0

My website is being hacked for the last 2 days. I'm an amateur who built it back in 2007ish and it still has some poor code. Was a hobby project that suddenly became very popular and lived to this day fluorishingly despite php5 and no prepared statements, just mysql (not mysqli) queries. Maybe that's the end of the line for it, but I got nothing to lose by asking for some help...

I do sanitize inputs, but inside user area there was at least 1 file that didn't do a good job and also echoed mysql_error back to user screen. And this Russian hacker took time to register and confirm email (so I have it now) to perform his SQL injection. (It's a Ukrainian website, with a few patriotic notes since invasion, maybe that p*sses somebody off because on May 9th there was a spike in hacking attempts I've seen on Cloudflare)

They were able to change passwords and a couple other fields in 1 table in database. (noticed couple hours later, changed those passwords, started investigating) User deletes his account right after he's finished. His IP points to cheap Russian hosting/vpn/data center (found their IP range, blocked with firewall only today).

Then in logs I see files used exclusively as includes being requested from 2 new IPs: 1 known in abusedb for apache-bow-document,php-url-fopen - (btw my php allow_url_fopen On allow_url_include Off) 2 'clean', from China, 'Data Center/Web Hosting/Transit'

No more observable changes (to me, that is) in database or website 48 hours later.

What I've done so far: fixed (hopefully) couple places where SQL injection was possible Changed FTP password, changed linux user password, been toggling shell access off/on. I need SFTP myself, much faster to navigate and change things, but if I disable shell it becomes impossible, right?

I don't know whether this all means they know mysql password or user password? They all different, and mysql user has minimal previlleges as far as I remember (tried running SHOW GRANTS FOR user as root but doesn't show anything maybe bc root has no database?) Any tips appreciated, really.

I've seen hacking attempts for years on this site, as in ?id=user&%OR%...Union... blah blah and they were never successful but this time somebody decided to target it seriously, I guess..

just ran SHOW GRANTS in phpmyadmin as user and it looks scary

GRANT USAGE ON . TO 'dbuser'@'localhost' IDENTIFIED BY PASSWORD 'blahblah' GRANT ALL PRIVILEGES ON mydatabase. TO 'dbuser'@'localhost' –

I guess I should change mysql user password and previlleges? Or too late... I thought they were minimal like select, alter, index, delete and drop. Sorry for long text)

Improve this question
3
  • dumped old mysql user, created new one with few grants. will be checking logs. I sort of sympathize with the hacker who'd be intending to run this big old mother himself, it's quite messy, sometimes takes me a bit to figure out what I did there))) Hoping they'll just get bored and move on to greener pastures, like CMS based websites hacking, at least they're kind of standard))
    – Deerian Gray
    Aug 5, 2022 at 1:59
  • You do not appear to have a question. What did you want to ask?
    – schroeder ♦
    Aug 5, 2022 at 8:22
  • Was looking for any 'first help' tips, where to look, what to do. When my head cleared up from panic fog I Googled that question. My VPS server provider ran some scans for malware and haven't found anything suspicious...
    – Deerian Gray
    Aug 5, 2022 at 22:00

1 Answer 1

Reset to default
1

You are right to assume a full breach of the database contents and associated credentials. To determine the exact extent of the breach, you would need to conduct a digital forensic analysis, since tracks might have been hidden well. This would take much more time than to assume these credentials are leaked.

Generally, you should not continue to host outdated websites as they are likely to be prone to multiple vulnerabilities.

Improve this answer
1
  • Thanks. I know... At least it doesn't have any payment processing, all they could steal is user database (email, name, location (no home addresses)). That's visible on the site anyway (except passwords).
    – Deerian Gray
    Aug 4, 2022 at 23:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .