---
title: "Handling a hijacked account"
date: "2015-07-04"
category: "email"
slug: "handling-a-hijacked-account"
---

## Overview

This article covers how hosting accounts are compromised, how to prevent it, and the policies that apply when an account is flagged for sending spam.

## How Accounts Get Compromised

### E-Mail

Passwords are most commonly discovered through brute-force attempts from distributed botnets -- [command-and-control](https://en.wikipedia.org/wiki/Botnet) systems where thousands of infected machines try random username/password combinations across millions of servers. If a password is weak enough, the attacker eventually gains access.

### Websites

Botnets also crawl websites looking for vulnerable software. Frameworks like WordPress, Joomla, Drupal, and Ruby on Rails have consistent URL patterns that reveal what a site is running.

**Example:** If `http://example.com/wp-admin` returns a login form, the site is likely running WordPress. The attacker now knows which [exploits](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress) to try.

Once an exploit succeeds, the attacker can execute arbitrary code, edit files ([[writing-to-files]]), and install backdoors. The only safe recovery is to reinstall the software from scratch and keep it updated.

#### What Does a Backdoor Look Like?

Backdoors are obfuscated code typically inserted at the top of infected files to avoid disrupting normal operation.

**Backdoor resources:**

- [Examples of website backdoors](http://aw-snap.info/articles/backdoor-examples.php)
- [PHP Backdoors: Hidden with clever use of extract function](https://blog.sucuri.net/2014/02/php-backdoors-hidden-with-clever-use-of-extract-function.html)
- Backdoor examples [1](https://kb.sucuri.net/malware/signatures/php.backdoor.arakbali.001), [2](https://kb.sucuri.net/malware/signatures/php.backdoor.array.001), [3](https://kb.sucuri.net/malware/signatures/php.backdoor.b374k-shell.001), [4](https://kb.sucuri.net/malware/signatures/php.backdoor.base64.001), [5](https://kb.sucuri.net/malware/signatures/php.backdoor.pregreplace.012), [6](https://kb.sucuri.net/malware/signatures/php.backdoor.gzinflate.002)...

## Preventing Compromises

Always use anti-virus software and keep it current.

### E-Mail Best Practices

- **Avoid throwaway accounts**: never create users like "test"
- **Use strong passwords**: longer passwords are significantly [more difficult](https://www.grc.com/haystack.htm) to guess. "gumby" takes ~60 million guesses (36^5); "gumbyisacharacter1" requires 1.03 x 10^28 guesses
- **Never include your username in your password**
- **Run anti-virus software**: some trojans (e.g., "[PokerAgent](http://blog.eset.ie/2013/01/29/trojan-stole-login-credentials-of-over-16000-facebook-users/)") silently collect login credentials without other symptoms

### Website Best Practices

- Use [[permissions-overview]] carefully -- PHP runs as a separate user and needs explicit write access ([[writing-to-files]]). Overly permissive file permissions let attackers modify any file on your account
- **Keep software updated**: updating [[updating-wordpress]] and [Drupal](https://www.drupal.org/node/1494290) is straightforward
    - Software updates can be performed for a one-time $15 fee if needed
- **Limit plugins**: only use actively maintained plugins
- **Never use pirated software**: "nulled" themes are often injected with [malicious code](https://blog.sucuri.net/2015/05/fake-jquery-scripts-in-nulled-wordpress-pugins.html) like [CryptoPHP](http://www.pcworld.com/article/2853192/over-23000-web-servers-infected-with-cryptophp-backdoor.html)

## Cleanup Process

All cleanups carry a **mandatory $15 fee** to cover spam removal and account security work. Fees are charged automatically. Unpaid fees result in service suspension after 72 hours.

### E-Mail Cleanup

When spam is reported through [feedback loops](https://en.wikipedia.org/wiki/Feedback_loop_(email)):

- All queued mail from the affected user is purged
- The user's password is changed to a random value
- You must set a new password via **User** > **Manage Users** in the [[logging-into-the-control-panel]]

**Never reuse the same password.**

### Website Cleanup

Malware is removed and overly permissive file permissions are tightened. If the site cannot be secured without your intervention, web access is revoked until the software is updated.

When an update is required, the [[where-is-site-content-served-from]] permissions are set to 0700, blocking web access until the vulnerability is resolved. After updating, restore [[permissions-overview]] by changing permissions back to 0755 via the control panel or [[accessing-ftp-server]].

## Recommended Anti-Virus Software

**Windows**

- [Microsoft Security Essentials](http://windows.microsoft.com/en-us/windows/security-essentials-download)
- [AVG](http://free.avg.com/us-en/homepage)

**Linux**

- [Sophos Anti-Virus](https://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-linux.aspx)
- [Comodo](https://www.comodo.com/home/internet-security/antivirus-for-linux.php)

**Mac**

- [Avast](https://www.avast.com/en-us/free-mac-security)

## Recurring Infractions

Spam disrupts mail flow for all accounts on the server and can cause long-term reputation damage with filtering engines ([SenderScore](https://www.senderscore.org/), [Barracuda](http://www.barracudacentral.org/reputation), [McAfee](http://www.mcafee.com/us/threat-center.aspx), etc.), causing legitimate mail to be silently discarded.

- **3 violations in 90 days:** automatic **24-hour suspension** of e-mail and website access to allow you to secure your network
- **4th violation:** **termination** and forfeiture of unused hosting credit
