0

I have just launched our brand new blog website (php/mysql). I don't have any idea about cyber security. Yesterday we published a topic on coronavirus vaccine. I just noticed a new post is sitting on the home page Title: "Mr.Krungzx" and user "cyberanon". I tried to search in the admin panel, but didn't find anything related to this unknown post. We are using SSL to make our website secure. But seems like nothing worked, and I am clueless what to do next or what are the possible resolution and how to clean up this post from our web page also make sure this don't happen again. Appreciate your help.

9
  • 3
    Unfortunately (and I really mean this as gently as possible), it sounds like you are in over your head. It sounds like you setup some blogging software but don't really know anything about how these things work. To be clear - that's perfectly normal. No one is good at everything - we're all learning new things each day. In this particular case though, if you really don't understand anything about the technologies you are doing, your odds of doing this "right" are very small. Mar 17, 2020 at 13:49
  • 1
    There are clearly some glaring security issues somewhere, so even if you managed to scrub this post off of your website it's quite possible that someone would hack their way back in quickly anyway. Your best bet may be to accept the fact that managing your blog software may be a task best left in someone else's hands for now. There are many services available that will host your blog for you (both paid and free). You may save yourself a lot of trouble to stick with something like that for now. Mar 17, 2020 at 13:51
  • How to remove it? That's a question that depends on the type of blogging app you are using. How to prevent it from happening again? Without knowing how it happened, we can only guess. Reset all passwords to something strong.
    – schroeder
    Mar 17, 2020 at 14:04
  • Thank You for Your quick response. Will reset all the password for sure. It's true that I am not very tech savvy, but always love to learn new things specially if it related to cyber security :-)
    – Arnav
    Mar 17, 2020 at 15:24
  • @Arnav Unfortunately "how do I secure my application" is a very broad question and not a good fit for how this site operates. You said that it is a custom built application. That means that the issue could be just about anywhere. If this is the first time you've built a web application then the main concepts you need to familiarize yourself with are defense in depth and the OWasp top ten Mar 17, 2020 at 15:36

1 Answer 1

1

This can be all sorts of things. As your blog uses a MySQL database, check if the unwanted post is in there. If it is, and no-one authorized placed it there, you might have a breach somewhere.

Make sure that the database (phpMyAdmin?) and controlpanel of the blog are not using default or easy login credentials (e.g 'root' without password). Also check that visitors can not create new blog posts.

If the post is on the homepage but not in the database, try checking the source files which generate this page. There might be something in there.

Furthermore, using SSL is not making a website secure. It secures (encrypts) the connection between a visitor (client) and the webserver. It does not secure the application itself against malicious actors.

For more help please give us some more information, is the blog running on a known platform (e.g WordPress) or custom build? Can guests place new content or comments?

2
  • Thank You for providing the possible reasons.It really helps a beginner like me to learn new things. I was able to delete the post from admin, but yes it was there in the database. No I am not using root and password is not that simple. The platform is custom build (php/myadmin). Guests can comment using facebook comment plugin but only admin can post content. What all I should do to make the site secure? Just wonder how can someone inserted value into database? Only changing password is OK? Or need to work more and How? Thanks Again for Your Response.
    – Arnav
    Mar 17, 2020 at 15:21
  • Changing passwords is the first step. Also the links Conor provided can be usefull. If you have some experience in IT, you can dive into the webserver/mysql log files to see what happened. Perhaps there is something there (if you remember the time on which the post was placed, this narrows your search). As the blog is custom build, make sure the 'create new post' page is secure and not accessible by non-authorized users. Mar 18, 2020 at 6:29

Not the answer you're looking for? Browse other questions tagged .