Why Would Anyone Hack My Site?

It’s hard for the average person to comprehend why anyone would break into their website. “I don’t have anything of value. Why would someone hack my site?”

I’ve heard that question several times in the past couple of weeks. There must be a lot of script kiddies with too much time on their hands as I’m seeing an increase lately in attempts to log in to sites I manage. I’ve also cleaned up several hacked sites in the past couple of weeks.

Two of the hacked sites were not on my Website Management Program and had fallen woefully out of date. There were plugins on those sites nearly a year out of date, not to mention WordPress versions at least that long out of date. These are disasters waiting to happen!

The third site we caught before any damage was done. The site is one of my Website Management Program clients. I was alerted within a few minutes that someone had logged in with administrative privileges using an account they had somehow created themselves. I quickly emailed my client asking if he was aware of the existence of this account.

While I waited for a response, I did some research on the account name. I found that the same account name had been used in other attacks that were reported on WordPress.org’s support forum. The logins came from a well known hosting company’s server so it’s difficult to tell if the breach was due to a security flaw in a plugin, or if the hosting company had a security hole allowing access to websites on their servers.

In any case, having found this, I quickly deleted the account and locked out the IP address from which the login originated. I then changed the admin passwords in WordPress for my client’s account and my own account. I also changed his hosting acccount password and the password for his WordPress database. His original password had been moderately strong, but not all that difficult to guess, so I changed it to a strong password until he could log in and come up with a strong password of his own.

Finally, I contacted the client and had him do a complete anti-virus scan using his usual anti-virus program and another called Malware Bytes. I’ve found Malware Bytes to be an excellent “second pair of eyes” to complement the usual anti-virus software found on most machines. Malware Bytes tends to catch things others don’t. No anti-virus catches everything, which is why I recommend periodically running Malware Bytes as a safety check in case the primary anti-virus misses something.

Once we were sure his machine was clean, I sent him his new passwords. He contacted his hosting company, which happened to be the same one from which the attack came, and arranged for them to scan his site regularly for malware. This is something a good hosting company should be doing anyway, but in the case of this host it’s an extra cost option, a big reason why I don’t recommend them.

In any case, once we had his site secured, my client asked “Why would anyone hack my site?” A perfectly legitimate question as his site doesn’t take credit cards or store any sensitive information, things you would think a hacker would be after.

The answer to that question ranges from “because they can” to “so they can use your site to spread malware” and everything in between. Some hackers just do it because they get a kick out of getting into something they’re not supposed to be in. Once in, they’ll leave some evidence that they were there, and move on to the next challenge. They tend to be more annoying than dangerous.

Others want to use your site as a repository for various malware, sometimes known as “drive-by” malware sites. One of the sites I cleaned up had been infected with malware and my client became aware of it because Google blacklisted her site. Those of you who use Google a lot, or use Google Chrome for browsing have seen the warning messages indicating that proceeding to a particular site is dangerous and could infect your machine with malware. Imagine going to your site and being confronted with that screen instead of your home page!

We were able to clean up her site and get Google to take it off the blacklist, a topic I’ll cover in another post. Her site is now up to date and being monitored for updates so that it will be kept up to date to hopefully avoid a future incident.

The moral of the story is to keep your WordPress site updated and backed up! Updates are posted for plugins on a fairly frequent basis as flaws are discovered and fixed. The same is true for WordPress itself, although updates to WordPress tend to be much less frequent. Even themes have potential vulnerabilities and need to be kept up to date.

As the saying goes “be careful out there!” Feel free to ask any questions and/or comment below.

John
The Small Business Website Guy on Google+