Hacked Off

TheBookGuide was hacked for a second time over the weekend and the feelings of outrage and helplessness in the face of this invasion; have to be experienced to be fully appreciated. Rather like coming home to find you’ve been burgled … but with many more ways for the criminals to gain access … and the prospect of their imminent return.

Those who invade websites often plunder anything they can, but in our case the reason was to try and use our popularity to redirect traffic to a site that will attempt to download a Trojan. I can’t help feeling bad about this - despite knowing that you would have to be a moron to ignore all the warnings, and use the internet on an unprotected device.

However, when it became clear that we couldn’t cure the problem by simply replacing infected files with the site live, we had no alternative but to take the TheBookGuide down.

You would be amazed at how many places there are for hackers to hide their unpleasant little surprises on a website, and how long it takes to Hoover out all the corners so that you can be sure that the infestation is completely irradicated. And professional Hoovering doesn’t come cheap.

Last time we were hacked, Colin cleaned our network of anything even vaguely suspicious, changed the passwords, and checked all the file permissions. We were quietly confident that all the doors and windows were bolted.

This attack appears to be too similar to the last one to be a coincidence, particularly the identical problems with user names and resetting passwords on our host, Webfusion’s control panel. In the end it took three days and many hours on the phone before resolving this issue sufficiently for us to change all the passwords.

Colin is of the opinion that Webfusion never properly migrated our site to its new hosting platform, and that the user name and password problems are symptomatic of a vulnerability caused by this. 

In view of Webfusion’s inability to permanently resolve these issues and their generally appalling level of technical support, we will be transferring to a new host as soon as possible, and hope that this will be the end of the problem.

Colin reminds me that we attract hackers because the site is popular, and that it is impossible to guarantee that we won’t get hacked again at some point in the future, but you can be assured that we are doing everything we can to avoid any further disruption to the site.

Mike Goodenough
Editor
11.08.11