1

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since it contains no sensitive information, and I've been interested in finding the vulnerability.

Now, Wordfence reports "a change in the email server (MX) records of your DNS configuration". I suppose this means they're attempting to redirect qtechtheory.org to their own site, or intercept/spoof emails to/from our domain. The new records have a blank domain.

So, my questions are

  • What exactly are they now able to do?
  • How much 'access' must they have had in order to effect this change? Could that access really be elevated from PHP injection in e.g. some plugin?
  • Can I reverse this change without having to recreate the site? Otherwise, is this a change which would persist if I restored a backup of the site?
  • Does this indicate a problem I can't fix by nuking / re-creating the wordpress site, and which I'll have to take up with BlueHost?

Finally, are there any tips for finding the vulnerability so as not to recreate it? I use around 13 plugins, which is too many to scrutinise.

EDIT

I found an SSH account which I wasn't sure the role of, named 'ss-a76cde51202b8a78'. I deleted it after discovering in the FTP access log:

/home2/ldjovumy/public_html/MMprobe-3et5u.php b _ i r ss-a76cde51202b8a78@qtechtheory.org ftp 1 * c

(note I couldn't find MMprobe-3et5u.php). The command was from IP 52.10.88.182, the same reported in these attacks. I suppose that answers the who-dun-it.

Thanks for the help!

  • 1. Wordpress don't care about your MX records, perhaps the message is coming from bluehost? 2. Did yo have the rights to maintain your domain record? If so ,then it is a warning from bluehost that somebody is modify your domain mail server records. check out with your colleague for possible changes. – mootmoot Sep 20 '18 at 10:21
  • @mootmoot 1. Wordfence reports it. 2. Clearly the records are modified, but it is not a colleague – Anti Earth Sep 20 '18 at 10:31
  • You should change your user password in which website that you registered your domain. Also make sure you are not not using any common password : en.wikipedia.org/wiki/List_of_the_most_common_passwords By the way, all your questions maybe irrelevant if this is just a password hack into your domain account. – mootmoot Sep 20 '18 at 11:17
  • @mootmoot Changing all passwords was my first action, and none are common. Yup, but I don't see a strong reason to think that yet – Anti Earth Sep 20 '18 at 12:51
  • Somebody just make us of the AWS IP as "C&C".If your domain administration interface is also using bluehost, then I afraid you need to wipe clean and redeploy everything. – mootmoot Sep 20 '18 at 13:59
1

Changes to MX records are very unlikely to have occurred due to an attack on the WordPress site, with the exception that if your DNS is running on the same server, it might be possible. That wouldn't be a typical configuration: if you bought a domain name, it's more common for the DNS records to be associated with that provider's infrastructure, even if you bought it from the same provider as hosts the site.

Given that, it's likely that unauthorised changes to the DNS records would have resulted from the account with the hosting provider being compromised, rather than the site itself. Therefore, I'd advise looking at whether it is possible that the provider account has been compromised, and, since it wouldn't be unheard of, whether the provider has made some updates to their mail environment which required changes to the MX records.

Assuming that the changes are malicious, the attackers would be able to control where email sent to addresses on the domain actually went. Typically, they don't care much about the bulk of mail to most inboxes, but they are interested in password reset mails for more valuable accounts, material which could be commercially sensitive, or material which could be used for blackmail purposes.

It is possible that access details to your provider account were available within the Wordpress environment: if they were shared with an FTP connection, or a mail server, for example. If that was the case, the compromise of the site could be linked, but it's equally possible that the hosting provider was compromised, or that the account used a guessable password, and they got lucky.

This change would persist through restoration of the site, PHP changes, or even a complete reformat of the server (barring exception above), since it isn't on that server. The DNS records point to the web server and the mail server, but these can be from completely unrelated providers.

You'll need to take it up with whatever company runs your DNS records. This is usually the company you bought the domain from, unless you have specifically changed to a third party service. If you have changed, that provider will be the

  • I do use the 'BlueHost' Wordpress plugin, which they encourage one to install to 'improve performance', etc. Could this enable WP access to be elevated to the provider account? – Anti Earth Sep 20 '18 at 13:16
  • No idea - depends what it does really... – Matthew Sep 20 '18 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.