Posts

Websites are being Encrypted and held to Ransom

/in , , /by

Encrypted Website Database - RansomThere is a new security threat for website owners to contend with.

Similar to Crypto-locker and other Ransomware, there is a new threat that will encrypt the core database files of a website.

Dubbed “RansomWeb” by Security firm High-Tech Bridge, database files are encrypted, and an email is sent to the admin demanding the payment of a Ransom to unencrypt the files. In one case, the Ransom demanded was US$50,000.

Stop your website from being encrypted and being subjected to a Ransom

Now even though this particular website was doing backups of the database, they were doing automated backups that remained on the Server. Unfortunately for them, their website was compromised months before the attack occurred, and consequently all their backups were compromised. This is why it is so important to download backups and keep them separate from the Server.

One of the things that we do here at Website Design by Spotty Dog Computer Services as part of our Monthly Maintenance and Backups Service is to download backups of your website to a local hard drive. We will keep up to 12 mths of backups so that in the event that something like this happens to your website, we can restore an uninfected and uncompromised backup.

Apart from downloading backups to a local hard drive, the best thing you can do is have a secure website. That means installing security plug-in’s that close security holes, and keeping WordPress and all Plug-in’s up to date as new releases are made available. This is of course part of our Monthly Maintenance Services too.

So if you have a WordPress based website, we can take steps to protect your website (and your sanity), but please do not wait until it is too late!!!

Just one of the many services we offer.

 

Has your website been hacked?

/in /by

Hacked WebsitesEvery day, somewhere in the vicinity of 10,000 websites are hacked or compromised in some way.

What do we mean by hacked and compromised? Well what we mean is that someone has breached the security on your website and inserted some malicious content. That malicious content can be in the form of viruses, trojans, worms, keyloggers, spyware and so on.

Typically, if your website has been hacked or compromised in some way, and a visitor views your website, they will be redirected to another website that contains malware, or malware on your own website will attempt to exploit vulnerabilities in the visitors Browser and or Operating System.

Once your computer has been infected, it can be used to send out Spam, or information can be stolen from you and used for fraudulent activities and Identity Theft.

This is why it is so important to keep your computer up to date for things like Java, Flash, the Browser itself and Windows. To further complicate matters, if you are using Windows XP, it is inherently less secure that Windows 7 and 8, but worse still, Microsoft will cease to support Windows XP after April 2014.  So at this time, expect to see a spike in infected PC’s.

So back to whether your website has been hacked or compromised.

If your website has been hacked, it is likely that the first time you will know about it is if a visitor notifies you that they have received a message in their Browser informing them that your website is a known attack site. Google for example scan millions of websites looking for malicious content, and will mark your site as an Attack Site and warn visitors.

Reported Attack Site

The other way you may become aware of it is through the Google Webmaster Tools website, if you have your website setup there of course.

Google have a series of videos explaining what it means to be hacked and how to remedy the hack and get your website off the Blacklist.

Here is the first video in the series:

 

 

CMS Websites at risk from Hackers

/in , , /by

Content Management Systems (CMS) websites like WordPress have long been a target for Hackers.

CMS systems like WordPress are popular because they are free and Open Source, and very flexible to such an extent that just about anybody can create a Website, or Blog, or eCommerce website with relative ease.

The problem is that a lot of website owners either fail to keep their CMS and plug-in’s up to date.

New versions of the platform and plug-in’s are regularly released, not just to improve functionality, but to plug security holes.

This is why Hackers love to target CMS websites.  It’s because they know there is a high chance of discovering an unpatched website.

Even if you do keep the platform and plug-in’s up to date, you must also do a few other things.

Here is a checklist:

  • Use a strong Password – You must not use easy to guess and simple passwords.  Never use “Password” as your password for example.  Also avoid using dictionary words, pets names, family members names etc.  Use Upper and Lower case letters in combination with numbers and keyboard characters like @#$%^&* if possible.  If you find it difficult, try substituting some letters with characters or numbers.  For example MyPassword2013 could become MyP@55w0rd2013.
  • Use a good Security Plug-in – My favourite Security Plug-in is Better WordPress Security.  Among the things it does is:
    • Change the urls for WordPress dashboard including login, admin, and more
    • Rename “admin” account
    • Change the ID on the user with ID 1
    • Change the WordPress database table prefix
    • Change wp-content path
    • Ban troublesome bots and other hosts
    • Ban troublesome user agents
    • Prevent brute force attacks by banning hosts and users with too many invalid login attempts
    • Enforce strong passwords for all accounts of a configurable minimum role
    • Detect and block numerous attacks to your filesystem and database
  • Add CAPTCHA to your User Log-in – I like to use another Plug-in called SI-CAPTCHA Anti-Spam.  Not only does it add CAPTCHA to your Log-in, but to WordPress forms for comments, registration, and lost passwords too.

It may sound daunting, but if you have your website hosted and maintained by Spotty Dog Computer Services, all the updates are included in our Monthly Maintenance Fee.  And as an added bonus, if a Hacker does manage to compromise your website, we make regular backups so we can restore your website if it all turns pear shaped 🙂