someone hacked my wife's website

[DerekWilson]

hi guys,

i'm not a web coder by any means ... but i do dabble. i helped my wife put a website up for her comic.

it has been hacked. i don't know how they got in and i haven't found everything they did ...

i'm not sure if there is anything malicious on it, so head there at your own risk if you wanna check it out...

iqp.laurascomics.com

i can't even find the code that's creating that pop up ... not that i've been able to look very in depth. i'm quite frustrated and am going to bed for the night.

they actually deleted a bunch of her comics, replacing the data in the image files with hacking tools ...

...

i know i could really tighten security up by locking everything down, but my wife needs an easy way to upload images to the site, so i've got a couple scripts that are able to create new files that have to stay (or maybe i need another way to do it that's more secure).

i could use some general advice on securing web sites and some specific advice on this situation if possible.

thanks.

 

[lxskllr]

I don't know anything about HTML, but it looks like the server got hacked, and they dicked around a bit with the coding. I think it's fairly benign, but you need to find the hole they got through, and patch it.

 

[RebateMonger]

The script for the popup is two-thirds the way down the HTML code for the home page.

Offhand, I don't see any other scripts on other pages, but I didn't look at them all. Also, I don't see anything nasty that's attempting to download onto a fully-patched XP box (in a Virtual PC window).

What kind of server is the site hosted on? Is your own?

 

[lxskllr]

I was going to post the code, but the forums wouldn't let me. I didn't feel like editing the HTML, and it looked like the HTML would get stripped if I used the "attach code" feature, so I didn't bother.

 

[mechBgon]

For starters, change the password used to log in for website administration. Make it something complex enough and long enough to withstand brute-force attacks.

 

[SagaLore]

PM sent.

The server seems fine to me. Its the php comic strip application that you're using that allowed the compromise. A poorly sanitized GET statement probably allowed the php to publish a new comic without any credentials, and even further lack of sanitization of the comic data allowed script tags to be used in the form's dropdown option label.

Feel lucky they didn't load a remote .js with a more serious payload.