by Milton
18 replies
After just having my computer invaded and a web site trashed I thought I would post this information I received from my hosting company.
Having been in this game for a good many years I thought I was on top of this but the cretins out there are getting smarter.

Here is a list of steps that you can take to ensure your sites remain secure: As advised by my website host.

1. Use the following online vulnerability scanner and ensure your software is up-to-date: Scan Now - Online (OSI) - Vulnerability Scanning - Secunia.com
2. Download anti-virus and fully scan your PC for malicious files. Here are some free online scanners for Windows, which is typically the most vulnerable to infection. If you have a different OS, there are similar programs that can be located and run on your system to protect it in the same way:
MalwareBytes ( Malwarebytes.org ) and
ComboFix ( A guide and tutorial on using ComboFix ) have been reported to be able to clean a recent strain of malware that resists detection by almost all other anti-virus agents. It is highly suggested that you one or both of them and one of the following:
-http://housecall.trendmicro.com/
-http://www.bitdefender.com/scan8/ie.html
-http://www.kaspersky.com/virusscanner
-http://support.f-secure.com/enu/home/ols.shtml
-http://www.eset.com
3. Update all passwords for any account that you access/own that may not be up to standards. Any passwords that have been compromised will need to be changed as well. Standards for secure passwords are available: Password strength - Wikipedia, the free encyclopedia
4. Ensure that all scripts/plugins/modules/components are updated to the most recent released version, as new versions are released primarily to address known security vulnerabilities in these sites.
5. Keep your computer secure from malware infecting it. If your computer is compromised, your account can be compromised through your password being used to access it.
- Ensure you use the latest browser version; Ensure that said browser subscribes to Google's blacklist API (Mozilla Firefox, Google Chrome, Safari)
- Disable javascript
- Use the firefox addon noscript
- Make sure your antivirus has a subscription to new database and version releases. This may cost some amount of money, but is well worth the expense.
- Use AVG Online Virus Scanner | Scan Web Pages | AVG LinkScanner Drop Zone to test suspicious links you are given in emails or find online.
6. Ensure that all database configurations for your account are using a custom generated user and password combination, and that this information is not stored in plain text if this is feasible. Using your cPanel username and password to access your databases for your site may be convenient, but it introduces an incredible security risk.
7. Audit your account for unnecessary scripts, such as file uploaders. Ensure that if they are necessary that they are password protected, or if that is not feasible that they check the file type before allowing upload, to prevent upload of certain types of files.

Of course I take no responsibility for any of the programmes mentioned here. I just hope this can prevent you going through the angst (read expletives mumble under breath so wife can't hear) I've used some of the programmes already and with a few surprises.

I'm not sure if its ok to post the links but the admin will take care of that. I really wouldn't wish my experience on my worst enemy ( but I'll think about that one) Yeah I would!
So best of luck.
Milton
#hackers #heads
  • Profile picture of the author hugofortin
    Hi,

    Oh no! not again hackers!

    Thanks for this list!

    Hugo
    Signature

    Are you FRUSTRATED because you have no LEADS for your MLM company? Don't make any MONEY from your MLM company? If you have answered YES to these questions, please visit my blog for advices on how to have leads and make money in this Industry.
    http://hugofortin.com/

    {{ DiscussionBoard.errors[1457376].message }}
    • Profile picture of the author johnknow
      And I suppose you couldn't post this last month?

      I had a total takeover of my computer. Had to change every darn password
      to every darn site I had ever signed up for. Yes, even this one, hehe.

      But still thanks a lot as there are a couple of things on your list that I did not do.
      {{ DiscussionBoard.errors[1457379].message }}
  • Profile picture of the author shg
    OH well this is really great help from you because few months back my site was hacked and spammers installed some scripts so my site was running so slow and started falling down in search engine position so i was very alert...

    but now again they will attack so i have to just go through all your points...

    thnx a lot....
    {{ DiscussionBoard.errors[1457382].message }}
  • Profile picture of the author Milton
    Originally Posted by Razer Rage View Post

    Great list. On top of that, I would like to add another; common sense. The most sophisticated security system in the world will not protect you from a lack of it.
    Yes your right but I couldn't find a link to the site that supplies it.
    Milton
    {{ DiscussionBoard.errors[1458687].message }}
    • Profile picture of the author j0s3
      Hackers... $@~!£!

      The only way to stay clean and free from viruses is to unplug your PC.

      Damn them.

      PS Watch out for online scanners that you've never heard of before. Google them first and get some info if they're the only option for something specific. Otherwise use only trusted established names like AVG, Sophos, Mcafee etc
      Signature

      Jose Gonzalez
      (no pitch)

      {{ DiscussionBoard.errors[1458696].message }}
  • Profile picture of the author Erik Ortega
    Thanks for the tips! I know how frustrating getting your site hacked can be...a few months back I had one of my sites hacked and found Islamic terrorist propaganda pictures all over my page! All of my hard work was gone (until hostgator got it back up for me =) )
    Signature

    Be extremely subtle, even to the point of formlessness. Be extremely mysterious, even to the point of soundlessness. Thereby you can be the director of the opponent's fate.- Sun Tzu

    {{ DiscussionBoard.errors[1458699].message }}
  • Profile picture of the author thescribe
    Thanks for the list! There are a few things on there that I had not thought of. You also have to exercise caution and some common sense when online. Be sure to thoroughly check out sites and services that you have never used before.
    {{ DiscussionBoard.errors[1459097].message }}
  • Profile picture of the author mywebwork
    This is a good list, although in the real world some of it isn't practical - the one that I spotted was "disable JavaScript".

    I understand the reasoning, JavaScript is a client-side language and with products like Adobe Air it even has limited access to your local machine. But disabling it would render many websites unusable, including most Web 2.0 designs (i.e. Twitter) and anything that uses Google AdWords or Google Maps. Using a plugin that enables it on a site-by-site basis is an improvement, but for an active Internet user it could also become an annoyance. Once a safety measure becomes an annoyance it is soon abandoned - look how much people hate all the security warnings that Windows Vista displays every time you want to run or install something new.

    Common sense is still your best defense, along with an updated virus checker.

    Of course the most secure and 100% hacker-proof arrangement involves unplugging your Internet connection and never installing new software!

    One thing that I didn't see mentioned was the importance of frequent and accurate backups or all your websites (and your home computer as well). And don't just back them up - practice restoring them as well so that you are confident that if a hacker does do something malicious you can recover. My (currently) one and only WF blog post details a nasty experience I had with that earlier this year, and some guidelines to prevent it from happening to you.

    Bill
    {{ DiscussionBoard.errors[1459249].message }}
    • Profile picture of the author John Cabral
      Originally Posted by mywebwork View Post

      Of course the most secure and 100% hacker-proof arrangement involves unplugging your Internet connection and never installing new software!
      Bill
      Thats pretty much the only way...
      Signature

      I like to mess around with software programming.

      {{ DiscussionBoard.errors[1459488].message }}
  • Profile picture of the author davidofderbyshire
    Thanks, unfortunately, the cretins are always 1 step ahead
    {{ DiscussionBoard.errors[1459785].message }}
  • Profile picture of the author mobility
    Good list. #4 is especially important if you're running a popular CMS or blog platform (i.e. Wordpress, Drupal). There are a number of hacks that target older versions of Wordpress.
    {{ DiscussionBoard.errors[1460264].message }}
  • Profile picture of the author Jawshh
    Good guide Thanks
    Signature

    Get a Website Loaded With Unique Content Every Month For Free. Check it out NOW!!!

    Advanced Internet Marketing Tactics

    {{ DiscussionBoard.errors[1460356].message }}
  • Profile picture of the author shaddai
    The only way to stay clean and free from viruses is to unplug your PC.
    Well, that is pretty foolproof. A hurrendously large improvement can be made without turning the computer off though: Ditch windows.
    Signature

    “Never be afraid to try something new. Remember, amateurs built the ark. Professionals built the Titanic.” -Author Unknown

    Resident computer geek. If you need help, don't be afraid to PM here, or DM on Twitter.
    {{ DiscussionBoard.errors[1460396].message }}
  • Profile picture of the author HomeComputerGames
    Setting correct Directory and File permissions is a must and a major reason many sites get hacked.
    You don't want to have a directory or file open for anyone to write to. Especially a config file.

    Also, if you are trying a new script on your site be sure to research for any vulnerabilities or scams. It's best to have someone check the coding to make sure the original programmer hasn't inserted code to send them information about your guests.
    Too many people download scripts and install them without even questioning whether the programmer may be dishonest or not. They seem to assume since it is a wordpress plug-in or a script listed on a free scripts site that it must be safe.

    In the real world it would be very, very, easy to add a little bit of code to a script to have it send your database of users to the programmer. Even further it would be possible to send any credit card transactions to them. Now you are in some legal trouble if this happens.

    Even with someone checking the script it is possible to hide the devious code by just inserting a line of code here and there throughout many thousands of lines of code. By doing this you do not have an "obvious" data delivery module but rather broken up and blended in.

    So be cautious when installing all of these plug-ins and scripts. You may get more than you bargained for.
    Signature

    yes, I am....

    {{ DiscussionBoard.errors[1460456].message }}
  • Profile picture of the author rainspeak
    That was a lot of work putting that together. Thank you.
    {{ DiscussionBoard.errors[1460751].message }}
  • Profile picture of the author Profit-smart
    Learn to do portscans.

    Then learn to do IP traces.

    Then find the local police station for whoever your current "hacker" is.

    6 times now I've forwarded the applicable info to police stations in Peru, India, Malayasia, and twice here in the States.

    Typically these guys are busy with low level credit card fraud. If you help catch them, you save hundreds of unsuspecting consumers from being defrauded as well.

    And after all, the consumers are what keep our businesses running arent they?
    {{ DiscussionBoard.errors[1460972].message }}

Trending Topics