Hi Siva,<div><br></div><div>The sad truth is that WordPress sites do sometimes get compromised despite the best efforts of both users and hosts, and one just has to clean up and get on with life.</div><div><br></div><div>At ISOC-NY we use all number of prophylactic plugins including <strong style="background-color:rgb(252,252,252);word-wrap:break-word;display:inline!important;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">Bad Behavior</strong>, <strong style="background-color:rgb(252,252,252);word-wrap:break-word;display:inline!important;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">Exploit Scanner,</strong> <strong style="background-color:rgb(252,252,252);word-wrap:break-word;display:inline!important;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">SABRE, </strong><span style="background-color:rgb(252,252,252);font-family:sans-serif;font-size:12px;font-weight:bold;line-height:16px;white-space:nowrap">Wordpress Firewall 2, </span><span style="background-color:rgb(252,252,252);word-wrap:break-word;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">and </span><strong style="background-color:rgb(252,252,252);word-wrap:break-word;display:inline!important;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">WP Security Scan, </strong><span style="background-color:rgb(252,252,252);word-wrap:break-word;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">and also </span><strong style="background-color:rgb(252,252,252);word-wrap:break-word;display:inline!important;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">DBC Backup </strong><span style="background-color:rgb(252,252,252);word-wrap:break-word;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">for chron backups</span><strong style="background-color:rgb(252,252,252);word-wrap:break-word;display:inline!important;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap">.</strong></div>
<div><strong style="background-color:rgb(252,252,252);word-wrap:break-word;display:inline!important;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap"><br></strong></div><div><span style="word-wrap:break-word;display:block;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap;background-color:rgb(252,252,252)"><span style="font-weight:bold">Wordpress Firewall 2 </span>in particular defeats apparent SQL injection attempts on an almost daily basis. </span><span style="word-wrap:break-word;display:block;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap;background-color:rgb(252,252,252)"><strong style="word-wrap:break-word;display:inline!important;margin-bottom:0.2em"><br>
</strong></span><span style="word-wrap:break-word;display:block;margin-bottom:0.2em;font-family:sans-serif;font-size:12px;line-height:16px;white-space:nowrap;background-color:rgb(252,252,252)"><strong style="word-wrap:break-word;display:inline!important;margin-bottom:0.2em">WP Security Scan </strong><span style="word-wrap:break-word;display:inline!important;margin-bottom:0.2em">have recently upgraded their product and it is now really remarkable, immediately reporting any changes to one's entire installation.</span></span></div>
<div>See
<a href="http://www.websitedefender.com/">http://www.websitedefender.com/</a> - I recommend it. Free for a single non commercial site.</div><div><br></div><div>j</div><div><br></div><div><br><div class="gmail_quote">On Wed, Feb 15, 2012 at 9:36 AM, Sivasubramanian M <span dir="ltr"><<a href="mailto:isolatedn@gmail.com">isolatedn@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello<br><br><br>For the third time we are experiencing some problem with our Chapter Blog:<br><br>1. <a href="http://isocindiachennai.in" target="_blank">isocindiachennai.in</a> site was under attack in 2009, and the hosting service provider was unsupportive and unreasonable.<br>
<br>2. The same URL, after three years, was found listed in spamhaus, and communication to spamhause to remove the domain did not elicit a response. Any email sent with the URL on the message was blocked by spamhaus, this was not known for 3 years.<br>
<br>3. Isocindiachennai.org is now infected, while being hosted at another hosting service provider<div><br></div><div>(on a possibly related note, isocchennai twitter account is not on hashtag stream)<br><div><br></div>
<div>
<b>All these instances could be normal, non-specific malicious attacks, or perhaps not.</b></div>
<div><br>This is the communication received from the hosting service, when I noticed and raised a query on why the site was down this afternoon:<br><br><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
> Please note that , the above domain is suspended due to the malicious files uploaded. Our system found the below files under the public_html of the domain which is malicious root exploit files .<br>><br>> HEX}php.injector.genol.444 : /home/isocic/public_html/wp-content/themes/thedawn/lib/scripts/cache/756dfa9b1ec0d8000e1ed6abd22ec632.php<br>
> {HEX}php.injector.genol.444 : /home/isocic/public_html/wp-content/themes/thedawn/lib/scripts/cache/dc73ae75cc2426896738e4f1efd7fe64.php<br>> Kindly check on this and you need to terminated the domain and have to reupload all the contents after you have secured the site. This will prevent the other sites hosted under your reseller account from getting deface. Kindly update us the time during which you need us to unsuspend the site to take the backup .</blockquote>
<br><br>I have responded by saying this:<br><br><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
This is NOT due to any work we did. We did NOT alter anything from the cpanel or from wp-admin during the last few days and we are surprised at this problem.<br>However as suggested we can delete and reupload the site, but AFTER TAKING A BACK UP ...<br>
<br></blockquote><div> </div><br>On least on this instance the hosting provider is supportive. A back up may be possible, and a solution is in sight. We are working on it :)</div><div><br></div><div>------------- </div>
<div>
<br>The following is the communication on the previous incidence wrt to the <a href="http://isocindiachennai.in" target="_blank">isocindiachennai.in</a> domain:<br><br><br>---------- Forwarded message ----------<br>From: Rajnesh D. Singh <<br>
Date: Wed, Apr 1, 2009 at 10:48 AM<br>Subject: RE: Require help in pursuing an issue with CERT<br>To: Sivasubramanian Muthusamy <<br>
<br><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><br>Hello Shiva,<br>
<br>Your hosting provider’s actual hosting is in the USA rather than India, and its quite possible that the account was actually suspended by their provider (i.e. whoever Squarebrothers buys their services from).<br>Squarebrothers appears to me as just a reseller of hosting and domain name services. In case you didn’t know, your site is actually hosted in Dallas, Texas.<br>
In this instance, I am not sure what CERT-IN can do. The site is physically in the US, and as such outside of their “jurisdiction”. I assume you have access to your website (e.g. CPanel or Plesk, etc.) so you can manage things like email addresses, databases, etc. that run on it. If you do, then you should also have access to some of the log files. You will need to look for this and see if you can get some information that way.<br>
Other than that, have you filed an incident report with CERT-IN as per the form they provide on <a href="http://www.cert-in.org.in/incidentreporting.htm" target="_blank">http://www.cert-in.org.in/incidentreporting.htm</a> ?<br>
Link to the file is <a href="http://www.cert-in.org.in/documents/certinirform.pdf" target="_blank">http://www.cert-in.org.in/documents/certinirform.pdf</a><br>
If you haven’t filed this form with them, I suggest you do. Once you have done this, call their helpdesk, refer to the incident report form you filed, explain the issue, including the fact that your site is hosted in the US, and what assistance they can provide or what do they suggest you do. The only “Indian” aspect I see here is that you have registered a “.IN” domain name, but this is open for anyone to register (and as such does not mean much).<br>
You can also always change your hosting service provider (and advise them you are doing so because of the issues you have had).<br>HTH.<br>Regards,<br>R.</blockquote><br> <br><br> <br><br> <br><br> <br>________________________________<br>
<br>From: Sivasubramanian Muthusamy [mailto:<a href="mailto:isolatedn@g." target="_blank">isolatedn@g.</a>..]<br>Sent: Wednesday, 1 April 2009 12:06 AM<br>To: Rajnesh D. Singh; <a href="mailto:chapter-support@isoc.org" target="_blank">chapter-support</a><br>
Subject: Require help in pursuing an issue with CERT<br><br><br>Hello Rajnesh,<br><br><br>I have already copied you on a message sent to a local web-hosting service - a small, single owner outfit <a href="http://www.squarebrothers.com" target="_blank">www.squarebrothers.com</a> which hosted <a href="http://isocindiachennai.in" target="_blank">isocindiachennai.in</a>, a static website with one email account <a href="mailto:chennni@isocindiachennai.in" target="_blank">chennni@isocindiachennai.in</a> which was more of an unused account. The site was noticed down and when contacted the webhost sent a reply without explanation that the site was suspended for sending bulk mails, and when asked for log files to be sent to CERT, the reaction was adverse and rude - received a communication that the site is shut down and the support ticket closed.<br>
<br>This is likely to be due to the vulnerability of their hosting infrastructure and if the chapter address had been used for sending bulk mails, it is necessary to understand the origin of this incident, understand the type and volume of messages sent, to the type of addresses to which the message was sent. It is necessary to get down to the bottom of it.<br>
<br>I need some help on this. Is there a way by which you could help us get CERT to pay a closer attention and a thorough investigation ?<br><br>Sivasubramanian Muthusamy<br><br>---------- Forwarded message ----------<br>
From: Sivasubramanian Muthusamy <<a href="mailto:isolatedn@gmail.com" target="_blank">isolatedn</a><br>Date: Tue, Mar 31, 2009 at 5:26 PM<br>Subject: Re: [SUPPORT #IIT-225158]: Domain not working.<br>To: "Support, Square Brothers." <<a href="mailto:support@squarebrothers.com" target="_blank">support@squarebrothers.com</a>>, <a href="mailto:incident@cert-in.org.in" target="_blank">incident@cert</a><br>
Cc: Tamil <<a href="mailto:tamilmalaravan@bharatplanet.com" target="_blank">tamilmalaravan@bhara</a>>, Chandramohan <<a href="mailto:chandramohan@bharatplanet.com" target="_blank">chandramohan@bhar</a>>, "Chandramohan, BharatPlanet - Chennai" <<a href="mailto:tcmohan@gmail.com" target="_blank">tcmohan@gm</a>><br>
<br>hello<br><br>In response to the following mail, you have chosen not to give us further details or log files as your response indicates, we suggest that you do not delete the log files or suppress details until this issue is looked into by CERT. <br>
<br>This message is copied to CERT with a request to note that you have been notified of the importance of the full importance for an investigation into this incident.<br><br>Thank you.<br><br><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
On Tue, Mar 31, 2009 at 3:02 PM, Support : Square Brothers <<a href="mailto:support@squarebrothers.com" target="_blank">support@squarebrothers</a>> wrote:<br><br>Hi,<br>Sending bulk/spam mails & resource abuse is again our AUP & terms of service.<br>
If the hosting account violated AUP or the terms of service, your account will be stopped without any notice or mail.<br><br>~ Support Team ~<br></blockquote> <br><br> (the above message appears to be a retaliation to the suggestion of taking this up with CERT) <br>
<br><br>Sivasubramanian Muthusamy<br><br>On Tue, Mar 31, 2009 at 12:54 PM, Sivasubramanian Muthusamy <<a href="mailto:isolatedn@gmail.com" target="_blank">isolatedn@gmail</a>> wrote:<br><br>Hello,<br><br>You have not sent us any communication to inform us about this serious security lapse which is a possibility due to a vulnerability in your hosting infrastructure. We would like to have the details and log files now as we prefer a complaint to the CERT.<br>
<br>ISOC India Chennai is part of ISOC ( <a href="http://www.isoc.org" target="_blank">http://www.isoc.org</a> ) and we need to take this issue seriously. Please let us have the complete details of this incident.<br><br>
Sivasubramanian Muthusamy<br>
<br><br>On Tue, Mar 31, 2009 at 12:21 PM, Chandramohan <<a href="mailto:chandramohan@bharatplanet.com" target="_blank">chandramohan@bharatplanet</a>> wrote:<br><br><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Hi,<br>With reference to the mail below, we have not sent any bulkmail or<br>whatsoever from the account.<br>May I have any references regarding the same.<br>Regards,<br>Chandramohan</blockquote><br>-----Original Message-----<br>
From: Support : Square Brothers [mailto:<a href="mailto:support@squarebrothers.com" target="_blank">support@squarebrothers</a><br>Sent: 30 ?????? 2009 20:24<br>To: <a href="mailto:tamilmalaravan@bharatplanet.com" target="_blank">tamilmalaravan@bharatplane</a>t<br>
Cc: <a href="mailto:chandramohan@bharatplanet.com" target="_blank">chandramohan@bharatplanet</a><br>Subject: [SUPPORT #IIT-225158]: Domain not working.<br><br><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>Hi,<br>This account was suspended for sending bulk mails.<br>Make sure that there will be any bulk/spam mails from this hosting account.<br>regards<br><br>R.Ilangovan<br>Member - Support<br>Square Brothers Information Technologies (P) Ltd.,<br>
AA-9, Second Avenue, Annanagar,<br>Chennai, Tamilnadu, India. PIN : 600040<br>Tel : <a href="tel:%2B91.44.26205355" value="+914426205355" target="_blank">+91.44.26205355</a> / 26205356<br>e-Mail : <a href="mailto:support@squarebrothers.com" target="_blank">support@squarebrothers</a><br>
url : <a href="http://www.squarebrothers.com" target="_blank">www.squarebrothers.com</a></blockquote>
<br><br>Ticket Details<br>===================<br>Ticket ID: IIT-225158<br>Department: Support<br>Priority: Medium<br>Status: Closed<br><br><br></div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>---------------------------------------------------------------<br>Joly MacFie 218 565 9365 Skype:punkcast<br>WWWhatsup NYC - <a href="http://wwwhatsup.com" target="_blank">http://wwwhatsup.com</a><br>
<a href="http://pinstand.com" target="_blank">http://pinstand.com</a> - <a href="http://punkcast.com" target="_blank">http://punkcast.com</a><br> VP (Admin) - ISOC-NY - <a href="http://isoc-ny.org" target="_blank">http://isoc-ny.org</a><br>
--------------------------------------------------------------<br>-<br>
</div>