Recovering from a site hack, preventing another one

Question

I am trying to help someone recover from a hack and prevent a further incident. They are running version 1.7.3. The result of the hack was modified index.php files in the root and system folders with javascript added to the files.

The hosting company assures us that it is not possible for other users to exploit php and web server privileges to modify the site files, so, taking that with a grain of salt -I'm looking at other possible vulnerabilities. So far all I can think of is:

1. A vulnerability in a plug in
2. A vulnerability in the php used in some templates

So far I'm not finding any issues in trying to investigate in the plugins, but not a whole lot of information either.

What specific steps can I take to locate the vulnerabilities and prevent another attack?

Answer 1

There are several solutions to securing your EE installation:

1. Rename your index.php file to something else - even if it isn't "visible" in the site URLs, if it still uses its same name, that makes it vulnerable to potential attacks because it's visible.
2. Rename the /system/ file to something else
3. Better yet, move the /system/ directory above the web root
4. If you can, figure out a way to use EE so that the site has the same functionality, but uses plugins or existing EE functionality/tags rather than PHP in the templates. That PHP may be totally secure, and I don't think that's what allowed this intrusion this time...but EE is very powerful, there's no reason to use its inbuilt functionality as much as possible. (That's a bit more secure than putting PHP in the templates, but not always.)
5. Have your client regularly change all passwords, and close any accounts that don't absolutely positively 100% need access - either into EE itself, or to the server/hosting account. (When you've got a small company trying to Do It Themself, they sometimes may overlook that.)

It would probably be smart to advise these folks to spend the time and money to upgrade to the latest version of EE - and it will be a rocky upgrade process for a version as far back as yours, so make backups - but even then, you'll want to take the steps to secure your installation of EE. The exact steps to renaming these various files and moving these directories are in the EE documentation.