Hosted Email Hacked, SQL injection maybe?

Question

I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised.

Basically, someone is using my email account to mass send spam. I've changed all the passwords and everything but when my Gmail pulls the emails from the host it's still downloading loads of spam messages that show like this:

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  example@example
    SMTP error from remote mail server after end of data:
    host 198.91.80.251 [198.91.80.251]: 554 5.6.0 id=23634-03 - Rejected by MTA on relaying, from MTA([127.0.0.1]:10030):
    554 Error: This email address has lost rights to send email from the system

------ This is a copy of the message, including all the headers. ------

Return-path: <admin@example>
Received: from keenesystems.com ([66.135.33.211]:2370 helo=server211)
        by absolut.x10hosting.com with esmtpsa (TLSv1:RC4-MD5:128)
        (Exim 4.77)
        (envelope-from <admin@example>)
        id 1TGwSW-002hHe-Lc
        for example@example; Wed, 26 Sep 2012 13:35:44 -0500
MIME-Version: 1.0
Date: Wed, 26 Sep 2012 13:35:43 -0500
X-Priority: 3 (Normal)
X-Mailer: Ximian Evolution 3.9.9 (8.5.3-6)
Subject: New staff members wanted at Auction It Online
From: admin@example
Reply-To: example@example
To: <example@example>
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Message-ID: <OUTLOOK-IDM-9aed7054-6a3e-e1a4-1d5c-3e73377652a6@server211>

I'm not aware of how this has happened. I'm not sure how anyone could have got hold of my password.

It's a simple wordpress install, at some point recently my host went down and there was a fresh install of wordpress with default admin accounts, I have a feeling it could be something to do with this.

My question is, even though I've changed all my passwords it's all still happening, is there annywhere in paticular this script would be stored on my host. I really can't deal with having my hosting account suspended and my email account sending all this spam.

Answer 1

The attacker may or may not have your email password; this message doesn't indicate one way or the other. This is a failure notice from some email sent (possibly by your website) earlier in the day. You should expect to continue to get these notices for a while even after the outbound email stops, though the rate should slow significantly over time. If it doesn't, then the outbound messages are still going out and you need to re-evaluate your current security.

As for how the attacker got in, if you're running an old Wordpress install, there has been a vulnerability or two in the not-too-distant past that could account for this. If you're running an updated install, then check your plugins and themes. The vast majority of the time, it's a plugin or theme that is to blame.

People tend to only install software (like Wordpress) that has a decent reputation, but they completely let their guard down when installing third-party components. It's very possible that the person who wrote your theme or component has no idea how to write software; this could even be his very first attempt. And yet a vulnerability in a theme or a module is just as bad and just as exploitable as one in the core system.

You have to be extremely cautious, particularly with PHP software (which has much lower barriers to entry for inexperienced developers), and only install code that you know you can trust.

Also, you have to stay on top of the updates. The window between when an update for a package is officially released till when the issues it fixes get widely exploited by even inexperienced hackers is only a matter of days.