Username/pw are being changed, not brute forced

  • Resolved aintholly

    (@aintholly)


    5 years, 8 months ago

    I’ve been using Wordfence for about a month after multiple takeovers of my website. Over the course of troubleshooting I’ve deleted plugins, old themes, hardened WordPress with .htaccess, scanned all my website files with anti-virus, disabled FTP access, reset WP salt in wp-config, and more.

    Every time attackers somehow manage to change the username to “admin” and a password to one of their choosing. There’s no notification from Wordfence, meaning they are managing to change the username and password without logging in to the WP site. I usually catch them before they login to WP, and I reset the password from phpMyAdmin. After I restore access, I scan the site with WF and come up clean.

    Today I received a WF notification because an attacker actually used the admin login. They deleted the WF plugin and installed a malicious plugin called “File Manager.” They also used a malicious php file called “resetcp.php” to reset the password, but I’ve never found a file like that before.

    The site is currently running WP 5.1.1, WF 7.2.4, Imsanity 2.4.2, Annual Archive 1.5.3 and Akismet 4.1.1. The only theme is Twenty Nineteen.

    I’m in the process of backing up my posts so that I can completely erase public_html and start with a new WP install. Other than that, is there anything else I can try to protect my site?

Viewing 5 replies - 1 through 5 (of 5 total)

  • Hey @aintholly,

    I’m really sorry to hear about this, I know how frustrating it can be.

    In addition to a fresh installation of all software I’d suggest updating your ftp/sftp and database credentials. I’d also see if your hosting provider will move you to a different server. If this continues to happen after that, I’d get with a hack repair service to make sure it’s professionally cleaned and the point of entry is patched. We offer this service if it’s needed.

    https://www.wordfence.com/wordfence-site-cleanings/

    Good luck,

    Gerald

    Thread Starter aintholly

    (@aintholly)

    Thank you for the reply. After changing the credentials didn’t help, I completely deleted the FTP user since WordPress no longer requires FTP to update like it used to. I also changed the mysql password after every hack as part of changing all related passwords. While I’d like to know how this latest malicious file was uploaded without FTP access and with no records of the offending IP address showing up in the access logs, we’ve decided to take the drastic route. We’ve completely erased the public_html site, hopefully removing anything that was allowing malicious users to upload files and change the password. The plan is to eventually re-install the latest version of WP and see if that site stays secure. The hosting provider has been involved but hasn’t been able to detect any obvious reason how they continued to gain access.

    As an aside, I fired up a Tor browser and tried to find information about hacking WP on onion sites. The continuous nature of the attacks (at least once every 5 minutes according to WF) led me to believe my specific site must have been listed somewhere as an easy-to-attack target. I wasn’t able to find anything in a few hours of searching, but I think there has to be a reason so many hackers from different countries continued to attack the site on a daily basis. Perhaps some remnant of an old theme or plugin was allowing access even though I removed it from WP.

    In summary, it seems like we’ll never be certain how attackers were gaining access. We’ll just start from scratch and hope for the best.

    Hey @aintholly,

    After speaking with a colleague about this I was wondering if I could get a little more information?

    Who are you hosting with?

    Also, can you please email me your Diagnostics report so we can review the plugins on the site? From the WordPress Dashboard navigate to Wordfence > Tools > Diagnostics then click SEND REPORT BY EMAIL to send it to [email protected]. Please also add your www.remarpro.com username and update this post so we’ll know what it’s in reference to.

    Additionally, it might be a good idea to update your cPanel/hosting credentials.

    Thanks,

    Gerald

    Thread Starter aintholly

    (@aintholly)

    Thank you again for the replies. The site is hosted by Webintellects. During the repeated hacks, the cpanel password was one of many we changed. At the hosting provider’s suggestion, we even changed email passwords and deleted unused email accounts.

    There’s no longer a site to send WF diagnostics from. We’ve decided to completely erase the public site and temporarily host the blog on a local LAMP installation. Perhaps in the future we’ll re-install on our hosting service, but for now we’re keeping it private. I’ll be sure to install WF from the get-go next time in the hopes we can avoid whatever caused it to be so easily and frequently compromised.

    Hey @aintholly,

    Thanks for the update, and I’m sorry to hear about the troubles. Please do let us know how it goes.

    Thanks,

    Gerald

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Username/pw are being changed, not brute forced’ is closed to new replies.

Tags