Determining how my Wordpress website was compromised

Question

I have got a blog running Wordpress. The last time I visited my blog I realized it was hacked. The website redirects to a phishing page of paypal meanwhile other links a opening fine. I want to know how that attack was made, how to fix this problem and what security measures I must adopt so that it should not happen in future.

Answer 1

I will try to explain how such and similar hacks happens. They are really prevalent and at some point of time I was puzzled with something like this: who can possibly reply to an email that claim that some nigerian king wants to share his 5mln$ and needs your help, and in such a case why spammers are sending these spam.

First of all one have to understand that this attack was not tracking particular user or particular site. Most probably the person who decided to do the attack had no clue about the site beforehand.

He googles something like this: vulnerability in wordpress, and gets tons of results. For example this is the list of vulnerabilities, but this is too much text and I do not have time too read it. So let's see something easier. Ok, this sounds like a deal and the threat looks amazing:

The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code in your timthumb cache directory

http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/

It has even some ideas how to exploit it, but lets just look at the google query: how to exploit timthumb.php . The link with a title technical details sounds like it can give you a technical detail (actually it is not, but I will stop writing here so that it will not look like I am telling how to break something).

The ability for a site visitor to load content from a remote website and to make the web server write that remote content to a web accessible directory is the cause of the vulnerability in timthumb.php

amazingly convenient.

So the person is testing vulnerability on his machine and after it gives him a possibility to upload an arbitrary file on your machine it will upload something bad. And than run it. Ok he has done it on his machine, but how he found this guy?

Answer is simple: attacker was not looking for it, he was just looking for every site that used timthumb.php. After getting them he tries every site and chances are big that one of 10 sites would have this exploit.

I am not claiming that the writer's site was hacked in such a way but most probably in similar way.

I have written this with one thing in mind - give the idea how is it done, not to tell how you can do it (in this case it is written really badly)

Another reason for writing it is to tell what can you do - update your core as often as possible. Check for bugs and exploits.

The good thing is this sort of attacks is done by people who has no idea how to do create it. Nevertheless I am a programmer, but I have never even used wordpress and it took me less then an hour to write the post and search for exploit.

So most of the people like I have just describe are like monkeys - they have no idea what are they doing (they just copypaste something). They see something on site, they want to look like hackers and they are really proud if they will be able to do. And if they will not succeed with simple instructions - they will just move to next possible victim.

Sorry if my answer looks unstructured and stupid. If you think you can improve it - I would be glad

EDIT: Please patch your website ASAP. If you feel the desire to show the community what the page exactly is; save the html file as a txt file. This way it doesn't execute anything on more computers. Your blog has been marked as a phishing website, firefox prompts and suggests "getting out of here".