A few useful things wordpress bloggers can do to further protect their sites is:

1. Install the Login lockdown plugin – This will prevent brute force attacks on your wordpress login page.

2. create a blank index.html file and put it in your plugin directory – this will prevent people from seeing what plugins your using by typing an address in their web browser.

3. chmod your wordpress files – your user account should have read, write, and execute, the system should have read and execute, and the public should have read only..by default, most hosts are not set up this way. This can help make it harder for hackers to inject code into your wordpress files.

there are other things you could do as well, but these 3 steps will help out a ton.

good post, keep them coming

Oh where Oh where has JJ gone?

Oh where, oh where can she be?

I really like your blog and I can see you’ve put alot of effort into it.

I also have a blog.. hopefully you stop by and visit as well.

Anyway.. wanted to wish you best of luck, and I read a post a little lower down where you were in a coma and all that. Wow life can be so unpredictable huh? Hope you’re much better now and keep up the great work on your blog!

TriNi

Batching System, I’m glad you found this info. useful to you and your website and yes we all have to watch out for any of the signs that Plin has mentioned here in his post. Better to know and learn about it now before one gets hit by the deadly virus!! It’s not fun I can tell you that much and a lot of work just to get back online. Thanks for dropping by. jj

Thank you very much!

I would like to add to it by explaining a little more in-depth what the virus that steals the FTP passwords does, and why hackers do this.

The virus is very adept at determining the current anti-virus software installed on the infected PC. It does this so that it can “morph” into something the anti-virus software won’t detect. It then disables the updates.

This virus steals the FTP login credentials in a variety of ways.

First, it knows that some popular FTP programs store their username and passwords in an unencrypted format in files. It searches for these files, opens them, read them and sends the contents to a server which then carries out the website infections. Everybody is looking for free software. Well many of the free FTP programs store their usernames and passwords in plain text.

So, to defend against this, many people stop storing their FTP username and password and feel they’re safe.

However, the second way the virus works is by acting as a keyboard logger. This records all your keystrokes. When you type in your FTP login credentials, it records them, sends them to a server and carries out the website infection.

The third way the virus works is by “sniffing” the outbound FTP traffic from the infected PC. Since FTP transmits all data, including the login credentials, in plain text, it’s quite easy for the virus to capture this information, send it to a server and, well, you get the point.

Keep in mind that when the above methods are used, there will be evidence of the infected webpages being uploaded in the FTP logs. Quite often though, people don’t ever read those but the IP address of the infectious server will be the source IP address.

The fourth way the virus works is by injecting the malicious iframe into the FTP data stream as it leaves the infected PC. Let’s say you’ve made some changes to a webpage on your PC. You then FTP it up to your site, as the file is being uploaded to the website, the virus injects it’s code. So the webpage on your PC looks fine. By the time it gets to the webserver, it’s infected. This method will not leave any evidence in the FTP logs because the source IP address in the log file is yours.

The fifth and final way the virus works, that we’ve seen, is that it waits for you to FTP something to your website. When you do, it also uploads an infected webpage, different than the one you’re uploading, to your website. This one we’ve just started seeing recently. But we have tested it. We’ve sent webpages to a website and then watched as a different webpage is uploaded at the exact same time as the file we uploaded. So again, there is no evidence in the log file because it originated from our PC at the exact same time.

This comment is getting long but I promised I’d also explain why hackers do this.

Money.

They make money from infected PCs. What better way to infect PCs than with a “drive-by download”? Just by people viewing those infectious websites, they run the risk of being infected. Once they’re infected, the hackers can install other malware on their PCs which they, the hackers, get paid for.

It’s no longer about showing the world what they can do. They now profit from their craft.

Money, it’s what makes the world turn.