im not sure whether this is the right place to post this...my website has been attacked for the second time yesterday and redirects to a russian website. the first time one of the ditto files were affected where a javascript redirect was appended into the code. this time round, it was somewhere in the manager folder, the redirect happened before you could view source and therefre know what part of the code is affected.. is this a modx vulnerability or should i take up the issue with my host
-
MODX Staff
- 12,272 Posts
What version of MODx are you running? Are you on a shared server?
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
im running modx-0.9.6.1p2. i dont know about the server, i will have to check
I once had a virus that when saving forms in the browser would change links to ones in russia and to some porn sites. I first though that it was a hacker on the server but it was a virus on my pc.
my pc is clean, i have alot of websites done on the same machine but only one is having this issue... just check emanageafrica.com
-
MODX Staff
- 12,272 Posts
Would need to know what all else is running on your account and what plugins, etc. are installed. Really, without an inspection of your weblogs, it’s impossible to tell the source and even then it can be a big task depending on the size of the logs. You should probably consult with your server admin regardless as it may have led other bad effects.
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
i haven’t installed any pluggin, and i only have easynewsetter installed. i had reuploaded the website yeterday only for the attack to affect me again. i’ll let you know hwat the host says in a bit
Have you changed your FTP (and other) passwords? Once a hacker gets in the door, it can be very difficult to shut them out without changing all your passwords, deleting all files, and re-uploading the original files (since a hacker may have added code somewhere to give them a back door into your system).
If you send your FTP login unencrypted, it could have been intercepted in transit. Or your server itself may have been hacked in such a way that the hacker gained root access. If you have register_globals set to ON, you may have been the victim of an XSS attack. And the virus that Dimmy mentioned is certainly something to consider, since your symptoms are spot on for that. Maybe you or someone else logged on using an infected machine at some point? Deleting the code and clearing the cache (from a known clean machine, of course) should resolve it if this virus was the culprit, since it doesn’t actually hack your site but just inserts javascript code into the manager forms.
If it turns out that your site was hacked, make sure that you let your server admins know, since it might not be limited to your account.
