Re: my wife's website was hacked

[Nathaniel Reindl <nrr@corvidae.org>]

> On Sep 9, 2018, at 06:09, Andrew Bauer <knnniggett@gmail.com> wrote:
> 
> So this was all about creating bogus links to get people to click them, which in turn, I suppose, would somehow get the attacker paid for people clicking on the ads? I'm uncertain what the benefit is exactly, but I don't have the mind of someone like this. 

It’s actually a somewhat clever exploit of SEO as well. Building that sitemap makes those pages reachable by spiders—noting well that weblogs prohibiting crawling via robots.txt is exceedingly rare—and hence also searchable on search engines like Google.

You’ve doubtless had a search or two filled with some of those noisy results that are a lot less content and more collections of keywords. They’re most often for things like what you’d often find on Pinterest.

Same idea.

> It's still a mystery how exactly the attacker gained access to her site. Her passwords have been changed of course.

With Wordpress, it’s extremely hard telling. It could be a weak password, or it could be an exploit of some too-permissive configuration options in Wordpress, or it could be an outright exploit in the software, hardened or not.

If you and your wife are keen on sticking with Wordpress and evading these kinds of attacks in the future, you do luckily have a couple of options. Unfortunately, neither of them are particularly great.

If you’re wanting to be less hands-on: Wordpress.com is probably your best bet in terms of hosting. I’m not familiar with how pricing or any of the business-side concerns work, but this was the only way we used Wordpress when I was at Turner Broadcasting. The software’s security track record was otherwise something that my small production engineering team couldn’t keep up with when also considering business demands.

If you don’t mind the slightly-more-than-occasional sharp edge: There are a couple of really good security/hardening articles online, one of which is by Cloudflare. (I’m mobile; otherwise, I’d link it here.) This will take time and a bit of knowledge about how to conduct some penetration testing on your own to get it right, but it can be a rewarding project if you can keep on top of what it means to be hardened in the context of Wordpress.

Sorry to hear that you got hit with this. Hopefully, it becomes and remains merely a bitter memory from this point forward. Happy hardening! —n


-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.