www.paypal.com

Hey guys, we have been hacked 3 times in two days, even after changing passwords etc.

The person access by SSH and then loads a phising script (www.geocities.com/brmmce/lloydstsb.co.uk.zip)

Our hosting provider has said "please could you look into your code which I believe is being compromised.", however it’s a standard install and no one else has complained about it so can only assume it’s not MODx? Also passwords used on MODx is different to that of the VPS, but maybe they get access for some form of PHP attack? All this is way outside my expertise.

I am away for a month and have limited internet access (great timing), so any help is appreciated and I’ll reply as soon as I can.

Thanks

If somebody is accessing your site with ssh, they can probably do pretty much anything they want. If that is the case, it sounds like your hosting provider is trying to pass the blame for failing to adequately secure their servers.

What files are being compromised? Is the main index.php file being overwritten? You can change it and the manager/includes/config.inc.php file to read-only, but if they’ve got ssh access they can change them back to whatever they want, or simply put in an index.html file which the Apache server most likely is configured to use before index.php, if it exists.

We had something similar on a VPS recently on a non MODx site - and it isn’t much fun so you have my sympathy!

I suspect MODx is nothing to do with it, in our case they got hold of the master password and changed it. In the end I had to shut down the VPS and start again from scratch because whenever we cleaned up then within 2 hours or so the roque files would be back.

I didn’t find any scripts or files altered, just these random new files in a subdirectory that are being used as false sign-ups in phishing emails. Ours was Lloyds TSB too and their compliance department contacted the host and the domain registry, who in turn threatened us with suspension - so don’t be too surprised if the domain dissappears.

As has been suggested, there may be a problem with the VPS security, although the host said no-one else on the server had a problem.

Good Luck

Thanks for your response. We had the hosting provider upgrade the server to a 64bit platform and I disabled SSH.

Bluespark, I had the same thing, cleaned it up, changed password and within a day it was compromised again. The hosting provider got a call from ebay and yea, it was fix it now or we cut you off kind of thing.

Sottwell, MODx is not being touched at all, they are putting it in another directory (outside of MODx) and appears to be sending emails to people who end up in that directory with a fake login for paypal.

I too doubted it’s MODx but was prudent to check on the forums to ensure it wasn’t something to do with MODx.

Thanks again.