Hacked site
-
Kofod95
- Senior Contributor
- Posts: 748
- Joined: Sat Feb 06, 2021 7:38 pm
- Phoenix Version: 1.0.8.20
- Has thanked: 99 times
- Been thanked: 179 times
Re: Hacked site
Sorry to hear that you've been hacked!
If you have back-ups, that would be the way forward. If not, you should be able to, fairly quickly, install a new site and add the add-ons you need, add the override files and css and then the db (you might be able to use the same db - that depends whether or not that has been hacked as well).
Of course, you should make sure to close the security hole before going live again
//Daniel
If you have back-ups, that would be the way forward. If not, you should be able to, fairly quickly, install a new site and add the add-ons you need, add the override files and css and then the db (you might be able to use the same db - that depends whether or not that has been hacked as well).
Of course, you should make sure to close the security hole before going live again
//Daniel
I'm not smart, but sometimes even a blind chicken can find a corn.
Here are a lot of corns: Phoenix user guide
Here are a lot of corns: Phoenix user guide
-
burt
- Core Team
- Posts: 4547
- Joined: Tue Oct 29, 2019 9:37 am
- Phoenix Version: v1.1.0.8
- : Buy Me A Beverage
- Has thanked: 252 times
- Been thanked: 412 times
Re: Hacked site
The most important thing is to take your site offline while you clean any infected files.
We need more data to even have a chance of helping you.
What ecommerce software are you using? What version?
WHat PHP version? WHat host? What is the "hack"?
The only site that I know of yours is currently up and running on osCommerce 2.3
We need more data to even have a chance of helping you.
What ecommerce software are you using? What version?
WHat PHP version? WHat host? What is the "hack"?
The only site that I know of yours is currently up and running on osCommerce 2.3
-
heatherbell
- Senior Contributor
- Posts: 2540
- Joined: Mon Oct 07, 2019 4:39 am
- Phoenix Version:
- Has thanked: 35 times
- Been thanked: 243 times
-
14Steve14
- Senior Contributor
- Posts: 920
- Joined: Fri Oct 25, 2019 7:01 pm
- Phoenix Version: v1.0.9.1
- Has thanked: 17 times
- Been thanked: 103 times
Re: Hacked site
Sorry that your site has been hacked.
I was reading somewhere where a person just overwrote all the current sites files with a good known backup copy, and the site was still hacked. The thread was saying to delete all the old files from the server, and upload a fresh copy of the files, which should remove any files added by the hacker. The trouble is that if a hacker got in once, the chances are they will be able to do it again, and quickly. The second time could be even worse than the first.
Hopefully all the data, and especially the customer data is all secure and has not been touched.
You could also try asking your hosts for help and advice.
I was reading somewhere where a person just overwrote all the current sites files with a good known backup copy, and the site was still hacked. The thread was saying to delete all the old files from the server, and upload a fresh copy of the files, which should remove any files added by the hacker. The trouble is that if a hacker got in once, the chances are they will be able to do it again, and quickly. The second time could be even worse than the first.
Hopefully all the data, and especially the customer data is all secure and has not been touched.
You could also try asking your hosts for help and advice.
Re: Hacked site
By going to https://www.virustotal.com and put in the website and there it is .
I have two web site one using the old OSC which I will shut down and one with CE Phoenix v1.0.8.0, which I will keep and move forward with.
My host is Host Gator,
Now looking around I can see where some hacking is.
I have very limited knowledge but it would appear a folder has been installed, called "ssI" which has these folders "certs, csrs, keys, private.
with this type of text of which there are 31 of them attached at various dates within a few months.
To me does not look correct.
I have two web site one using the old OSC which I will shut down and one with CE Phoenix v1.0.8.0, which I will keep and move forward with.
My host is Host Gator,
Now looking around I can see where some hacking is.
I have very limited knowledge but it would appear a folder has been installed, called "ssI" which has these folders "certs, csrs, keys, private.
with this type of text of which there are 31 of them attached at various dates within a few months.
To me does not look correct.
-
ecartz
- Core Team
- Posts: 3084
- Joined: Tue Nov 05, 2019 6:02 pm
- Phoenix Version:
- Has thanked: 4 times
- Been thanked: 208 times
Re: Hacked site
If you delete the ssl directory, make sure to back it up first. That looks like an SSL certificate, so it may turn out to be something that you need, perhaps installed by your host.
Do not post "private" keys in the public forum.
Do not post "private" keys in the public forum.
-
puddlec
- Member
- Posts: 31
- Joined: Mon Dec 07, 2020 3:11 pm
- Phoenix Version:
- Has thanked: 1 time
- Been thanked: 7 times
Re: Hacked site
i got the same folder on mine from my host who uses cPanel (AutoSSL)
the dates that the various files have matches up with when it updated my lets encrypt SSL certs.
also matches up with the cPanel email i got, i also get an email from an SSL tracker website i use to check the dates, and tells me when it sees a new cert (which i got a few hours later)
so it is perfectly normal to have those folders/files
the dates that the various files have matches up with when it updated my lets encrypt SSL certs.
also matches up with the cPanel email i got, i also get an email from an SSL tracker website i use to check the dates, and tells me when it sees a new cert (which i got a few hours later)
so it is perfectly normal to have those folders/files