I've recently been employed as a junior web and software developer for a small company, and noticed that their Home page has had links to completely unrelated sites added like spam to the index.html which have been hidden (display:none) with JavaScript.

I wanted to know how this was preventable in future, or how it was even possible. I will be changing the FTP access login and password, and getting the host to change their admin passwords, but I also have a PHP contact-us form in one of the pages which I feel may possibly be exploitable.

Do I need to get the host to change their PHP permissions, and if so, what to? Do I need to add anything to the PHP code that may help prevent this kind of thing? Are there any other security implications I need to know.

Browsing the web for these details has been rather unsuccessful. Thank you all in advanced for any help you can offer me.

closed as too broad by Adi, Xander, Lucas Kauffman, TildalWave, AviD Aug 16 '13 at 15:37

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Hi Rudi, welcome to Information Security! As noted, this is really way too broad to provide a simple answer to - entire books can be (and have been) written to answer this, there is no silver bullet and you will need to do A LOT of different things. Start learning with something like OWASP, specifically start with their Top 10 and go from there. Also browse the many other questions here that are related... Then you can come back and try to ask a specific, practical question... – AviD Aug 16 '13 at 15:37

If someone outwith your company has modified the content of your site, it seems likely that it has been compromised.

If that's the case then you really cant trust anything on that server any more as it may have had malicious software (e.g. a rootkit or similar) loaded on to it.

I'd recommend that you get a backup from before the site was compromised and then wipe the server and start again with fully patched software. Also depending on what sort of content your site has it could be that the attacker compromised the application itself so I'd review the site for things like SQL injection.

If you search this set for other questions about servers being hacked and how to respond that should provide you with more info.

Not the answer you're looking for? Browse other questions tagged or ask your own question.