Finding the attack vector of a hacker that nuked my siteCache

An evolution 1.0.2 site of one of my clients got hacked a few days ago.
The Hacker overwrote the files siteCache.idx.php and sitePublishing.idx.php with «hacked byLenis».

I checked the FTP logs, which are not writable for users, and I’m pretty sure there was no break-in there.
Reflect-Snippet is ruled-out, also.

So, now I need to find the open window.

Can anyone point out, where I could start to look or what I need to look for in the access-log files?
I’m trying to understand what a hacker would need to be able to nuke the files mentioned.

Thanks,
Sascha

Have a look at the date/time stamps on the affected files and tie that back to your webserver access logs, this is not infallible but worth a look.

From my google search I did on this, I think it’s possibly a vector directed at CPanel and/or WHM that allows them to get access to the server.

For example: http://wordpress.org/support/topic/355729

And, another instance that points to the host being the problem.

I would contact your host in all honesty and find out if they can help. It’s possible that they haven’t kept CPanel up to date on their servers.

Seems to be the problem of the webhost.

My cache-files had permissions of 666 instead of 644.
The hoster told me, finally, that a hacker is running scripts on the host, trying to find writable files. He then overwrites them.

Correct me if I’m wrong, but isn’t this supposed to be prevented by the system?
I’m ok with setting the correct permissions but should I really have to do that, if the system itself wasn’t compromised?

If the hacker had access to the server to be able to run the scripts like they did and your files had incorrect permissions (i.e. above and beyond the minimum required for MODx to function), there’s next to nothing MODx can do to prevent that from happening.

Personally, I would consider a change of host if they have security holes that allow scripts to be run across multiple hosted accounts like that.

I informed my client to consider just that.

With «prevented by the system», I meant UNIX not modx.

So, all seems to be fine now. Hopefully, my client will let me move the site to a new host.

Thank you all, for your replies.
Sascha