A site that redirects visitors to unknown pages, shows ads nobody added, is flagged by browsers as dangerous or sends spam: these are typical signs of a compromise. The temptation is to restore a backup and forget about it. But unless you understand how the attacker got in, in most cases they will come back, perhaps within days.
First of all: preserve the current state
Before any clean-up, you need a complete snapshot of the site as it is now:
- a copy of all the site's files, including hidden ones and upload folders, keeping dates and permissions;
- a database export;
- a copy of the logs from the web server, hosting panel, FTP or SFTP and, if available, the web application firewall;
- a list of the accounts with access to the panel, FTP, database and the site's admin area;
- screenshots and saves of the pages showing the abnormal behaviour;
- hashes of the archives produced.
Many hosting providers keep access logs for only a few days. Downloading them immediately is often the most important thing to do.
Where to look for traces
Recently modified files
Sorting files by modification date is the most intuitive starting point. Remember, though, that dates can be faked, and a skilled attacker can give a malicious file the same date as the legitimate ones. A comparison with a clean version is more reliable.
Comparison with original files
For popular platforms such as WordPress, the core system, official themes and plugins are available in their original versions. By comparing the hash of each file with the corresponding official version, added or altered files are identified immediately. What has no reference original, such as custom themes and uploaded files, still has to be examined by hand.
Suspicious files
Recurring signs:
- PHP files in folders meant only for uploaded images or documents;
- files with names imitating system files, with one letter different;
- obfuscated code, with long encoded strings and functions that execute text as code;
- very small files that receive commands from outside, so-called web shells.
The database
Attackers can hide code in the database too: scripts inserted into posts, options changed to load external resources, new administrator users. Check administrative accounts, with their registration dates, and options containing external addresses.
Access logs
Web server logs show the requests received. Once a malicious file is found, search the logs for who called it and when: often the first request coincides with the moment of compromise, and earlier requests from the same address show how the attacker got there.
| Clue in the logs | Possible meaning |
|---|---|
| Many requests to the login page | Password-guessing attempts |
| Requests to a specific plugin with unusual parameters | Exploitation of a known vulnerability |
| A file upload followed by requests to that file | Installation of a web shell |
| Successful FTP login from an unusual country | Stolen credentials |
The most common entry points
- outdated plugins or themes with known vulnerabilities;
- components downloaded from unofficial sources, already containing malicious code;
- weak or reused passwords for the admin area, FTP or hosting panel;
- a compromised administrator computer, from which credentials were stolen;
- other sites in the same hosting space, from which the infection spread.
The last case is common on shared hosting: one site is cleaned, but the infection returns because a second, forgotten site in the same folder is still compromised.
After the analysis: recovery and prevention
Once the entry point is found, recovery can proceed:
- rebuild the site from official components and a verified backup that predates the compromise;
- change every password: admin area, database, FTP, panel, email;
- update everything and remove unused plugins and themes;
- check the computers of whoever administers the site;
- enable two-step verification and a file-monitoring system.
In my forensic work I notice that the most neglected step is the fourth: if credentials were stolen from an infected computer, no site clean-up will be final.
In short
- Before cleaning, copy files, database and logs, which are often short-lived.
- Comparing with official versions quickly identifies altered files.
- Web shells, obfuscated code and new administrators are recurring signs.
- Logs make it possible to trace when and how the compromise happened.
- Without closing the entry point, the infection tends to return.