1

The index.php file in root has been injected with code. I do not know what this code means, but this is obviously not good. This is the first time this happens in all the years I work with EE. (BTW, the server that this build runs on is not my choice.)

My questions:

1) what do I tell the client? Does he have to move server (ISP?)

2) What do I do, should I reinstall EE completely?

Hope for an answer here, thanks.

2

The first thing to do is remove the code but you should also look to see there is anything else that has been touched. Reinstalling completely may be unnecessary but it won't do any harm.

If you store any personal information of users you should also determine whether or not this has been taken and your client needs to decide whether or not to inform them of the breach.

But it is pointless fixing anything unless you find out how the code was injected. In all my time working with EE I have only seen a few hacked sites. But they all tend to be on shared servers and the attack vector was another popular CMS hosted on the same server.

The injected code might give you a clue as to where the attack came from. Do some Google research on that as it might help determine your next steps.

As far as your client goes, be up front. This kind of thing happens and anyone that thinks any site is 100% secure is fooling themselves. The real issue is how you deal with it now. Be open and thorough. Try to find out how it happened and take steps to prevent it happening again.

| improve this answer | |
  • Point 1 (remove) is what I did first. I discovered on the server an (old?) WP build, their index.php had the same Code injected. Point 2 (inform client) is what I did next. They call their ISP tomorrow, see what they say. We'll change password of course. To look for the origine of the added code is difficult I think. – Hansl May 31 '15 at 19:16
  • Found this security.stackexchange.com/questions/70579/is-this-a-backdoor which I think is related to what I found in index.php of EE and in the WP build on the server. I send a message to my client that they should do something about that WP build. I will reinstall EE and check all my own HTML just to be sure. – Hansl Jun 1 '15 at 5:38
3

I agree with @foamcow's answer.

Also, change your SFTP and MySQL passwords and look at .htaccess in case they injected some redirects.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.