Why did a hacker hack my website?

Dat klopt, de meeste hackers richten zich niet specifiek op één bepaalde website. In plaats daarvan schrijven ze scripts of geautomatiseerde programma’s om tientallen, zo niet honderden, websites tegelijk te hacken. Deze scripts zijn niet selectief en proberen elke kwetsbare website die ze tegenkomen te gebruiken voor hun doeleinden.

De reden achter het schrijven van deze scripts is vaak om zoveel mogelijk reclame te verspreiden en zo geld te verdienen. Ze plaatsen bijvoorbeeld advertenties op gehackte websites of sturen e-mails via het domein van de gehackte website om producten of diensten te promoten die de hacker aanbiedt. Dit kan voor hen lucratief zijn, vooral als ze toegang krijgen tot een groot aantal gehackte websites en zo een breed publiek kunnen bereiken.

Voor veel hobbywebsites kan het verwarrend zijn waarom ze het doelwit zijn geworden van hackers, maar in werkelijkheid hebben de hackers waarschijnlijk geen specifieke reden om juist die specifieke website aan te vallen. Ze richten zich gewoon op kwetsbare websites in het algemeen om hun eigen winst te maximaliseren. Daarom is het belangrijk voor alle website-eigenaren, of het nu hobbywebsites zijn of bedrijfswebsites, om hun websites goed te beveiligen en regelmatig te controleren op mogelijke kwetsbaarheden. Zo kunnen ze de kans verkleinen om slachtoffer te worden van dergelijke geautomatiseerde hackpogingen.

WordPress, a feast for owners and hackers alike

Het is indrukwekkend om te horen dat je al sinds de begindagen van WordPress, toen het nog slechts een blogplatform was, betrokken bent bij het ontwikkelen van websites. WordPress heeft inderdaad een lange weg afgelegd en is uitgegroeid tot een van de meest prominente Content Management Systemen (CMS) ter wereld.

Als open-source software met een grote community en duizenden gratis plugins beschikbaar, heeft WordPress inderdaad een aantrekkelijke propositie voor gebruikers en ontwikkelaars. Echter, het succes van WordPress heeft ook hackers aangetrokken, en het platform staat bekend als een van de meest gehackte CMS-platforms vanwege de vele mogelijke aanvalsoppervlakken.

Het hacken van een website of plugin is geen eenvoudige taak, maar ervaren programmeurs met kennis van PHP, HTML en MySQL kunnen na grondig zoeken een lek vinden en mogelijkheden ontdekken om ongewenste acties uit te voeren binnen WordPress. Veel slimme personen wereldwijd, waaronder werkloze IT-professionals, schrijven scripts om geld te verdienen door spam en andere kwaadaardige activiteiten te verspreiden.

Als expert op het gebied van WordPress-beveiliging, zorg je ervoor dat potentiële lekken in plugins worden opgespoord en aangepakt om de veiligheid van de websites te waarborgen. Door specifieke maatregelen te nemen, zoals het voorkomen van injecties in de database, het beschermen tegen bestandsherhaling, het controleren van bestandstoegang op de server, het beveiligen van gebruikersnamen en wachtwoorden, het implementeren van backups, en het beperken van loginpogingen, zorg je ervoor dat de WordPress-websites goed beschermd zijn tegen aanvallen.

Met de expertise van WPbeveiligen kunnen website-eigenaren hun WordPress-sites geruststellen en ervoor zorgen dat hun online aanwezigheid veilig en beschermd blijft tegen kwaadaardige aanvallen. Door continu de beveiliging te optimaliseren en kwetsbaarheden te elimineren, kunnen ze een betrouwbare en stabiele website-ervaring bieden aan hun gebruikers.

Why are hackers hacking?

Hackers committing cybercrimes have become increasingly common. Hacking can be done from the comfort of one’s home, and hackers can remain anonymous if they know how to cover their tracks.

1 in 5 Dutch individuals will eventually be confronted with a hacked website, hacked social accounts, compromised computers, or even hacked smartphones.

Money or in some cases “fame” is the motivation for hackers to target websites, especially if they can redirect visitors to their own (often illegal) websites. For hackers, it’s not about quality, but quantity. If a website is easily hackable with a script, hackers will use it as a means of advertisement.

Hackers can monetize their activities by operating websites that fish for bank credentials or sell products. By increasing the number of visitors and links to their website, they can rank higher on Google and generate revenue from product sales.

Hackers often evade capture by using proxies or different IP addresses. They might operate from internet cafes or use other people’s Wi-Fi connections. Similar to how burglars work at night to avoid detection, hackers try to remain unseen. Once a website is hacked and redirects visitors to an illegal website or webshop, the hacker behind the attack is concealed, and the compromised website becomes the end of the line.

Hackers can gain entry to a website personally by phishing for usernames and passwords, but more often, they exploit known vulnerabilities within a system. They may use brute force attacks to try multiple passwords rapidly or perform a SQL injection to access the MySQL database and disable security or create their login credentials. Other methods include gaining access through FTP, admin panels, databases, or malware that records keystrokes and sends them to the hacker.

Yes, hackers are considered criminals as their actions often cause harm and incur costs to website owners. Cybercrime is not limited to individuals with tattoos and criminal records; even seemingly innocent individuals like teenagers or young adults can engage in hacking without realizing the legal and harmful consequences.

To protect against hackers, using Ithemes Security PRO is recommended. This plugin ensures that WordPress is not easily exploitable, and it thwarts hacker attempts to hack into the system. It tracks login attempts and injection trials, and it also creates backups of the database and records server changes, allowing easy restoration of the website if needed.

10 ways to open up WordPress to hackers

These are the 10 things you absolutely should not do if you want to keep your WordPress secure:

  1. Keeping the username “admin.” Most scripts are designed to perform a brute force attack in combination with the username “admin,” where thousands of passwords are attempted on your admin page.
  2. Leaving “admin” in the wp-admin link without setting a maximum number of login attempts. Setting a limit to 3-5 login attempts will deter brute force attacks.
  3. Displaying your username above each post. Choose a different name for publishing posts!
  4. Leaving the comment area open without an anti-spam plugin. If you don’t use comments or rarely receive them, consider disabling the comment section.
  5. Using the website name as your login username or password. This is one of the first combinations attempted by hacking scripts!
  6. Using dozens of plugins. The more plugins you have, the higher the chances of one having a vulnerability. Exploiting a vulnerability in one of your plugins can lead to a MySQL injection or the creation of files on the server.
  7. Leaving the WordPress version number in the source code. Hack scripts can easily find the exploits (vulnerabilities) associated with that specific version.
  8. Not updating WordPress for 3 years. This might have been acceptable when WordPress was relatively new, but due to its popularity, there are now numerous scripts scanning the internet for WordPress sites.
  9. Illegally downloading and using plugins and premium themes. Sites offering illegal themes often insert their ads or backdoors into the theme. A simple line of code can collect and transmit information to the hacker.
  10. Using the cheapest hosting. The server is also a target for hackers. They attempt to access the server through vulnerable WordPress websites to launch attacks on other sites. Cheap web hosts, unfamiliar with WordPress and not focused on security, often have slow servers, leading to slow website loading times.

These are the 10 points you can change to make it more difficult for hackers to compromise your WordPress website.

Alternatively, you can let WPbeveiligen proactively secure your WordPress, addressing these 10 points and more than 30 other security measures!

Goofballs and Malware

The internet is anonymous, and as a customer told me last week: ”The internet is full of weirdos and malware.”

Types of individuals we deal with:

Regarding hacks and malware, we encounter a wide range of individuals, but of course, we never get to know the person behind it since every “weirdo” has the intelligence to hide behind a proxy.

Professional Programmers

An example of brilliant programming work:

Today, we came across JPEG images in the uploads folder.
Not strange, right?

Until you open the file with a PHP editor and find code that opens up your WordPress website to hackers.
The hackers go beyond this trick and provide a good piece of programming work to make these files executable.

voorbeeld

The Script Kiddies

An internet term used to refer to individuals who simply execute a script to “hack your website.”

This is a large group, mainly consisting of young people. They watch some YouTube videos and follow the steps taken by seasoned hackers to hack a website.

Unfortunately, with the average WordPress website lacking additional security, they still have a chance of success.

The Weirdos

There’s a group of hackers seeking “fame”. It doesn’t matter which website they breach, as long as their name or advertisement appears on the site.

In some cases, you might end up with an entirely new homepage with a fictional alias and an image displaying their logo clearly. Most of the time, however, your website unknowingly promotes expensive products that you have nothing to do with. Sometimes legally, sometimes illegally.

Conclusion

Individuals from all over the world target WordPress users, ranging from brilliant people doing it for “big money” to those who only have a computer and deep debts and want/need to earn something because they don’t receive benefits in most countries, and their entire family is suffering.

Each person has their motive for engaging in these illegal activities, and it is our responsibility to ensure they can’t access your WordPress!

Our website is full of articles and tips on how to prevent weirdos and malware. Feel free to read more!

Interview with a hacker, “hacking for fun”

This is an interview with a hacker who has been active in hacking websites and applications for several years. The hacker wishes to remain anonymous, and we will therefore not mention any name.

How did you start hacking?

It all began years ago when I was 16. I read about taking over someone’s Windows PC to play pranks like opening and closing the CD-ROM drive remotely. Then I learned about shutting down the PC, which also seemed fun. But it quickly became boring as I couldn’t see the person’s reaction. Also, back then, there weren’t as many laptops, and most of them didn’t have webcams, which I would have liked to see at that moment.

That sounds relatively harmless, but I understand you have been involved in other activities in recent years.

Yes, the feeling of having power over someone or “breaking in” was quite addictive. Eventually, I started sending keyloggers via email, allowing me to receive weekly emails with everything they typed. But even that became dull, as there wasn’t much interesting stuff to read.

And then you started hacking websites?

Well, not directly, as it was quite challenging to learn, and everything online changed so fast. It actually started with an acquaintance who had a website. Just for fun, I tried some login credentials, and he used his own name as the user and password, which he used everywhere, even for games, etc.

So, just for fun, I changed a few words on the website.

With someone you knew personally?

Yes, just for fun, harmless… I only changed a few words, giving the information a different twist.

How did you progress to the point where you started seriously intruding into other people’s websites, I assume strangers?

Well, intrusion… I’d say they left the backdoor of their website wide open, and I just walked in. And they weren’t strangers because the first websites I started hacking belonged to people I didn’t really like. My former employer and a few individuals who deserved it. I mean, it’s still quite decent, right? I didn’t physically harm them but just took them down a peg.

I only modified their websites. I deleted all the pages and uploaded my own page with a nice picture.

It’s really that simple once you’re inside the server.

Aren’t you afraid they might catch on or report you to the authorities?

They have to find me first. I have a way to be “invisible” on the internet without leaving my IP address, etc.

Are you still very active? Should I think about one website per week, per month, or…?

No, not at all. Occasionally, when I have free time, I turn on some hacking software and try to get into a website. Sometimes, I even email them. I politely tell them they have a vulnerability and how to fix it. But most of the time, I don’t get paid for it, even though I provide my Bitcoin address. Not even a tip for the effort, so it’s more fun to hack a well-known or popular website and mess around with it.

Thank you for the interview.

You’re welcome. It’s also nice to share sometimes. Most of what happens on the internet is anonymous because I prefer to keep everything private from acquaintances. They usually wouldn’t understand anyway.

This is how a hacker earns from your website

Placing even a small piece of code on your website can allow a hacker to display advertisements on your website, which can earn them money through affiliate programs.

How much money does a hacker make?

A simple hacker may earn around 10-50 euros per month by targeting a few websites. However, if a hacker or a team of programmers cracks a plugin and gains access to 10,000+ websites through that plugin, the earnings can be significant.

geld

There have been cases where companies with programmers nearly go bankrupt and resort to hacking websites to generate income through advertising networks or selling their own products. Such actions harm many websites and can quickly generate substantial profits for the hackers.

How innocent is hacking a site?

Injecting a link into a website. That should be harmless, right?
WRONG! It is an intrusion into someone else’s property. It robs the victim of their income and the investments made to build a good website.

Hacking, whether it targets small sites or large business websites, is a criminal act.

The hacker gains, and you lose

 

Your Google ranking takes a hit..

Google will notice that your website is displaying information that doesn’t belong to it.

Especially in the case of adult content or illegal pharmaceuticals, your reputation will quickly deteriorate.

If a hacker’s code redirects your website to another site or offers unsafe files through your website, Google may choose to block access to your website with a red warning screen. This warning appears on Google Chrome browsers on desktops, tablets, and phones, as well as in the description of your website in Google search results.

google blokkeerd website uit veiligheid

You lose potential customers..

Customers visit your website or online shop but see that it is unsafe, so they perform a new search on Google and end up at your competitor’s website.

Restoring a hacked website..

You need to ensure that your website is free from viruses and hacks. Searching for malicious code takes time for every programmer, not to mention finding and closing backdoors; otherwise, the website may be hacked again within a few days!

Preventing your website from being hacked

A hacker uses specific tricks and exploits vulnerabilities in plugins and WordPress. These can include forms, upload directories, the well-known login address, files containing sensitive information, the database, and more.

We secure WordPress websites against hackers, offering hack-free guarantee!

Get your WordPress website secured now

Who hacked my website?

Your website has been hacked, and it now displays advertisements for another website and product. Or the hacker has used your website/server to send out thousands of spam emails.

That’s not a pleasant situation! And after removing the hack, you may want to track down the hacker.

But you won’t find them.

Why you won’t find the hacker

Hacks are 999 out of 1000 times automated. This means the hacker has written a script that searches for sites one by one and tests them for vulnerabilities.

  1. The script runs on a server, and not from the hacker’s computer.
  2. The hacker who launched the script for the first time did so through a “detour”. The data ended up on the internet through many other computers.
  3. There are more than 10,000 scripts in circulation. The scripts are also reused by others who did not develop them. It could be just a student or your neighbor who is not a programmer, making it impossible for you to expect it from the person.
  4. The product the hacker is advertising goes through advertising sites in different countries, each with its privacy laws.
  5. The name of the hacker is often a fictional name that is used by multiple people.

Prevention is better than cure

We have various clients who want to recover the costs of restoring their website from the culprit, the hacker who developed the script with malicious intent. However, no matter how good your connections are or how many computer specialists or detectives you hire, you won’t find the culprit quickly, let alone bring them to court.

So, prevent your website from being easily hacked by scripts!

Have your WordPress website professionally secured.

 

Finding WordPress hackers through server logs

Imagine your WordPress website has been hacked, but you don’t have any security plugins running. Or worse, the hacker has disabled the security plugin.
Then you have no idea what has happened, you don’t know which files have been modified, how the hacker gained entry…

Finding Server Logs in DirectAdmin

Server logs record EVERYTHING. However, they are in raw server language without any formatting. In DirectAdmin, you can find the server logs by logging in and navigating to Your Account » Site Summary / Statistics / Logs » Full usage log.
weblog

weblog

Understanding Server Logs

A lot of information will be presented to you.
There is a specific order in which we will guide you through the logs, so you can understand them.

server logs

  1. First, you will see the IP address.
    This points to the computer/router of the potential hacker.
  2. Next, you will see the date.
    Keep in mind that the server time may differ from your local time.
  3. Then, you will see a GET or POST command.
    This is important because a hacker or script will typically execute POST commands on your server/website.
  4. After that, you will see the requested URL.
    Here, you should see regular pages and information that a visitor can request.
    If you see URLs such as XML-RPC.php and other files on the server, you can assume that it’s not a regular visitor.
  5. Finally, you will see the User Agent.
    This refers to the browser/operating system being used.

Now that you can read the server logs, you can investigate the history of your website and the actions of the hacker.
Here, we use the term “hacker,” but in 9 out of 10 cases, it refers to a script executed by the hacker or even an automated script that the hacker no longer pays attention to. They only look at the outcomes and results.

Finding the Hack(er)

A server log can easily contain 2000 lines, and you may only have the logs for the last 24 hours.
(We assume that you have discovered the hack on time or that it is a recurring hack.)

What to look for:

You will search for specific keywords, which can be done by opening the log file in your browser or using your favorite text editor.

  1. POST – As mentioned earlier, a hacker or script executes a command on your website to achieve something.
  2. XML-RPC and other PHP files – A visitor opens pages and posts, NOT PHP files.
  3. IP addresses from strange countries – If you have visitors from China, Russia, Germany, France, etc., while your website is targeted at a Dutch audience, and they access a large number of pages and/or files, it is highly suspicious. Use the IP Location finder to determine the country of origin for a user.

As a programmer, you can do this using Notepad++ or any other code editor that allows you to highlight lines directly.

Knowledge is Power, but not Victory Yet

Now that you can read the logs, have found the hacker, and know which actions they have taken, you can start undoing the consequences of the hack.

In many cases, the hacker has placed files or inserted text ads. These can be removed or reversed by restoring a backup.

But! You’re not done yet

The hacker has gained entry, whether manually or through a script, and it will happen again unless you secure your website with a WordPress Antivirus plugin.

Configure the plugin properly and follow all the necessary steps to make your WordPress site secure and hacker-proof!

And as always, back upback up, and back up some more backups!

5 types of hackers and their shenanigans

We encounter hundreds of hacks each year, each one more cleverly devised than the other. For example, one day you may open your website’s homepage and find nothing but a blank page with the text: hacked by… This is called “defacement,” which simply means that your page has been redesigned and altered. Fortunately, only the homepage may be affected, and the rest of your pages may still be accessible.

Another type of hack is known as “the link builder.” Your website remains mostly the same, with a few details changed. You may find pieces of text with links to a shady website. The sole purpose of this hack is to build links so that Google ranks the hacker’s site higher in search results. However, your website’s visibility on Google will significantly decrease due to advertising these dubious products.

Then there’s “the shoplifter,” who targets your online store. They hack their way in and modify the payment options, leaving only one remaining. And as you might guess, that payment option redirects to their own PayPal or bank account, allowing them to receive money from your customers. Usually, the funds are transferred to the account of a so-called “money mule.”

“The script kiddie” refers to a young boy or girl who simply picks up some scripts from the internet and alters some text or the layout of your website. These youngsters are often referred to as script kiddies. However, it’s essential to mention that their actions are no less criminal and should not be taken as a joke. The website owner incurs damage due to the loss of customers and the expenses incurred when a webmaster or security agency needs to repair and secure the website.

Finally, there’s “the corrupt web agency,” which consists of companies in countries like Russia, Pakistan, etc., who struggle to earn enough to support their families. Out of desperation to make ends meet, they misuse their knowledge. Their team of programmers and server specialists develop sophisticated viruses that embed themselves in servers and websites. These hacks are of a high level, requiring more effort to get rid of them. They often target the funds of your online store or promote their own webshop through advertisements. They frequently redirect visitors to their own website or webshop as well. They exert direct and noticeable control over your website, using clever tricks and backdoors.