Glad to see Mark was informed, I was going to call him. These A holes do it simply because they can when with their knowledge they could be doing so much good, kinda like congress.
knowledge and congress is a contradiction in terms
Websites which are hosted and you do not have shell access means you will have to put in a support ticket for the hosting company to fix.
If you have shell access then you need to find out if that was accessed and what type of attack it was. Many attacks will compromise the system and can install software which has a great potential to do serious damage. Fortunately those type attacks are few and far between and I have only seen a select few of them. One site was hacked and all equipment was locked out and that AM the client got a call from Romania demanding $150,000 to release control back to them and tell them how he was able to get in.
Some key rules to live by.
*) Always do updates from the OS and apps used. i.e. windows updates, java updates, browser updates, plugin's, adobe updates and the like. This grants you less problems with hacks of this nature as most of the updates deals with security problems.
*) Never store username/passwords where they can be easily obtained. This particular hacker has a file on his desktop called passwords.txt which he harvests from all over. Iphone has apps like msecure which keeps those things under protection and can shred the data after x failed attempts.
*) watch log files. This is your first and best line of defense. Log files telling you failed connections, access denied, wrong account names and the like is major red flags. Some of the best setups is like fail2ban on *nix systems, they monitor logfiles and after x failed attempts that site is blocked for a set time limit.
*) sensitive data i.e. social security numbers, payment information, passwords and the like should not be used unless possible. When they are used the data should be session limited meaning only good for a very short period of time. i.e. 5 minutes. Never stored and kept out in the open. There are a ton of websites still using non-ssl payment processing which is a big cardinal sin. One site I worked with had some extreme debug level logging turned on and that was adding credit card numbers to the log files. After about 8 months or so the server was broken into and all those numbers were stolen. Often times cart setups will allow some degree of customizing from very insecure to painfully secure to appears to be secure but very insecure.
*) check the services frequently and often. Never know what you will find. I had one client that was putting a tape into the drive for over 2 years (before I was working with them) and the backup was running but nothing was being put on the tape, thus going thru the motions of backing up.
*) Clean, sanitized archived copies of websites. Essentially backup copies that are non-molested which can be restored. Several people I have known had hacked boxes (pc's) where a root kit was installed. (hidden software that monitors everything and allows full access to someone else) These incidents need to be destroyed, reformatted and everything reinstalled to guarantee 100% recovery. Even the bios need to be looked at. (use to be able to install hooks into the bios that activate root kits before the OS loads, even survive formatting.)
