Webmasters, help! My website has been blacklisted

[tamrahennatx]

My site has been hijacked and is spreading malware - not only mine but two others that I manage. My host gave my instructions on how to get google to remove the blacklist once the sites are cleaned but not how to figure out what happened and fix the problem.

Has anyone else dealt with this? What did you do?

[dunyah]

Ack! Friggin' hackers. I don't know, but why aren't the service providers more responsible for stuff like this? Someone got through your password to get into your site and do this. It seems like the service companies should figure out ways to stop them.

I hope you get it resolved soon.

[nitara]

You most likely have a cross-scripting vulnerability (XSS exploit). I would check any javascript for features that'll accept a user input such as a search box, share button, a comment feature, anything that'll spawn a pop-up, etc. If you can inject a script in there, so can a hacker. Also, if you support flash, make sure you have the latest and greatest version.

[tamrahennatx]

The only think I have on my web page is a twitter feed script and an email list sign up box - would either of these leave me vulnerable? And I can't get a look at the corrupted file to see what's in it because my computer's anti-virus quarantines the file. ARGH!

[Asim]

The only think I have on my web page is a twitter feed script and an email list sign up box - would either of these leave me vulnerable?

YES. Any data-gathering form on the 'Net is a potential way for someone to hijack your server, as nitara notes. And they don't even need to implement XSS to do it; there's a host of new techniques for doing this, and it's really an arms race...*sigh*

One way to find out exactly what's going on is to "ask Google". They have a page that tells you ways to clean it off manually, as well as instructions on how to get a Google report on what they're finding that's an issue, and, it seems, how to resolve it as well.

Note that this involves signing up for Google Webmaster Tools, which I recommend anyway. However, the verification tends to require you to change files on the infected system, although I think there's a way around that.

I'd offer more help, but I'm going to Reda and then Pennsic, so I'm slammed mad. I hope this helps!

[Aziza_UAE]

'....it's really an arms race' yeh, sad but true Asim.

[tamrahennatx]

YES. Any data-gathering form on the 'Net is a potential way for someone to hijack your server, as nitara notes. And they don't even need to implement XSS to do it; there's a host of new techniques for doing this, and it's really an arms race...*sigh*

One way to find out exactly what's going on is to "ask Google". They have a page that tells you ways to clean it off manually, as well as instructions on how to get a Google report on what they're finding that's an issue, and, it seems, how to resolve it as well.

Note that this involves signing up for Google Webmaster Tools, which I recommend anyway. However, the verification tends to require you to change files on the infected system, although I think there's a way around that.

I'd offer more help, but I'm going to Reda and then Pennsic, so I'm slammed mad. I hope this helps!

Thanks Asim. I'm working on these things, and I've disabled anonymous ftp access and reset my passwords as well (both cPanel and ftp login passwords are changed and are different from each other).

It seems to be restricted to only my index page, so I'm assuming that by uploading a new page I can fix the problem?

Should I get rid of my twitter feed and email form altogether or is there any way to make these more secure?

[tamrahennatx]

The problem has been resolved and my website is back up, yay!

[bintbeled]

*whew* I bet you're relieved.

[tamrahennatx]

*whew* I bet you're relieved.

I am, and I've learned a bit in the process. It actually took less time than I thought it would to correct the issues.