Thread: One of my sites was hacked.!!!!!!!!!!!!!

Question One of my sites was hacked. I'm looking for help to find out the reason.

Greetings.

It seems a hacker got access to my server or ftp account and he ran a script that put a piece of ENCODE PHP code at the beginning of all .php files in my server. I'm looking for help to interpret the code to be DECODED.


Someone expert in PHP and Security could please help me to find out what this script do? how PHP code DECODED?



Thanks a lot for any help!!!

they usually use some method like base64_encode()

If your site was hacked, I personally think you should contact your host. The best thing they can do for you is to recover your files and delete your account and then remake it.

Also look into a more secure host too. I haven't been hacked or had security issues with myhosting.com at all. And thank god because I own a business online where people use their credit cards.

i think he is right. u should go with u r hosting company....

I was recently hacked also and my host recovered recovered the files and databse before me straight away so definitly worth asking them

Not always the hosts fault, but can often be. I've known of this type of hack being performed on web servers that have not been configured securely.
Although, there could be a hole in your scripts, CMS, etc. and/or file permissions (although a good host would nullify the file permissions security risk).

Check the permissions on your scripts/files. Which user and group owns them? If it is the user 'nobody' this looks like a poorly configured server.
Do you need to change permissions on your directories to 777 to upload files to you server?

Sort out your host issues, then worry about the code. You should also be keeping backups of your sites.

I couldn't agree more with all the posts above. Just another reminder; always have a file back up, and secure your login details to avoid hacking issues next time.

wondering what happened to the hacked site now and how he fixed it... I'm planning to run a new website with sensitive data so I wanted to be very careful on this one.
thanks.

its not a big deal, most of the web hosting companies take daily backup, just make your self calm and call your web host

just change the username and password of your server and reload your website...

Be aware of techniques of hacking??
Vulnerability scanner
Trojan horses
Viruses
Worms
Key loggers

Jaydee, if it's a business site, hire a security expert to check the site's code and fix any security holes. Then hire a security firm to do periodic (at least monthly) checks on the site for vulnerabilities. (They change constantly - what was secure 6 months ago may not be now.)

Always keep a local backup of all the files on the site and your database. (The easiest way to keep a database backup is to cron a database backup every day.) then map a local drive to your site's FTP address and make daily changed-files-only backups of that drive. Back up to a dated directory, so you have at least a week's worth of backup (more or less, depending on how soon you'd know if the site was hacked).