My website got hacked. If you tried to reach this site in October, you probably noticed. I owe you an explanation and an apology, and I’d rather give you both straight.
What happened
On September 22, WordPress released a fix for a serious security flaw. WordPress normally installs fixes like that by itself. Mine tried twice that week and failed both times because of a file permissions problem on my server. Nothing broke. Nothing looked wrong. The site just kept running on the old version.
The next day, someone started trying that exact flaw against my site. Early on September 24, they got in. The break-in took ten seconds: seventeen automated requests, dressed up to look like an ordinary web browser. Over the following days they planted their own tools and gave themselves a second administrator account. By mid-October they were using my server to attack other computers on the internet. Amazon flagged the traffic and I shut the server down.
What may have been exposed
I’ll be direct, because you deserve that. Whoever got in could reach the website’s database, which holds what people typed into the forms here: names, email addresses, phone numbers, and messages. I went through the logs and found no sign that the data was downloaded, but a missing fingerprint isn’t proof, so I’m treating it as exposed. The site has never taken payments.
If you’ve ever filled out a form on this site, be a little extra skeptical of any unexpected email that uses my name. If something looks off, call me before you click. I also found no sign that the attack reached my other accounts or systems.
What I did about it
- Found the door. I traced the logs back to the first attempt, so I know how they got in and when.
- Rebuilt from clean. The site now runs on new servers with fresh software, restored from a scanned backup taken before the first attempt.
- Closed it behind me. The flaw is patched, the leftover PHP tool on the server that they chained it with is gone, and I confirmed that this site can now update itself.
- Replaced the keys. The passwords and access keys the old server held have been changed or shut off.
If the site looks different, that’s why. Same words, new paint. If you’re rebuilding anyway, you might as well renovate.
The part that applies to your building
Here’s what stuck with me. The alarm was going off the whole time. WordPress tried to install the fix twice and quietly failed. Amazon’s security service logged 129 alerts that nobody read. The systems did their jobs. There just wasn’t anyone on the other end.
Every owner has a version of this. The fire panel with a trouble light everyone has learned to ignore. The roof inspection that got pushed another year. The monthly report from your property manager that you stopped opening. Deferred maintenance doesn’t hurt the day you defer it. It hurts the day somebody else finds it first.
I was a Boy Scout. Our motto was “Be Prepared,” and I’ve been preaching it on this blog for years. This fall I got a reminder that it applies to the guy doing the preaching.
So here’s my question: what’s running on autopilot at your property that you haven’t actually checked lately? If you’re not sure, call me at (510) 954-6646. I’ll always take your call.
