[Technology] Website Hacked - The font of knowledge that is NSC

[Superphil]

which version of php is the server running? Hasn't there just been a major update to PHP and an old insecure version totally depreciated?

its. 7.? something, just recently updated to this.It was 5.? previously.

 

[superbrother]

PHP 7.1.5 for the front end and a more recent PHP 7.1.21 for the admin

 

[WATFORD zero]

And here I am, the other half of oldfootballshirts.com. Thanks for all the quick comments and support.

oldfootballshirts.com is now offline, completely. As the backdoor was regenerating itself we must do full scan when we know nobody can be making any modifications.

You will all know that OFS is rather a large collection of photos of thousands of shirts across several thousand teams. All organised in a rather large file system which when you consider all the various sizes of each shirt there is likely to be close to a million files spread over thousands of folders. Just zipping up the entire images folder takes several hours on the server as does a full scan for malicious code embedded in the files. So, it is a bit of a monster and I was coming close to a mental breakdown worrying about it.

Don't know anything about your website (volumes, traffic, commercials etc), but if it is going to be a huge job, is it worth considering moving the content and functionality ? There are lots of ways of publishing content and commercial functionality these days whereby you are paying a third party to worry about upgrades/compatability/security etc.

If you built it a few years ago, and it has grown significantly, now may be the opportunity to consider passing some of those worries over to a specialist in those services and just concentrating on content ? If housekeeping is taking that long, maybe a change is in order (particularly if you are pushed for time).

 

[timbha]

I can think of just the person who can help you but he might be out shopping at the moment

 

[Deleted member 22389]

You have probably been round the houses. Is this any help
https://forums.cpanel.net/threads/malicious-php-script-keeps-coming-back.437402/

Also check your log files.

 

[PoG]

Are you using any plugins/templates, if so are these latest versions?

 

[Stat Brother]

I can think of just the person who can help you but he might be out shopping at the moment

I just assumed he visited the site over the weekend and left a trail of destruction in his wake.

 

[Superphil]

Are you using any plugins/templates, if so are these latest versions?

Pretty much 100% bespoke, but I'll get this checked out, thanks.

 

[Bozza]

Pretty much 100% bespoke, but I'll get this checked out, thanks.

There's a lot of plugins running on the site if you look at the link I made early in the thread. From a quick scan, I'd not have any immediate concerns with most of them though.

 

[Deleted member 22389]

Pretty much 100% bespoke, but I'll get this checked out, thanks.

Also check if any cron jobs have been added without your permission, presuming your on a linux server

 

[Superphil]

There's a lot of plugins running on the site if you look at the link I made early in the thread. From a quick scan, I'd not have any immediate concerns with most of them though.

Ah, OK, thanks, I'm not fully up on the terminology, I know much of the site is bespoke, didn't really know about plugins, but thanks for clarifying that, I shall make sure my brother is aware

Also check if any cron jobs have been added without your permission, presuming your on a linux server

Thanks for that, it was something we checked already, no harm in checking again I guess.

 

[Deleted member 22389]

Ah, OK, thanks, I'm not fully up on the terminology, I know much of the site is bespoke, didn't really know about plugins, but thanks for clarifying that, I shall make sure my brother is aware



Thanks for that, it was something we checked already, no harm in checking again I guess.

Let us know how you get on.