I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was some other activity on the server, as well. It included:
- Brute Force Hacking (I can verify this with the Auth logs)
- Redirection Malware attempts. People started getting warnings from Norton, and I also got a warning from Firefox.
After clearing out the websites entirely, and re-installing them, one by one, and adding security plugins to them, everything checked out fine. I've beefed up security on the server with fail2ban, and other various security patches, and utilities. Everything seems to have subsided and the attacks seem to be either entirely gone, or have been made irrelevant.
I'm not new to Apache, Linux, PHP, MySQL, and a host of other web related topics (SEO, Marketing, etc.), but I don't know where to start when it comes to security. I mean, I don't even know how the injection/XSS/malware problem even began. I don't know who started it, and why. I don't even know truly, whether the threat and problem is fixed. Where do I begin with those questions?
Some basic info:
- The sites are powered with Wordpress (latest version) with security plugins.
- Using Apache2 with Ubuntu 11.10 server.
- LAMP setup with basic security in place