sigh, hacked again

[james438]

I just want to vent a little. The fault really is my own for not having better security, but this past month my site was hacked twice. I looked at the scripts they uploaded to my site. They looked to be using some outdated php.

Once the scripts were uploaded they scan the site for any other passwords and email them to some address. I then spent nearly all night changing all of my passwords, which they might have gotten access to, like databases or ftp clients.

Apparently the day I made the changes they uploaded the hacker scripts again, so it looks like I get to change my passwords again. Sigh.

During the life of my site I have increased the security several times, and have learned several things, but it wasn't enough apparently.

This time, to increase security further I beefed up my security password with some unicode, created a fake login page and I now record login attempts as well as many facts about each login attempt whether successful or not.

Maybe this time hackers will have a more difficult time getting in.

[csscoder]

1- Did you know where is the hack script? Did you check the server logs?
2- Are you sure all your files are not 777
3- Check out the process usage..

[james438]

how do you check the server logs?

[csscoder]

Do you have access to the server via ssh?

[james438]

My knowledge of these matters is sadly limited, which is probably how I got hacked in the first place. I do not think I have access to Secure Shell (SSH), but I could be wrong.

I changed allow_url_fopen from on to off.

[csscoder]

check out this:
http://www.serverwatch.com/tutorials/article.php/1127521/Apache-Guide-Logging-with-ApacheUnderstanding-Your-accesslog.htm

http://httpd.apache.org/docs/2.0/misc/security_tips.html
also try to use some firewall in your server, where is located your website ?

[james438]

Arizona. The host is GoDaddy.com. website is http://www.animeviews.com (http://www.animeviews.com) in case you have not guessed yet ;).

[csscoder]

uff Godaddy, did you try to contact the customer support and tell them about your issue?

[james438]

no, but I can do that tomorrow. It is 11:08pm here.

I was thinking that the fault lay primarily with poor security practices on my part. Here is what I was attacked with: http://blog.ericlamb.net/2010/02/the-horrors-of-c99-php/ (http://blog.ericlamb.net/2010/02/the-horrors-of-c99-php/).

[james438]

I am getting close to gaining access to SSH. I am also reading the articles you sent me.

[csscoder]

Yes, but contact Godaddy, they need to solve it, tell about your issue and you need to know where is the problem because you have not access to your root folder to check the files...

[james438]

kk, will do.