Oh No! My Website Has Been Hacked

Valentin Vesa – Brand Evangelist

Thank you very much, Kristen. Hello everyone and welcome to Oh No, My Website Has Been Hacked webinar. As if you’ve heard from Kristen, my name is Val, or the legal name being Valentin, but everybody calls me Val. I’m in here in charge of social media and I’m doing brand evangelism for Sucuri. Husband, I’m father of two. We have a daughter who is nine years old and a boy who is 12, and we will talk about him in the following minutes. My biggest passion is traveling and every time I do travel, you’re going to find me on Instagram a lot, so sending a lot of photos.

Yes, mostly with my family, they can see here my children and my wife, and of all the beautiful places I get to go when we travel for business and then we always have those extra hours that we go around and travel and get to see the locations where we go. I’m currently in Cluj-Napoca which is in the center of the former county of Transylvania, the famous Transylvania, but unfortunately, there’s no vampires. We can still come and visit. That will be northwest to the country, Romania.

For the past 18 or so years, I have been pretty much involved in a lot of things that are going on in social media, online marketing. I’m working as a social media specialist, as I said, here, but if I go into my personal presentation, I would say that I never eat pork, or very rarely, and unfortunately I don’t eat seafood. I don’t really like it. I started eating tuna fish which was a really big thing and my wife really appreciated. Unfortunately I love Coca-Cola too much, and especially when I need to clean the bathroom. It’s really useful; you could try it yourself, but the actual subject of our conversation today, as you’ve heard, our charity project named Shoebox Project, and of course, the platform that it runs on, WordPress.

Now, to put a big story short, Shoebox started out as a family project when we started back in 2006 when our son, Luca, that I’ve mentioned to you before, he was three and a half years old and we tried, with my wife, to teach him how to give, teach him that anything that he receives on Christmas can be a big joy for him, can be a reason of smiling, but there are so many other children around us who never get any present for Christmas because there’s no funds, there’s no money, and for many of those, there’s no Santa Claus due to that situation.

We wanted to teach him that it’s much more important to give than to receive, so we prepared two shoeboxes together with another family and some friends and we went to a very poor family and we let him give that box away. Then on the way home, we started talking about it, so asking, “What do you feel? What happened? What did you talk to him?” Me and my wife, we stood at a distance so to let them talk amongst themselves. I think the child was around his age, so maybe four, maybe something like that.

I told him on the way back, please don’t share this with anyone. This is something that we do as a family and if you liked it and if you think it’s worth it and you want to do it again, we can repeat this at next Christmas, but let’s not brag about doing a good deed, right? But as you’ve know and maybe most of you hearing now are parents also, children don’t really do everything that we tell them to do, so he went back to kindergarten and he talked to everyone in his class.

They heard from him things like how undressed the child was, the fact that didn’t have any shoes on, all those little details that maybe as adults we sometimes miss, but they were really impressive for him, for my son. The children talked with their parents at home and the parents started calling us, me and my wife, and asking us what project did we start. They want to go and be members in our NGO, and we were just astonished, like there is NGO. We just did something in the family. Then we found out that he actually shared with everyone what we did.

I told everyone it was too late in 2006 to start doing it as a big thing, so I said, “Let’s do it next year.” In 2007, with these parents that I’ve talked about and only using Yahoo Messenger, which is believe is about to be discontinued, we talked and we organized and we were able to raise 512 shoeboxes filled with sweets and clothing and items and everything nice for 512 children who in 2007, most likely received the first time ever Christmas gift.

That was just amazing. Then looking through the years, last year in 2015, we were able to raise more than 100,000 boxes and we have now locations in 19 countries and 203 cities and 416 collection centers. Most of the bigger cities have, of course, multiple locations so people can easily get and have in their walking distance a location where they can drop their boxes.

As I said, everything started in 2007 as a project. There’s no NGO behind this. I want to emphasize this. There is no structure. There is no organization. There’s no money involved. We do not accept any sort of cash donations. Everyone that wants to participate, the only thing they need to do is fill a shoebox with the items that we recommend, depending on the age and gender of the child, and then just bring into a collection center.

Everything started in 2007, but two years later, my wife had a suggestion, and for those of you who have wives or partners, do listen to them. They do tend to have amazing suggestions, and I think that a lot of great ideas in the world came from women, although maybe we men don’t really admit that. In 2009, she said, “Dear. We need a website. We cannot just go on like this doing everything on Yahoo Messenger, text messages, phone calls.” I do not want to describe how long the phone bill was when she got home with it and the other end was filling the providers’ headquarters.

I said, “Okay, let’s go online.” What is it out there? What was it out there in 2009 that I can go with? I found, of course, WordPress, and then reading about it and the famous five minutes install and be online in five minutes, I was sure that at that time, it was the best solution to go with. Then what do you do when you decide to create a website? You first look for a very cheap hosting and domain offer, which is what I found and of course, as a charity, and for those of you running projects, I’m sure when you were at this point in time, maybe the money were not there and money maybe was short, but any offer like that, any coupon, any voucher, any discount that you can find, it was like gold.

Go online. If you are lucky enough as we were, the host was using Softaculous, or any other sort of software that helps you install scripts on your server, in our case, Softaculous, and then of course if you find WordPress in there, it can just go on through as I said, the magical online in five minutes process and then get online. The funny part was that I wasn’t much of a designer back then. The even funnier part is that I’m not much of a designer either today, but this is how the site was looking like in December 12th, 2009, when we started it. Some of the CSS and images are of course not here because we are looking in a wayback machine screenshot, but still, let me tell you it wasn’t nothing impressive, but it worked.

We had an online presence. We had a website that people can go to. We could send out links. Of course, we did not have a Facebook page yet. There was no Twitter account. There was no YouTube back then. As I said, everything was done through Yahoo Messenger, but I do want to point out here that we had a theme donated to us by vladstudio.com. I’m sure every time I say this name, nobody remembers it, but for those of you who do, you know who it is. Everything was great. We had a website. We were online. We were able to talk to people, receive emails, until this happened.

December 22, 2014, our beloved website was hacked. Of course, you feel that everything collapses on you. The first question is, why? Then, why me? Then, why us? What is it so important on this website that somebody would decide to hack it, two days, three days before Christmas. The impacts were massive. Emails that I’ve never sent started to come back to us which obviously pointed to the fact that we had a script or some sort of malware file in the site that was sending out emails. We had a great emotional, social loving project that was sending out porn and Viagra spam. Just imagine the impacts of all those people receiving that.

Then of course we get a warning from the host saying, “If this goes on, we will suspend the website.” I’m sure many of you were in the same situation where this happens to you. There’s malware in the website, and when, at the worst moment, you’re trying to find help from your host, they say, “If this goes on, we’re going to suspend you.” Then of course email was now down, like no legitimate email can go out and in because there were millions, or whatever, hundreds of thousands of spam emails just locking and clogging the XM server.

We were in the mid-project phase. We usually start in December the 1st and up to 15th of December where we gather the boxes in the collection centers, and then from 16 to 22nd, 23rd, and sometimes even Christmas eve, 24th, we distribute the boxes to the children so everyone on Christmas day, they can open their presents. Now, imagine we were on December 22nd. We were almost done with distributing the boxes. I was already doing the lists and preparing the report to share with the volunteers and donors, all those who donated a box, to let them know where the boxes went, how the children received them, who was donating to where, and all that, but we were just out. The website was already blocklisted by the end of the day. Anybody going to the site would see that this website distributes malware, which just speaks to the incredible amount of awe and shock that we all had in the team.,

All our credibility built on all the past experiences is now almost gone, especially online. Nobody could find us and anybody finding us, if they go there, they would probably not want to come back when they see that image of a site being hacked. The first thing that you do when you’re in this situation is, besides asking yourself why, you try to fix it yourself and don’t tell me you don’t, because I know you did. Every time you’ve been there, the first thought was, okay, whatever amount of technical knowledge that I have right now, what can I do to fix this, make it go away? Just make sure it doesn’t look like that anymore. I don’t want to see that image. I don’t want to hear those songs. I just want a website back.

I just listed some of the things that I did back then, looking at the HD access to see if there were any edits done because there were, and that page that you saw was being forcefully displayed to anybody going to the website because they were directed there, trying to see if there’s any unauthorized FTP access, of course checking the users list on the site. I knew exactly who had access to do what because all the volunteers were specifically added to the site to do a specific job, and all these other things looking at a database. I’ve seen some strange codes and bits of scripts there.

Then I did what I thought was the best thing to do, change all the passwords, of course, FTP, cPanel, Norton Commander. I don’t know exactly what sort of FTP manager I was using, but I was just trying to make sure all the passwords are new, like you would. Then of course that took care of the online part, and then I thought, okay, what if they actually hacked into my computer because maybe it wasn’t directed to the website?

I scanned my computer to see if there’s any keyloggers, malware, anything like that. Contrary to public habits, I actually had a valid license for antivirus. I didn’t use any old software, which you shouldn’t neither. I thought to myself, okay, you did a good job. The website was clean, and it was back online, so celebrate, right? Everything is back. I did it myself. I felt good about myself, but it only took two days for the hackers to be back. This is how the site looked like on December 24th, Christmas eve, one day before Christmas.

Everything was back, and I don’t know exactly if that’s true or not, but my suspicion is that this was another hacker because they all like to have their own signature image. I realized that is the time to ask for help, and we’re going to talk about this later on in presentation, but it wasn’t any longer for me to think, okay, let’s do it again by my own. I couldn’t do it, so I tried to see if there’s any services out there that could help me.

Remember, we were a project. There was no money or not a lot of money that I could spend on anything like online web security, anything like that. The single thought that I had was, how can I get out of this one and have someone … I don’t know who … help me? I tried to do initially everything that I could. As you could see, I didn’t do much or it didn’t take too long for them to come back. I was looking on Google, and searched, as many of you maybe had, hacked website cleaning services, and I found Sucuri.

Of course now I work for Sucuri and I am part of the company, but back then, for me, Sucuri was something like a savior, and I can say that. I went online, and I will go over this again, but this is the first part, the first bit, of the online chat that I had with Hillary. She’s still with the company, by the way, and we still have conversations about, “Hey, do you remember when I came online?” Look at the timestamp. The timestamp is my local time in Romania, 3:45, 3:46, 3:47. That was the local time.

The biggest surprise, good surprise, the biggest, the most positive shock, if you want, that I had was that on Christmas eve, at that time in the morning for me in Romania, somebody was online at Sucuri, knowing what I was talking about, having a clue exactly what the problem could be. They even did a small evaluation in the chat as to what happened exactly so I could go on and order it and get clean, and the amount of assurance that you get in those moments, when somebody’s there ready to help, you feel it in your bones that they know what they’re talking about. It’s not just scripts and marketing. It’s actual help that you can get in minutes, and I’m saying minutes because 40 minutes later, the website was back online.

Sucuri helped with, as I said, 4 AM for me was something that I would never have imagined anybody in any other service to be online and ready to help me, at least back then. The initial evaluation was done in the chat, so they already knew exactly what happened or guessed what could be the problem. Then they just directed me to the signup page. I opened a ticket. Malware removal was done; 40 minutes later, the website was clean. Not only did they clean the website, which again, I think … remember that what happened is very important … they sent me an email … well, I say ‘they’ but I’m part of the team now … but I got an email saying, “Just follow these steps if you want to continue to be clean after we clean your website.

It’s just something that you see somebody caring for you, and again, in the situation that I was in, any bit of help was just magic. When you see so much help coming in minutes or hours, that’s just amazing. Then of course, by the end of the next day, they already had removed the black list from the website, so the website was back online on Christmas day, and everybody was happy.

Now, if I go back trying to understand what I think happened, I would most likely say it was a random attack. I have no clue why would anyone hack a website that only had mostly static pages presenting what we do, what to put in the boxes, some videos of how to actually wrap the boxes, and make sure you don’t have perishable in there like oranges or yogurt, because those could be damaged in storage before they actually can get to the children. There was no e-commerce being done. There was no credit cards stored. There was nothing that you would expect a hacker to long for and to want to penetrate your website to get those details or that data.

Then again, I just had a default WordPress site. There was no custom security settings. There was no something that I would do now maybe, like change the [inaudible 00:21:39] menu [inaudible 00:21:40] or just move everything like config files outside of the public HTML folder, or just generic things like that that help a lot in your security posture. There was nothing like that going on. It was just an empty, clean WordPress install, and I did have the, let’s say, famous plug-in that I’m sure was vulnerable. Maybe it was part of the issue.

Then by the things that I have seen going out in those two, three days from the website, from the server, most likely the hacker’s intent was to spam existing lists from our website. Now, thank god everything is back in normal, and now the website looks like that. For those of you not understanding Romanian, somewhere on the site there’s a page describing the whole project in English. I will make sure that maybe I will send it out in the email that everybody will get.

Then again, going back to the issue of being hacked, I now refer to this experience as a good thing. There’s a reason why I say a good thing because normally, when you associate hack with good, there’s just no logic to that, but looking forward, I’m showing you some of the photos that I’ve taken in the many trips I took in the past one and a half years with the Sucuri team to all these amazing events, trying to blend in the local communities of platforms like WordPress, Drupal, Jumpline, so on, and all these amazing people that I’ve met.

Remember, I was telling in the beginning how much I love to travel, and this opportunity to do social projects, meet people, talk to them about what we do in Romania, and then what we do in the other countries, there’s so many of them that came forward saying, “Hey, I want to start this in my country too. I want to have a location in our city,” and I’m sure most of you watching now and listening, I’m sure you have in your city somebody that it can help. I’m sure there’s a family who maybe don’t do that well, or maybe they have children that only eat once a day, and you’ll only find out this by going and watching, making sure you see what happens.

When that neighbor walks to their car to leave in the morning, just spend an extra five seconds saying good morning and maybe find out more details about them. Some time, somewhere in the back of your mind, if you feel yourself in a position to help, do it. It will only bring you so much happiness. I can say about my experience that I am so happy that I get to travel, to meet people, and to share with them not only my love for WordPress and security and this focus on making sure that our responsibility as website owners is to keep our websites clean so that when people come to our websites, they get the message and not the malware, right?

They get whatever we try to send and express to them about what we do, about what we love, about what we’re involved with, and not the viruses and not the hacks. I will try to go over some of my personal best practices for website security. Again, I work in marketing so don’t expect me to go very technical on this one, but I will just make sure that I share with you what I do to keep my websites safe. I will start with number one, and that’s my personal favorite, is learn. Always learn. You can never have enough information. You can never say, “Now I have reached a level where everything there is to know, I know. I’m full, so now I’m going to do anything else.”

Of course you can start with our blog. There’s tons of educational information there about any platform or non-platform. You can learn about how to secure your website. You can learn about how to make sure that the people that access your site are only the ones who actually have the access to your site. As I’ve listed there, you can employ a web application firewall. Of course, we recommend our Sucuri firewall, but make sure that people who are going in who have access to your site are the ones who actually need it.

Think about this. Do they really need admin level access to change some images? Do they really need root level access in your server to … I don’t know … upload a PDF via your website? What are the platform vulnerabilities that exist? Learn about them. Try to find information no matter what your website is built on, be it WordPress, Drupal, Jumpline, anything like that. Make sure you find information about what’s vulnerable. Make sure you stay away from vulnerabilities and build in a safe way.

Again, if you hear about news, like we put out so many articles about malware and vulnerabilities that happen, either live or that we hear about after they are fixed, so many other platforms, so many other news sites are doing the same. When something like that is announced, make sure you check your website. So many people think that, “Oh, there’s a new vulnerability for WordPress. Oh, that’s fine. I don’t need that version. I’m fine.” Always go back in there and check. What if you are also attacked?

Number two, that would be passwords. Now, this should be the number one and also the most important thing. Always use a password manager. That’s what I was taught by the security experts that I work with every day. That’s what I was told initially in the first day that I got cleaned. They were telling me, “Make sure you don’t … “Iloveyou123 blah blah blah or da da da,” use those kinds of passwords, but go into Password Manager. There’s tons out there. I’m just going to name, for example, last [place 00:28:09] that I used, or 1Password, but you can find others, of course.

Go for complex structures. Don’t go for one-word passwords. For example, you can choose something like your favorite song when you were a child, or some lyrics in a poem that you liked, or maybe the song that your mom used to sing to you when you were little, just something that makes a lot of sense and has a lot of meaning to yourself and that is very difficult, of course, by others to guess. Then go through everything that means upper, lower, special characters, case numbers, and of course, go more than 10 characters, and never, for the love of God, never reuse passwords. That’s the worst thing ever.

Just imagine seeing an email from your, let’s say, Ling Ding or like it just happened, I think, in the beginning of this month where they sent that email out saying, “If you use your Ling Ding passwords on other sites, make sure you change those.” Now just think about yourself when one big site is hacked or when passwords are leaked, what if you used that password that was leaked in among of other websites? Now that would be concerning, right?

Number three would go, always update, no matter what it is. Depending on what we talk, we can go and say about CMS’s plugins, server, so many other things, but always make sure you have the latest, most updated version of anything in there. Usually, especially when security updates are released, all the vendors are very, very vocal about it. They tweet out, they send newsletters, they post on their website saying please update now, now, now, update.

Imagine that the minutes you need to actually see the news and then maybe the tens of minutes that you need to go in and log in and update and everything, those minutes, that time that passes is clean opportunity for hackers to go in, because you’re still naked, you’re still open. That vulnerability is still yours because it never got patched. You didn’t update. Always make sure you update.

Make sure you have backups. Going back to my story with the Shoebox site, I did not have backups. I just never thought of it. I just assumed that the host would have backups. I never thought of asking my host ahead of time, like how many days are you keeping my backups? Are they two days? Are they five days back? Did anyone ever test them to see if they actually work, even if we tried to restore them?

Number two says they’re offsite. Make sure you don’t keep your backups in the same folder with your site, so never save a backup archive in your public HTML folder or hdd.docs or anything, depending on your server, and always make sure you test them. It’s not enough that the website is backed up. It’s not enough that you have a backup that is offsite. Always make sure you test it. What if it doesn’t work? What if you do get hacked? What if your backup supposedly would help you to get back online with a clean site, and that backup in itself is actually a copy of a hacked site, or even worse, it’s a clean copy, but you cannot restore it? You’re still back to being hacked, right?

Number five is something that I’ve told you in the third or fourth slide what I said, admit you’re overwhelmed … is use professionals. Security is not something that let’s try to learn how to walk or let’s try to learn how to swim. Everybody can swim if you put enough time into it. Everybody can cycle or anybody can maybe play football or soccer or … I don’t know … everybody can read if they really try to do it, but security is one of those things that not everyone can do, not everyone can do well, and you should let the professionals do it for you.

Admit when you’re overwhelmed. Remember the initial thought that I had was, “Oh, it’s fine. It’s just hacked. I’m going to go through all these tabs because I’m all about knowing tech and everything,” and maybe with a little bit of narcissism in there and egoism, like, “I’m going to do it myself,” the ego coming in. Then you realize, “Oh, my god. I cannot fix it myself. This is too big for me. My knowledge is not enough,” and then you have to admit, when that point comes in time, as you see going forward, don’t give that problem and that situation extra money and time because you cannot do it in-house. Most of the times, the complications that arise from a hack or the hack itself, it’s so difficult to fix and get clean from that it’s just not worth it to do it yourself, so use professionals.

You can find me on Twitter, of course, on Instagram. I’ve already shared that I do a lot of photos. You can email me and what I can say about us as a company is that we are in the business of solving problems, and even since we started in 2010, the whole focus of what we do is to deploy security solutions that make most sense for any website owner, regardless of the industry, regardless of the site. We protect your site. We are there to respond. If something happens, imagine I was going online at 4 AM. Somebody was there trying to help me, ready to help me, and knowledgeable enough to actually do the job, not just say, “Okay, okay, we’re going to take care of you.”

Then of course employing our website application firewall and our intrusion prevention system helps you protect your website, and make sure that you don’t worry. We worry for you. We take everything out from your daily list of tasks that you have to do for your charity, for your project, for your small or big site. It doesn’t matter. This is achieved when you actually let the professionals do their job. Just don’t carry that weight on your shoulders. Just let us do the job and you get to do whatever you like most and take care of your project.

With that, if there’s any questions that you’d like to ask me, I’m happy to answer. Even after the webinar, you can keep tweeting at us at Sucuri Security. Make sure you use the hashtag #asksucuri so we can actually find all the questions very fast, and we’ll be happy to provide responses.