Welcome to WebmasterWorld Guest from 54.144.79.200

Forum Moderators: rogerd & travelin cat

Message Too Old, No Replies

Attempted hack

     

travelin cat

4:56 pm on Feb 5, 2014 (gmt 0)

WebmasterWorld Administrator travelin_cat is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Yesterday someone tried to get into a clients Wordpress install using my username, Better WP Security blocked them but they somehow had my username which I NEVER give to anyone. This particular one was 12 characters long with numerals, capital letters and lowercase letters. They got the info correct, but the last two letters were lowercase instead of uppercase.

The IP said they were in South Korea. Any idea how this could happen?

mrblond

5:04 pm on Feb 5, 2014 (gmt 0)

5+ Year Member



Scary stuff.

I use the Login Page Rename plugin, so they'd need to know the name of /wp-login.php to get there.

These hackers are unbelievably amazing sometimes.

lorax

6:32 pm on Feb 5, 2014 (gmt 0)

WebmasterWorld Senior Member lorax is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Likely via another site on the same server but just in case - any outdated plugins or themes on the site?

travelin cat

8:58 pm on Feb 5, 2014 (gmt 0)

WebmasterWorld Administrator travelin_cat is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Nope. Everything is up to date.

lorax

9:23 pm on Feb 5, 2014 (gmt 0)

WebmasterWorld Senior Member lorax is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



The most likely reason is if code is out of date (how old is the theme and how much customization was done?). Other than this, if your plugins & core are up to date, then they came in another way. Not through WordPress.

travelin cat

10:08 pm on Feb 5, 2014 (gmt 0)

WebmasterWorld Administrator travelin_cat is a WebmasterWorld Top Contributor of All Time 10+ Year Member



The theme is new and updated regularly. I made a child theme that has a lot of css customizing, but nothing else.

lorax

12:42 am on Feb 6, 2014 (gmt 0)

WebmasterWorld Senior Member lorax is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Another thought. Did you access the site from a public WiFi at any point in the past month or so?

travelin cat

1:45 am on Feb 6, 2014 (gmt 0)

WebmasterWorld Administrator travelin_cat is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Nope. I never use public wifi.

lorax

12:59 pm on Feb 6, 2014 (gmt 0)

WebmasterWorld Senior Member lorax is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



How strong is your salt?

Passwords are hashed before being put into the database so I strongly suspect someone either had access to your passwords or got to your database through another route.

Does your client access the site via FTP? Have they given access to anyone else for any reason? Do the site have any plugins from new or sketchy authors?

smallcompany

4:50 pm on Feb 6, 2014 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



Any idea how this could happen?


It happened to me in the past that my "hand picked" admin user name was used like in your case.
It turned that the picture gallery plugin would make my user name available whenever I would upload a photo into the gallery. The user name itself would not be published to be seen via a browser online, but it would be available within the HTML code.

I figured it by searching the database for the user name to see where it was actually showing up. That helped.

travelin cat

6:39 pm on Feb 6, 2014 (gmt 0)

WebmasterWorld Administrator travelin_cat is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Lorax, I'm the only one that has FTP access and the plugins are all tried and true ones like Yoast SEO and Better WP Security (which blocked the attack).

smallcompany, there is no gallery, but I will go through all of the page's source code to see if I can find something.

travelin cat

6:52 pm on Feb 6, 2014 (gmt 0)

WebmasterWorld Administrator travelin_cat is a WebmasterWorld Top Contributor of All Time 10+ Year Member



I found it! This was in the initial post's source code I made for the client: <p class="meta-info"> By <a href="http://example.com/author/username/" title="Posts by company name" rel="author">

Any idea how to remove the meta info?

travelin cat

7:26 pm on Feb 6, 2014 (gmt 0)

WebmasterWorld Administrator travelin_cat is a WebmasterWorld Top Contributor of All Time 10+ Year Member



My theme had a setting to remove the author data, so now it's gone. Phew. What a pain in the butt.

lorax

2:31 am on Feb 7, 2014 (gmt 0)

WebmasterWorld Senior Member lorax is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Glad you got it sorted!
 

Featured Threads

Hot Threads This Week

Hot Threads This Month