Change of DNS in MX records in a Wordpress site

Question

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since it contains no sensitive information, and I've been interested in finding the vulnerability.

Now, Wordfence reports "a change in the email server (MX) records of your DNS configuration". I suppose this means they're attempting to redirect qtechtheory.org to their own site, or intercept/spoof emails to/from our domain. The new records have a blank domain.

So, my questions are

• What exactly are they now able to do?
• How much 'access' must they have had in order to effect this change? Could that access really be elevated from PHP injection in e.g. some plugin?
• Can I reverse this change without having to recreate the site? Otherwise, is this a change which would persist if I restored a backup of the site?
• Does this indicate a problem I can't fix by nuking / re-creating the wordpress site, and which I'll have to take up with BlueHost?

Finally, are there any tips for finding the vulnerability so as not to recreate it? I use around 13 plugins, which is too many to scrutinise.

EDIT

I found an SSH account which I wasn't sure the role of, named 'ss-a76cde51202b8a78'. I deleted it after discovering in the FTP access log:

/home2/ldjovumy/public_html/MMprobe-3et5u.php b _ i r ss-a76cde51202b8a78@qtechtheory.org ftp 1 * c

(note I couldn't find MMprobe-3et5u.php). The command was from IP 52.10.88.182, the same reported in these attacks. I suppose that answers the who-dun-it.

Thanks for the help!

Answer 1

Changes to MX records are very unlikely to have occurred due to an attack on the WordPress site, with the exception that if your DNS is running on the same server, it might be possible. That wouldn't be a typical configuration: if you bought a domain name, it's more common for the DNS records to be associated with that provider's infrastructure, even if you bought it from the same provider as hosts the site.

Given that, it's likely that unauthorised changes to the DNS records would have resulted from the account with the hosting provider being compromised, rather than the site itself. Therefore, I'd advise looking at whether it is possible that the provider account has been compromised, and, since it wouldn't be unheard of, whether the provider has made some updates to their mail environment which required changes to the MX records.

Assuming that the changes are malicious, the attackers would be able to control where email sent to addresses on the domain actually went. Typically, they don't care much about the bulk of mail to most inboxes, but they are interested in password reset mails for more valuable accounts, material which could be commercially sensitive, or material which could be used for blackmail purposes.

It is possible that access details to your provider account were available within the Wordpress environment: if they were shared with an FTP connection, or a mail server, for example. If that was the case, the compromise of the site could be linked, but it's equally possible that the hosting provider was compromised, or that the account used a guessable password, and they got lucky.

This change would persist through restoration of the site, PHP changes, or even a complete reformat of the server (barring exception above), since it isn't on that server. The DNS records point to the web server and the mail server, but these can be from completely unrelated providers.

You'll need to take it up with whatever company runs your DNS records. This is usually the company you bought the domain from, unless you have specifically changed to a third party service. If you have changed, that provider will be the