Call for a Free Website Security Review (619) 479-6637     Hack Repair Testimonials Read more five star service reviews?

Website Malware andHack Repair Services

"Repairing Hacked WordPress Websites since 2012"

WordPress security

Website Security in The New Year 2021 – Are You A Cat Herder?

| | Leave a Comment

As we all head into the new year, if you implement the below strategies you’ll greatly reduce the likelihood your account will be compromised in 2021.

Are You A Cat Herder?

1. Segregation*
2. Monitoring
3. Regular updates
4. Backups

  • If you choose to not segregate your WordPress installations to separate accounts the risk your hosting account will be compromised will be exponentially greater this year.

 

 

Are you still “herding cats” like it was 2006?

 

As an expert cat herder, I can help you with your cat herding problem today.

 

#wordpress #infection #hackrepair #websitesecurity

What’s a Web Shell and Why Is My Website Being Repeatedly Hacked?

| | Leave a Comment

“What’s a web shell?”

Most hacked websites have one or more web shell scripts added either during or after the site has been compromised.

Malicious backdoor scriptsWeb shell scripts, sometimes called backdoor scripts, often include a visual interface that may be used to upload, rename, copy, move, or edit files. These scripts may likewise be used to view, edit, or download a website’s database.

Not all web shell or file manager scripts are malicious. A website designer may use these types of scripts legitimately to add administrator users to a WordPress website, edit theme files, or make website backups.

Backdoor scripts may be named anything, though, within a WordPress site, these types of scripts usually stand out from the core WordPress files. They may have file names like module.php, users.php, or have random letters like fnrt.php.

Below are examples of web shell scripting. Notice how some hacker scripts may be readable while others may be encoded or obfuscated? Either way, if a script’s code looks malicious, it probably is. Examples:

1

Web shell code
Click image to enlarge

2

hacker web shell obfuscated code

 

Why Is My Website Being Repeatedly Hacked?

Now that you have a better idea of what a web shell or backdoor script looks like, let’s discuss why your website might be repeatedly hacked.

wordpress other directories

With respect to WordPress. Hackers are often quite good at hiding their malicious scripts in places you might not think to look. For example, I often find web shell scripts within image directories or other directories not associated with WordPress.

If you believe your site is compromised, be sure to check whether other directories have been added within your website hosting account, outside of the usual wp-admin and wp-content, and wp-includes directories. See the example at right.

Likewise, if you have more than one WordPress website installed within your hosting account, assume all are hacked. An analogy I like to use with new clients: “If a burglar breaks into your house, is he likely going to just hang out in your kitchen, eat all your cookies, and then leave?”

Just like the hiding of scripts within unassociated directories, I’ve seen hackers compromise a hosting account using known script exploits within one WordPress installation but leave that website remarkably unscathed malicious-scripting wise. Why? The hackers’ general hope is that you’ll leave the apparently unhacked website alone and only clean up the obviously hacked WordPress installation. This leaves the hacker an “open window” for future attacks.

We fix hacked websites

Let’s summarize what I’ve covered here today. First, nearly all hacked websites will have web shell scripts installed. These scripts allow the hacker ongoing access to your hosting account. And second, be aware that a hacker rarely hides these backdoor scripts in plain site, so be sure to consider every directory within your account as a potential hiding place.

Enjoy!

 

WordPress Symptom Hunting, Malware Removal Services and the “Anyone Can Register” Hack

| | Leave a Comment

WordPress Anyone Can Register

Today’s WordPress hackers are smarter.

Many malware removal services focus on symptom hunting instead of providing complete website security.

By symptom hunting, I’m referring to the use of automated scanners to search for and remove malicious scripting from within website files. A number of free WordPress plugins provide the same level of symptom hunting and malicious code removal as many paid services.

While this outdated approach for cleaning hacked websites was standard in 2018, WordPress hackers are much smarter today.

In my experience, today’s website hackers are fully aware of the automated tools and scanners used by many website hosting companies and malware removal services. Hackers are learning to circumvent these tools using a variety of clever techniques.

Case in point, most of the hacked websites I clean and secure as part of my job at HackRepair.com are multi-layer hacks.


Below are the most-common to least-common layers of hacking I find within most hacked websites:

1. Malicious PHP code injection
2. Malicious or edited posts
3. Javascript code injection
4. WordPress feature manipulation
5. Web hosting company account changes
6. Damage to a Website reputation


1About malicious PHP code injection. Website redirection or malicious content injection is the most common symptom observed when a website is compromised. Malicious code or backdoor scripts may likewise give hackers complete file and database access to the account compromised.

These backdoor scripts and code injections are the low-level “symptoms” most free scanners can locate and easily remove.


2About malicious or edited posts. Blackhat SEO hackers may add or edit posts or pages to promote other websites or services.

Automated scanners, built for files-only inspection, cannot locate malicious website links. And scanners that do include link-checking within the website’s database can only locate malicious text or malicious website addresses.

Note: Not all links or text added by Blackhat SEO hackers are malicious, so a visual review of all pages or posts is necessary.


3About javascript code injection. Unlike malicious PHP code injections, malicious javascript code may be injected into Malicious Javascript Code Samplenearly every type of file and into a website’s database tables as well. This poses a particular challenge for automated scanners, since javascript code may be compressed or encrypted in a variety of ways.

Most automated scanners cannot distinguish the difference between legitimate and malicious javascript coding.


4About WordPress feature manipulation. WordPress feature manipulation is another method hackers use to side-step automated scanners and malware removal services.

Anyone can register hack

Below is one of many possible WordPress feature manipulation hacks to watch out for:

By checking the “Anyone Can Register” box and setting the “New User Default Role” to Administrator, hackers may re-add themselves as an administrator any time they choose.

Note: Since WordPress feature settings are valid options within WordPress, there is no way to correct these settings without human eyeballs and human decision making.


5About web hosting company account changes. Because a website may be displaying all of the above three symptoms, one can’t discount that hackers may have gained access through the hosting company’s billing or site management control panels as well.

Once a website account has been compromised, a hacker may, for example, add or edit FTP accounts, add cronjobs, gain access to email accounts or settings, and edit domain name settings to name a few.*

Note: A complete top-down review and updating of all website account hosting settings must be completed following all website hacking incidents.


6About damage to a website’s reputation. A number of online services like Google search, McAfee SiteAdvisor, Web Very Riskyof Trust, Norton Safe Web and others may both “index” manipulated content or mark a compromised website as malicious. Many of these services will not remove a bad reputation mark without a manual request for review.

Note: A visual review of search engines and security monitoring services must likewise be completed following all website hacking incidents.

 

Subtext…

Removing the symptoms of malware from a hacked website is only one of many steps required to fully secure a hacked website.

 

If you would like a free consultation by phone on the steps required to better secure your website hosting account please feel free to call me anytime here in San Diego, California.

Jim Walker
(619)-479-6637

 

And a warm Thank You out to the folks who helped me in proofreading and editing this article: Chris Bourne, Corey Kretsinger, Travis Perreira and all the other wonderful people who helped in clarifying my scribbles.