Eek! Have I been hacked?

[Ginarosemartin]

Just noticed that when I log onto my oscommerce site, instead of saying the site name at the very top on the explorer title bar, it says "Hello Man, you'r hakked". Does anyone know what this means? Thanks all, Gina

[natewlew]

I think you need to change your passwords as soon as you can. I would also change your hosting account passwords along with your OSC admin password(s).

[abra123cadabra]

Check how they could access your shop. Did you protect your amin panel?

 

abra

[Jack_mcs]

Just noticed that when I log onto my oscommerce site, instead of saying the site name at the very top on the explorer title bar, it says "Hello Man, you'r hakked". Does anyone know what this means? Thanks all, Gina

You probably weren't hacked, just defaced. Check to see if your index.php file has been changed.

 

Jack

[VectorSix]

Jack has a point. Could be that your host was compromised and the attacker just moved some things around.

 

However, if it is changed, it may be a file security issue rather than a username/password issue. Although, I wuold definately change those as well if access was gained to your configure.php files, which you really have no way of knowing unless they were modified...

 

I would check that your file permissions are set correctly, effectively 644 or 444, read-only. I know sometimes people like to decrease the security during setup, so it may be set at 777 rwx for everyone.

[Chris Smith]

Just noticed that when I log onto my oscommerce site, instead of saying the site name at the very top on the explorer title bar, it says "Hello Man, you'r hakked". Does anyone know what this means? Thanks all, Gina

 

It means that they got your sex wrong, their dyslexic and probably thirteen, as any serious hacker, cracker and so on, would either 1) not leave you a store or 2) and this is the scary one, wouldn?t let you know that they were ever there and leave a little piece of script that can either collect info or your sales. This was a mild attack and in truth probably more beneficial to you than you realise, now you can get your security in order before any serious attempts happen.

 

Chris :thumbsup:

 

PS try having cron backup you store every few days, and make sure you have a master copy of you files on your home computer. That way you will be down for about an hour rather than days.

[Guest]

IMO every store should have Jacks wonderful Site Monitor contribution installed. It will tell you which files have been changed, added, or deleted since it was last run. It makes finding the needle in the haystack much easier.

 

Thanks for that amazing contribution Jack :thumbsup:

[Minky]

I think you need to change your passwords as soon as you can. I would also change your hosting account passwords along with your OSC admin password(s).

 

Thanks everyone for your help. Unfortunately I don't have a clue how to set passwords - can anyone point me in the right direction? Gina

[Jack_mcs]

Peter - thanks. :)

 

Gina - If you are going to change passwords because you think someone might have gotten one of them, then you should change both your hosts control panel login and your admin password. To change the first, just login to the control panel and look for a way to change the password. All panels have them. If you can't find it, contact your host. There might also be a place in there to change your admin password. If not, you will need to replace the .htpasswd file. I suspect you can change them both from your control panel. A quick email to your host should confirm this. Also, be sure to check your ftp accounts and delete any that should not be there.

 

Jack