Feb 2012
13th
We figured out that the .htaccess files were getting hacked about every 71 minutes, with a few random exceptions. We could not keep running my automated script every hour so I made a bash script from the command line and set up a cron job to run the script once every minute. If it found any differences between the .htaccess file and the .htaccess.bak file then it would overwrite the changes immediately, and send us an email.
Two incidents happened yesterday – first my main sitebegan throwing 403 errors. On investigation I found that index.php permissions were set at 0. Quick fix, rset to 644 and all was well.
A few hours leter, another site began throwing 403 errors. A quick look via ftp failed to show any files with no permissions so I checked .htaccess and at the top of the file I found:
deny from all
allow from 86.152.223.55
allow from 81.152.4.150
allow from 86.147.223.27
…followed by the usual Word Press instructions
According to Project Honeypot all of these IP's seem to be bonafide however as this was the only .htaccess containg those lines (in my 6 websites) I blocked them out by starting the 4 lines with #. Result: website working normally again.
Was I hacked or is there some other explanation?
Regards
Will
It sounds like you were hacked.
For your .htaccess file to block all acceess except for a few choice IP addresses would not normally be a desirable setup.
Funky permission is a common side effect of some hacker techniques.
When you find a file that may have been tampered with your should check the modified time of that file and compare it too entries in your error log, raw access log, and FTP log for coinsiding events that may tell you how the file was modified.
Did my plugin pick up any Know Threats on a Complete Scan?
