Its the 2nd time i have been hacked within a short time: .htaccess:
ErrorDocument 400, 401, 403, 404 and 500 has http://greencoffee-fatburnsolution.com/?12/2
.
I use fireFTP where i used to store the login details in and i was told(makes sense now), that i should use a program like KeePass to protect my passwords. So i went and restored an old backup + changed password and used KeePass, but after some days, it has been hacked again.
I use OXID 4.7.4_57063 and im about to upgrade to the newest version. Any suggestions or questions please?
this topic is not really OXID relevant as in my opinion it belongs to the security of your computer. What I saw very often is that a Windows machine has been infected with a malicious software that scans the usual paths of ini files where FTP programs store their passwords non-encrypted.
With this data, it is pretty simple to log in to somebody else’s FTP and make changes to the files.
What I would do in this case:
change all credentials relevant for your system (FTP, database etc.) immediately
store this credentials in Keepass
do not store these credentials in your FTP program
change the path of the file that contains the passwords
get a virus scanner and clean up your machine etc…
Thats what i did the first time (Clean pc with spybot + scanned with microsoft security essential + used keepass and changed my password + didnt store anything in fireftp). Im not sure what you mean about the “change the path of the file that contains the passwords”.
So my guess is, that its something else, thats giving them access? oxid module ? something old on my host, like php virtualmin etc?
[QUOTE=gnomic;128670]
So my guess is, that its something else, thats giving them access? oxid module ?
[/QUOTE]
Unlikely
[QUOTE=gnomic;128670]
something old on my host, like php virtualmin etc?
[/QUOTE]
Well - who knows…
The main point is to change the credentials for your server immediately so once the old credentials are compromised they cannot be used any more.
@websacker
thats what i did the last time? full scan with multiple software, keepass and changed all my logins. Now it happened again = probably not the issue then. Maybe this is:
Netsparker issues, added to OP
Spoke with my host about it the first time it happened and they said what you said(which i now have done.) and it wasnt an issue with old versions of php etc. many did that… sounds weird to me, what do you guys think?
@websacker
Okay, thats good to know.
What would you then suggest i did? its probably not oxid, modules or the things my host runs = its probably still something at my end - if yes, whats the next move. Should i use other program? what programs do you guys use? or is there something else then me pc, that might cause this?
you should probably ask for some advice in a pc / software / security forum instead of ecommerce forum.
We are developing online shops, not hacking them
Try to find out the way of attack by checking log files, apache and ftp.
If you think passwords were stolen from your PC, double check your PC is trojan free. You should do a full scan of your PC with some different AV Programs. Get some good AV Programs (most of them are free for testing). Uninstall your current AV Program, install a different one and do a full scan. Then the same with another one. You can get an overview of AV Programs at http://www.av-test.org/ or http://www.av-comparatives.org/.
gnomic, at least your hosting provider must be able to find out the server logs which IP address was able to gain writing access to your .htaccess. They also should be able to find out how this access was gained. Impossible to resolve that in forums fishing around…
