4 ms·
I just spend half day cleaning client's website from intense attack targeting outdated timthumb vulnerability. Attacker discovered inactive old theme (canvas) w
by gesman 13y ago
I just spend half day cleaning client's website from intense attack targeting outdated timthumb vulnerability.
Attacker discovered inactive old theme (canvas) within website, scanned for thumb.php and planted external malicious PHP script inside website.
Then through that planted malicious script - infected about 100 of other PHP files overwriting header of each with malicious code.
This type of attack couldn't be cleaned up just by reinstalling wordpress as attacker could use any of newly infected files to re-infect the whole site again.
Luckily her website was hosted at http://hostrum.com http://hostrum.com where she had a detailed report of all suspicious files that are suddently appeared.
Lessons:
1. Make sure your hosting company has realtime malware notification and protection. Very little number of hosting companies do that.
2. Do no keep uninstalled old themes or old plugins - they can be used as a backdoors into website. Delete them if not used.
- druiid 13y agoJust as an FYI, those attacks are fully automated. There wasn't really some guy on the other end doing this. Had a client have this same thing happen to them and the request to re-infect kept coming in long after the initial issue was resolved. Another good thing to do which will disable 99% of these kind of attacks, is disable the following PHP functions: disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source There's very, very few scripts which actually need these, and if you run across one that does... you probably shouldn't use it anyway.