For your specific case, unfortunately it can be anything. Start at the HTML and JS and see if it's different in ways you don't expect. Check for obfuscation techniques like base64 encoded PHP code, or JS code in libraries that is not in the original distribution. It really can be anything. Also check your .htaccess, any CMS and its plugins, etc. Really check everything.
That should identify the issue. Once you do, fix it, and try to understand why it happened. Was your FTP password compromised? Was it a known vulnerability in your CMS? Was it a rogue plugin you installed by mistake? Identifying the attack vector is very important as you will need to close it too. Otherwise all your hard work fixing the site will be undone in no time.
Also be sure to check any other parts of your site: the attacker might have entered through one CMS (say a forum) and compromised another (say a blog).
That's basically a summary of what you need to be doing. We have a very detailed guide about dealing with hacked sites: http://www.google.com/support/webmasters/bin/answer.py?answe... . It recommends quarantining the site and returning HTTP 503. That's a very good first step.
And if you need more help, seriously, the forum I linked to above has a great community that knows a lot about identifying and fixing these issues.
Hello Pierre, thanks for chiming in, I appreciate it.
So it appears that we were in fact compromised. The problem is that the Webmaster tools didn't show this until a good 30 minutes after the browsers started complaining. How can this be? Now I feel terrible for posting this in the first place, I would hate to compromise anyone! :(
As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected.
It's a pain to get hacked, but on the bright side it will probably help you harden security in the longer run. Some quick, simple tricks (e.g. use an .htaccess file to make a whitelist of IP addresses that can access your /wp-admin/ directory) can give a lot of protection.
Comments
Hi
I work at Google helping webmasters. Hopefully there won't be a next time, but for reference, your best bet is to post in our forum specifically about this type of issue: http://www.google.com/support/forum/p/Webmasters/label?lid=2...
For your specific case, unfortunately it can be anything. Start at the HTML and JS and see if it's different in ways you don't expect. Check for obfuscation techniques like base64 encoded PHP code, or JS code in libraries that is not in the original distribution. It really can be anything. Also check your .htaccess, any CMS and its plugins, etc. Really check everything.
That should identify the issue. Once you do, fix it, and try to understand why it happened. Was your FTP password compromised? Was it a known vulnerability in your CMS? Was it a rogue plugin you installed by mistake? Identifying the attack vector is very important as you will need to close it too. Otherwise all your hard work fixing the site will be undone in no time.
Also be sure to check any other parts of your site: the attacker might have entered through one CMS (say a forum) and compromised another (say a blog).
That's basically a summary of what you need to be doing. We have a very detailed guide about dealing with hacked sites: http://www.google.com/support/webmasters/bin/answer.py?answe... . It recommends quarantining the site and returning HTTP 503. That's a very good first step.
And if you need more help, seriously, the forum I linked to above has a great community that knows a lot about identifying and fixing these issues.
Hope this helps, Pierre
Hello Pierre, thanks for chiming in, I appreciate it.
So it appears that we were in fact compromised. The problem is that the Webmaster tools didn't show this until a good 30 minutes after the browsers started complaining. How can this be? Now I feel terrible for posting this in the first place, I would hate to compromise anyone! :(
As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected.
It's a pain to get hacked, but on the bright side it will probably help you harden security in the longer run. Some quick, simple tricks (e.g. use an .htaccess file to make a whitelist of IP addresses that can access your /wp-admin/ directory) can give a lot of protection.
Wow a reply from Matt Cutts himself! _blushes_ :)
Thanks for the explanation, and it makes sense. One thing I would suggest is to update the docs to point this out!
"Please trust the warning over what Webmaster tools says as they might take a while to update".
Love the idea of the .htaccess for /wp-admin/, I'll make sure the WPEngine guys implement that for our site.
So sorry for this whole hoopla everyone, and thanks for the help.
Happy to try to help, and good point about whether we should update the docs.
P.S. This incident aside, nice job on the site--bootstrapping is cool, and I like the idea of lo-fi mockups that are quick and easy to make.
Thanks for the feedback. I'll pass it on.
And good luck with fixing the hack!