So I had my first site hacked...

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Markul
    Likes Pie
    • Dec 2007
    • 12407
    #1

    So I had my first site hacked...

    Seems some idiot managed to change something in a header file, injecting massive amounts of links to something called www.xangogoodness.org

    whois says this shit is owned by a Scott Smith from XanGo LLC, anyone know these fuckers?
    But.... I pulled out...
    Tags: None
    • yahoo-xxx-girls.com
      Confirmed User
      • Jul 2006
      • 3143
      #2
      The hacker might not be this guy or lady @ www.xangogoodness.org... it could be almost anyone... does it make sense to you for them to hack your server just to make it easy for someone like you to trace them by whois ???
      sig too big

        Comment

        • Markul
          Likes Pie
          • Dec 2007
          • 12407
          #3
          Why would anyone add just about a thousand links to a service when it has no ref id or anything, just plain old links?

          Unless I pissed someone off, but it wasn't even a big site or anything.
          But.... I pulled out...

            Comment

            • d-null
              . . .
              • Apr 2007
              • 13724
              #4
              what type of script were you running on the site?

              __________________
              Looking for a custom TUBE SCRIPT that supports massive traffic, load balancing, billing support, and h264 encoding? Hit up Konrad!
              Looking for designs for your websites or custom tubesite design? Hit up Zuzana Designs
              Check out the #1 WordPress SEO Plugin: CyberSEO Suite

                Comment

                • mrthumbs
                  salad tossing sig guy
                  • Apr 2002
                  • 11702
                  #5
                  Xango is a mlm program.. i think the 'hacker' did add ref codes but got caught and the xango owners redirected his account to the 'charity' division ?

                    Comment

                    • D Ghost
                      null
                      • May 2006
                      • 9819
                      #6
                      interesting

                        Comment

                        • Mr Pheer
                          So Fucking Banned
                          • Dec 2002
                          • 22170
                          #7
                          sounds like you were running an old version of wordpress

                            Comment

                            • malfo
                              Confirmed User
                              • Oct 2005
                              • 130
                              #8
                              Originally posted by Mr Pheer
                              sounds like you were running an old version of wordpress
                              yes i have the same and run an old version of WP.. how could correct this without updating WP
                              pchhhhttt.. my mom doesnt know i work in porn business

                                Comment

                                • CyberHustler
                                  Masterbaiter
                                  • Feb 2006
                                  • 29011
                                  #9
                                  Originally posted by malfo
                                  yes i have the same and run an old version of WP.. how could correct this without updating WP
                                  You gotta update...
                                  “If you can convince the lowest white man he’s better than the best colored man, he won’t notice you’re picking his pocket. Hell, give him somebody to look down on, and he’ll empty his pockets for you.”

                                    Comment

                                    • malfo
                                      Confirmed User
                                      • Oct 2005
                                      • 130
                                      #10
                                      Originally posted by Nick Decker
                                      You gotta update...
                                      i wont! :-D
                                      pchhhhttt.. my mom doesnt know i work in porn business

                                        Comment

                                        • CyberHustler
                                          Masterbaiter
                                          • Feb 2006
                                          • 29011
                                          #11
                                          Originally posted by malfo
                                          i wont! :-D
                                          Then enjoy being hacked...
                                          “If you can convince the lowest white man he’s better than the best colored man, he won’t notice you’re picking his pocket. Hell, give him somebody to look down on, and he’ll empty his pockets for you.”

                                            Comment

                                            • Violetta
                                              Affiliate
                                              • Jul 2004
                                              • 28735
                                              #12
                                              Originally posted by malfo
                                              yes i have the same and run an old version of WP.. how could correct this without updating WP
                                              change the password for your ftp! That worked for me!
                                              M&A Queen

                                                Comment

                                                • Markul
                                                  Likes Pie
                                                  • Dec 2007
                                                  • 12407
                                                  #13
                                                  Originally posted by Mr Pheer
                                                  sounds like you were running an old version of wordpress
                                                  Yea, that one blog was running 2.0.5 - only have a few that's still on that, the rest are updated. Yes yes I know the risks of not updating.


                                                  Originally posted by malfo
                                                  yes i have the same and run an old version of WP.. how could correct this without updating WP
                                                  Simple, upload a fresh header.php file. Wait for next hack and repeat, or update the blog ;) fixing this hack takes less than a minute lol, but I expect to see it again and again until I update the wp software.
                                                  But.... I pulled out...

                                                    Comment

                                                    • Markul
                                                      Likes Pie
                                                      • Dec 2007
                                                      • 12407
                                                      #14
                                                      Originally posted by jetjet
                                                      what type of script were you running on the site?
                                                      WP. And an old dated one at that, so yea I had it coming I guess

                                                      Originally posted by mrthumbs
                                                      Xango is a mlm program.. i think the 'hacker' did add ref codes but got caught and the xango owners redirected his account to the 'charity' division ?
                                                      Well the links were all w.o. affiliate code in the file, so yea, I presume that the people who run that service are a bunch of scammers (never in my life have I seen an MLM program that didn't involve at least one element of shady business practice anyway, so this doesn't really surprise me that much).

                                                      Still doesn't make it right in my book, just because you CAN do something, doesn't mean you HAVE to.

                                                      They looked like this:
                                                      Code:
                                                      <a href="http://www.xangogoodness.org/store/shop.php?blog=via&name=Viagra-pills-uk">Viagra pills uk</a> <a href="http://www.xangogoodness.org/store/shop.php?blog=pharmacy&name=Potassium">Potassium</a> <a href="http://www.xangogoodness.org/store/shop.php?blog=pharmacy&name=Botox">Botox</a> <a href="http://www.xangogoodness.org/store/shop.php?blog=pharmacy2&name=Diflunisal">Diflunisal</a> <a href="http://www.xangogoodness.org/store/shop.php?blog=pharmacy&name=Monopril">Monopril</a> <a href="http://www.xangogoodness.org/store/shop.php?blog=pharmacy2&name=Biperiden">Biperiden</a>
                                                      and so on... probably a script they have running to target old WP blogs *shrug*
                                                      Last edited by Markul; 07-28-2008, 04:27 AM.
                                                      But.... I pulled out...

                                                        Comment

                                                        • Markul
                                                          Likes Pie
                                                          • Dec 2007
                                                          • 12407
                                                          #15
                                                          Originally posted by Rockatansky
                                                          change the password for your ftp! That worked for me!
                                                          Hmmm.. I fail to see how this relates to FTP access, if this person had FTP access - he would do something else I think, and not just one one site....?
                                                          But.... I pulled out...

                                                            Comment

                                                            • tranza
                                                              ICQ: 197-556-237
                                                              • Jun 2003
                                                              • 57559
                                                              #16
                                                              That's bad..
                                                              I'm just a newbie.

                                                                Comment

                                                                Previous template Next
                                                                Working...