Its been a long week trying, at times when I can, to figure out what is happening on a server/website I am maintaining. The site was previously hacked, supposedly cleaned up by previous owners, and upon transfer to us, within hours, its hacked again.
Anyways, the question: if there are 0000 permission files on the server, can I assume the the hacker has root access?
(I don't even have root access...)
For clarity from a comment below: "But what I meant was, why would an intruder make a file 0000? I would imagine that they would want access to the file at some point. So if they made this file, I would imagine that it would be safe to guess that they have root access?"
[UPDATE] In case it wasn't clear, this site went live from another server roughly mid-May. I went back and checked the logs, and a few hours after the site going live saw a suspicious POST to an application url that should have returned a 404. Upon checking, that file was a backdoor; it was timestamped the same time as the rest of the files. So it is safe to assume that the site came to us backdoored (other backdoors had newer timestamps). So I've trolled the log files and scanned the dirs and found the backdoors.
We'll be setting up a new account for this site and moving over the clean files. I'm still confirming with the old admins, but it would appear that they thought the hack was confined to the 'blog' (WP) and hadn't checked the main site app for malicious-ness...