell?”

Most hacked websites have one or more web shell scripts added either during or after the site has been compromised.

Malicious backdoor scriptsWeb shell scripts, sometimes called backdoor scripts, often include a visual interface that may be used to upload, rename, copy, move, or edit files. These scripts may likewise be used to view, edit, or download a website’s database.

Not all web shell or file manager scripts are malicious. A website designer may use these types of scripts legitimately to add administrator users to a WordPress website, edit theme files, or make website backups.

Backdoor scripts may be named anything, though, within a WordPress site, these types of scripts usually stand out from the core WordPress files. They may have file names like module.php, users.php, or have random letters like fnrt.php.

Below are examples of web shell scripting. Notice how some hacker scripts may be readable while others may be encoded or obfuscated? Either way, if a script’s code looks malicious, it probably is. Examples:

1

Web shell code
Click image to enlarge

2

hacker web shell obfuscated code

 

Why Is My Website Being Repeatedly Hacked?

Now that you have a better idea of what a web shell or backdoor script looks like, let’s discuss why your website might be repeatedly hacked.

wordpress other directories

With respect to WordPress. Hackers are often quite good at hiding their malicious scripts in places you might not think to look. For example, I often find web shell scripts within image directories or other directories not associated with WordPress.

If you believe your site is compromised, be sure to check whether other directories have been added within your website hosting account, outside of the usual wp-admin and wp-content, and wp-includes directories. See the example at right.

Likewise, if you have more than one WordPress website installed within your hosting account, assume all are hacked. An analogy I like to use with new clients: “If a burglar breaks into your house, is he likely going to just hang out in your kitchen, eat all your cookies, and then leave?”

Just like the hiding of scripts within unassociated directories, I’ve seen hackers compromise a hosting account using known script exploits within one WordPress installation but leave that website remarkably unscathed malicious-scripting wise. Why? The hackers’ general hope is that you’ll leave the apparently unhacked website alone and only clean up the obviously hacked WordPress installation. This leaves the hacker an “open window” for future attacks.

We fix hacked websites

Let’s summarize what I’ve covered here today. First, nearly all hacked websites will have web shell scripts installed. These scripts allow the hacker ongoing access to your hosting account. And second, be aware that a hacker rarely hides these backdoor scripts in plain site, so be sure to consider every directory within your account as a potential hiding place.

Enjoy!