I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since it contains no sensitive information, and I've been interested in finding the vulnerability.
Now, Wordfence reports "a change in the email server (MX) records of your DNS configuration". I suppose this means they're attempting to redirect qtechtheory.org to their own site, or intercept/spoof emails to/from our domain. The new records have a blank domain.
So, my questions are
- What exactly are they now able to do?
- How much 'access' must they have had in order to effect this change? Could that access really be elevated from PHP injection in e.g. some plugin?
- Can I reverse this change without having to recreate the site? Otherwise, is this a change which would persist if I restored a backup of the site?
- Does this indicate a problem I can't fix by nuking / re-creating the wordpress site, and which I'll have to take up with BlueHost?
Finally, are there any tips for finding the vulnerability so as not to recreate it? I use around 13 plugins, which is too many to scrutinise.
I found an SSH account which I wasn't sure the role of, named 'ss-a76cde51202b8a78'. I deleted it after discovering in the FTP access log:
/home2/ldjovumy/public_html/MMprobe-3et5u.php b _ i r email@example.com ftp 1 * c
(note I couldn't find
MMprobe-3et5u.php). The command was from IP 18.104.22.168, the same reported in these attacks. I suppose that answers the who-dun-it.
Thanks for the help!