Sanjeev Sabhlok's notes on technology, hardware, gardening

Category: Website security

June 1, 2011

Hack-proof your WordPress installation and web server

Download the Word file that seeks to consolidate my – ongoing! – learnings here.

As a common user of WordPress software hosted on my own domain, I find web security to be my greatest problem.  

What are the vulnerabilities of WordPress and web servers?

Php software in which WordPress is written, is the key vulnerability. This leads to vulnerabilities in phpMyAdmin, dokuwiki, phpBulletin – which act as gateways to the UNIX shell and MySQL database. Also, many plugins create vulnerabilities, not being written by expert programmers. Since it is impossible to run a WordPress blog without using plugins (and php code), the whole thing is a SECURITY NIGHTMARE!

In general, methods of hacking apparently  include: Code injection, Web Servers, HTTP Methods, SQL Injection, CRLF Injection, Cookie Manipulation, Script Language Error, cross-Site Scriptng. The vulnerabilities of an ordinary WordPress user are so extensive that the ordinary WordPress blog is certain to get hacked. The wave of attacks occurring in the world is now almost out of control. See this excellent slideshow.

Solutions to protect your WordPress blog

Given that you can't master web security, do the following. These are band-aid solutions, and only provide a second-best alternative (to hiring professional help), but they will keep the blog going for a while.

[For ways to recover from a (frequent) WordPress disaster, click here]

Keep WordPress installation up to date

Apparently these guys are aware of how the WordPress loopholes are being exploited, and they try to resolve security issues with each update.

Install WordPress security software/ plugins

a)  WP Security Scan(which pointed out I had a number of security holes, particularly not having .htaccess files)

b)   BulletProof Security – this installs .htaccess files. If plugin directories are visible to external people they can crack the security loophole of the lowest security protected plugin (i.e. older version plugins). Once they can get in, apparently then can get shell access.

Watch out for "growing" web-disk

If your web disk (hard disk usage on the serve) is growing without explanation, that's a warning bell! Excessive use of monthly bandwidth is also a give-away.

Check where the "growth" is taking place

Use "Disk Space Usage" option in control panel to find out where the growth is occurring

Run the Clam AV anti-virus software from the control panel

Most hackers have installed phishing and other rubbish, including virus, on your server. This can be readily detected by this anti-virus software. It then neutralises all files that have been detected. Most importantly it will show you the locations of these directories, and you can search these places and remove the files. The kinds of viruses found on my server include:DoS.Linux.Blitz

Flooder.Bloop
Flooder.Nestea
Flooder.Rycol
Flooder.Slice-1
Flooder.Smurf-1
Flooder.Xess
PHP.Mailer-7
Spoofer.Midav

Run Webmail (Horde)

This will often show thousands of phishing emails that have bounced. The emails are important since they'll show up the locations of the attack files. Destroy the files.

Many examples of inserted code exist, but these were from recent emails:

freedomteam.in/blog/wp-content/forum-avatars/mailer.php

SQL injection attacks discovered:

Boss, there was an injected target on sabhlokcity.com/2011/03/review-of-geoffrey-millers-spent/?cid=21997&wpmp_tp=1&wpmp_switcher=desktop by 66.249.72.80

Boss, there was an injected target on sabhlokcity.com/wp-content/themes/whitehouse/single.php by 196.217.232.73

Boss, there was an injected target on sabhlokcity.com/2010/05/get-used-to-it-the-climate-always-changes by 200.107.238.156

Look for particular file types

Create an alias whereis='find ~/ -name', or just run find ~/ -name followed by the following file types
a) *zip*
b) mailer.php
 
Other dangerous file names I've found over the past few months include:
exploit.conf
cb.php
cur
case.edu
smurf6
s          
rc8
nestea
sl3
alpha
vadimI
slice3
bloop
sl2
smurf5
slice2
flood.zip

Check .bash_history 

Assuming you are using a bash shell, check the shell history.  It is possible that it will contain the steps the attacker took to setup a backdoor onto the system.

Change passwords

I've not done this much since it seems that most times it appears to me that hackers don't actually discover your password: they over-write it on the MySQL database. However, this is advised by a few people on the internet.

Learn from Google's web security website

Google operates a blog for Webmasters. Subscribe to it. Use this information to learn more about web security. For instance, this post.

Read/ subscribe to websites that provide hints on security:

Try using web security software

There is software that claims to detect security gaps in one's website. First, this yields a lot of technical jargon which few can understand. Second, one of these, in "attacking" my website to determine security gaps, hung up and never finished, creating gigabytes of stuff on the server. Be very careful while using these software!

 

FREE
 
PAID
 

 

How to recover from sql injection attack

 

Continue Reading

April 21, 2011

Dealing with a phishing attack

[Complete Word file]

That is when someone is using your website to attack other websites/ extract passwords, etc.
Use HORDE: The path from where these mails are bouncing is usually indicated in these emails.
Once identified first download, zip and backup these suspicious files – and save in E:\WEB-BKUP\WEB-ATTACKS which will be automatically backed up on Carbonite – in case there is need for an audit trail (I don't have backups of whatever was planted on our server prior to 10 April 2011). Apparently some of these files can provide info on the attacker's identity.
 
Then delete them from the website. Note that this does not mean they won't come in again! They are driven by a process that may source them from somewhere on the internet.
Make sure you delete and empty the Horde folder so that you can monitor if any other emails are bouncing. This is a very useful to detect whether the attack has been stemmed.
From the shell, check all zip files (the phishing attack usually puts in a zip file that expands into the fake website).
Continue Reading

April 20, 2011

Recovery from hacking or damage of blog

Despite taking great precautions your WordPress is almost SURE to be attacked today. Hackers abound. Be prepared to recover your blog!

Addendum. A hacker might not be able to prevent you from getting back into your blog (see steps below) but might put an offensive msg on your blog. That can be fixed by (a) install ANOTHER theme and see if it is visibile. That shows that your theme has been damaged. (b) Delete your old theme, and reinstall  a fresh copy. Activate it. Back to normal. 

 

[Complete Word file]

Step 1: Download and backup whatever you can

Start a download from FTP, just to be safe (if you can!). This should not be necessary, since you should have an active backup system, anyway.

Step 2: Troubleshoot the source of the problem

1) The SQL database (user) might have got corrupted

Hackers tend to change username and email of the blog user. Locked out of the blog!

Here's what to do if you are locked out of the blog.

Scenario 1: "Sorry, but you don’t have the administrative privileges needed to do this."

Same instructions as below.

Scenario 2: Can’t log in and can’t reset email

What is to be done if a hacker steals your password or otherwise hacks into the blog and prevents you from logging in? This happened to me on 26 March 2011. I suddenly found I could not log into sabhlokcity.com and was told that my password is wrong. Password reset would not work since the hacker had changed the email.

Solution: Fix the user in phpMyAdmin SQL database

Fix the password (details here) (select user/ browse/ edit). In my case the hacker had changed email to something in france (?). I changed back to my email ID, then used the login screen to reset the password. Then go into the blog and change to another password. 

DETAILS

Note the image of the hacked screen (I've BLANKED OUT MY USERNAME and other security information) but allowed the hacker's fake ID to be visible).

Through phpMyAdmin

This article is for those who have phpMyAdmin access to their database. Note: use phpMyAdmin at your own risk. If you doubt your ability to use it, seek further advice. WordPress is not responsible for loss of data.
Begin by logging into phpMyAdmin and click databases.

Image #3

  • All the tables in your database will appear. If not, click Structure.
  • Look for wp_users.
  • Click on the icon for browse.
  • Locate your Username under user_login
  • Click edit

Image #5

  • Check that your password is actually correct, and that MD5 is in the box.
  • Click the 'Go' button to the bottom right.
  • Test the new password on the login screen. If it doesn't work, check that you've followed these instructions exactly.

 

MAKE SURE TO USE THE MD5 OPTION – without it the password WON’T WORK
 
Typically you lose widgets/ widget area after a hacking incident. Reconstructing them is not possible without uploading back an old database. But the database greater than 50MB can’t be restored using phpmyadmin. Tables are individual entities in a database. eg: in the wordpress database tables are users, posts, settings etc. 
Use restore.sh in ~/sabhlok-backup. To restore dbdata.sql run: ./restore.sh dbdata.sql. Note: the full command is outlined here. An old database was uploaded, but unfortunately it did not have the widget arrangement. One last go – at using a later version of the backup.
 
In some cases the hacker not merely replaces the user name and account but deletes key files. That can made the wordpress installation defunct.
This may not always be necessary. At times this may require deleting existing installation and reinstalling it.
It is crucial to upoload the wp-content folder and uploads folder from the Amazon backup. (if prosumer theme doesn't work, then reinstall it)
Download and install prosumer theme again. The two key files are head.jpg (the main header) and you.jpg which replaces the woman with a cherry. Fortunately the Amazon backup contains these files. That had to be FTP'd, and for some reason it would not over-write existing (new) files. That meant a forced upload.
Go to myPhPadmin, then relevant database, and then upload the SQL file that has been saved under uploads on Amazon. This works for small database files.
Go to myPhPadmin, then relevant database, and then upload the
With great effort I found the core file (under the wordpress theme – whitehouse) and changed the functions_libraray.php file. That, however, did not help. So I renamed whitehouse theme to whitehouse2, and lo and behold worpress came alive.
 
That was the problem, so I reinstalled a whitehouse version. And saved the XML file.
 
This happened again recently when all widgets seemed to disappear. The solution was:
Rename to whitehouse2, install a fresh version, and delete whitehouse2. Sabhlokcity.com instantly came back to life.
The last time I had a peculiar problem I had to overwrite a main directory (not sub-directory) .php file (I forget which). Everything came back. NOTE THAT THE MOST IMPORTANT FILE IS CONFIG.PHP
A typical problem is plugin mismatch.  When that happens, all sorts of weird things can happen.
 
Solution: 
1) FTP to the site and rename the plugin folder as something else. This inactivates all plugins.
 
2) Re-active plugins one at a time and check which is causing grief. Since I have 50 odd plugins this is quite a nuisance.  It pays to DELETE plugins that you are not using. In my case, I'm building this blog post to record all the ones that I'll be using. Everything else needs to be deleted.
I upgraded WordPress (it asked me to do so!) and now I get this msg:  "Sorry, but you don’t have the administrative privileges needed to do this." That was a disaster! I searched the internet and found this solution. 
 
Go into Themes (under wp-content) to your theme. Within that you'll find 'core' then under /functions you'll find  the functions_library.php file. 
Open the file for editing.
You will see 
Quote:
function checkauthority(){
if (!current_user_can('edit_themes'))
wp_die('Sorry, but you dont have the administrative privileges needed to do this.');
}
Replace it with
Quote:
function checkauthority(){
if (!current_user_can('edit_themes'))
;
}
This worked for me. I find this whole WordPress thing such a mess, but one has to learn to live with it.
In the wp-config.php, change define(’DB_CHARSET’, ‘utf8′) to define(’DB_CHARSET’, ‘utf-8′)
 
Open up ‘wp-config.php’ from the root directory of your WordPress installation.Add ‘//’ at the very beginning of these two lines:define(‘DB_CHARSET’, ‘utf8′);define(‘DB_COLLATE’, ”);So that section should now look like this://define(‘DB_CHARSET’, ‘utf8′);//define(‘DB_COLLATE’, ”);
I accidentally put the double // on a previous line. Be careful. This does work.
 
1) Remove everything from searchform.php
<form method="get" id="searchform" class="" action="<?php bloginfo('home'); ?>/">
<fieldset>
<input type="text" value="<?php _e('Search',TDOMAIN);?>" name="s" id="s" onfocus="if (this.value == '<?php _e('Search',TDOMAIN);?>') {this.value = '';}" onblur="if (this.value == '') {this.value = '<?php _e('Search',TDOMAIN);?>';}" />
 
<input type="image" value="Go" src="<?php echo THEME_IMAGES;?>/search-btn.png" class="submit btn" />
</fieldset>
</form>
 
2) Delete the stuff in red from I forget which php file.
 <div id="sidebar" role="complementary">
 <?php
global $sidesearch;
if($sidesearch):?>
<div id="sidesearch" class="fix">
<?php include (THEME_LIB . '/_searchform.php'); ?> 
</div>
<?php endif;?>
 
<div id="widgets">
<?php if(VPRO) include(THEME_LIB.'/_grandchildnav_pro.php');?>
 
<?php if(pagelines('the_sidebar', $post->ID) == 'secondary'):?>
<?php if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar('Secondary Sidebar') ) : ?>
<?php _e('The secondary sidebar has been selected but doesn\'t have any widgets. Add some widgets to your secondary sidebar in the admin under appearance > widgets.',TDOMAIN);?>
<?php endif; ?>
<?php elseif(pagelines('the_sidebar', $post->ID) == 'short'):?>
<?php if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar('Short Sidebar') ) : ?>
<?php _e('The short sidebar has been selected but doesn\'t have any widgets. Add some widgets to your short sidebar in the admin under appearance > widgets.',TDOMAIN);?>
<?php endif; ?>
<?php else:?>
<?php if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar() ) : ?>
<?php if(!pagelines('sidebar_no_default')) include(THEME_LIB.'/_defaultsidebar.php');?>
<?php endif; ?>
<?php endif;?>
 </div>
</div>
Continue Reading