TELL HN: Many sites at Bluehost got hacked today (including their CEO's blog)

Post by rumpelstiltskin » Mon, Jun 28, 2010, 1:46 PM UTC

epochwolf wrote: post #7

rumpelstiltskin wrote: post #4

Earlier quoted context omitted.

Maybe you should tell them to secure their wordpress install instead: 1. Put an IP lock on the login page via .htaccess so that it can't be accessed from anywhere else but your IP - this one change alone can stop a significant percentage of intruders. 2. Add this line to the .htaccess file at the top level of your WordPress install - deny from all - it'll make it harder for your database username and password to fall…

First off, thanks for giving out instructions for securing wordpress. > Maybe you should tell them to secure their wordpress install instead Hence the ":P", my comment was mostly in jest. > 3. Create an empty wp-content/plugins/index.html file - otherwise you leak information on which plug-ins you run It's better to just disable indexes on the entire site. That prevents anyone from poking around. Options -Indexes Fol…

Post by crikli » Mon, Jun 28, 2010, 2:49 PM UTC

Post by xinsight » Mon, Jun 28, 2010, 4:46 PM UTC

sucuri2 wrote: post #12

epochwolf wrote: post #3

Ouch. How many times do I need to tell people not to use wordpress? :P

These attacks are not Wordpress-specific. The CEO blog was running Wordpress, but every type of site got affected.

Post by xinsight » Wed, Jun 30, 2010, 1:02 AM UTC

andfarm wrote: post #16

xinsight wrote: post #15

Earlier quoted context omitted.

Indeed. If you use shared web hosting (like Bluehost) there are often hundreds of other websites running on the same server. It is trivial to write a script that runs with the permissions of the webserver to snoop other websites' files. Read the config files (wp-config.php in the case of Wordpress) and you can then access the database directly and wreak major havoc.

Note that this is only true if your host is running PHP using mod_php or similar, and they don't have safe_mode configured properly.