webhost question, can this happen?

[Ana]

I've got a really puzzling problem I hope you can shed some light on. One
of my clients that I do webwork for has recently noticed a rogue porn link
on one of their deep pages. There's only one link, and it's buried several
folders down, not on a main page or anything.

How could this have gotten there? I thought hackers mostly hacked a site
and made it obvious. Could it be that someone hacked in? Could it have
been a virus that planted a link to increase traffic to their porn
site? The site is relatively popular and has a high hit count.

I didn't put the link there, and the other two people with access to the
site are like me, very vigilant about checking their computers for viruses
and not downloading anything. The host claims they check for viruses too
and it couldn't be them.

Any idea how a link can get planted on a website? I mean, a person had to
put it there, right? Or is there any other way??

Thanks in advance,
Ana

[MH]

> ... recently noticed a rogue porn link on one of their deep pages.

...
How could this have gotten there?

One easy way I know is to put a link in a guestbook type of page but that is
probably not your case..

Otherwise; to put a link in a page you would have to have access to the
source code, edit it to put the link in, and save it again on the server. So
that leaves either you or other people who have access with a user name and
password, either direct or through FTP --- or hackers.

--------
MH

[Vigil]

What OS is this on? :-)

On Tue, 23 Dec 2003 16:38:26 +0000, Ana wrote:

Any idea how a link can get planted on a website? I mean, a person had to
put it there, right? Or is there any other way??

--

..

[Pete Gray]

On Tue, 23 Dec 2003 16:38:26 +0000 (UTC), Ana <no*******@um.edu>
wrote:

I've got a really puzzling problem I hope you can shed some light on. One
of my clients that I do webwork for has recently noticed a rogue porn link
on one of their deep pages. There's only one link, and it's buried several
folders down, not on a main page or anything.

Is it a new link, or an existing link which now points at a porn site?
I ask because an organisation I am involved with got into a dispute
with the registrar of their original domain name (who was essentially
holding it to ransom), so I just registered a new domain name for
them. The original name later lapsed and was picked up by someone else
who had it redirecting to a porn site (perhaps intending to blackmail
the charity in question).
Any idea how a link can get planted on a website? I mean, a person had to
put it there, right? Or is there any other way??
Is it in a part where anonymous visitors can post comments?

Thanks in advance,
Ana

--
Pete Gray
while ($cat!="home"){$mice=="play";}

[Ana]

Pete Gray <ne**@redbadge.fsnet.co.uk> wrote:
: Is it a new link, or an existing link which now points at a porn site?

: Is it in a part where anonymous visitors can post comments?

It's a new link, buried on a page of other links. No where on the site is
a place for people to post comments.

Ugh, I guess this means someone got in.

Ok, now what do I do? I'm assuming changing the password isn't good enough
once they're in... or is it? Should I switch hosts?

Ana

[Darin McGrew]

Pete Gray <ne**@redbadge.fsnet.co.uk> wrote:

Is it a new link, or an existing link which now points at a porn site?

Is it in a part where anonymous visitors can post comments?

Ana <no******@um.edu> wrote: It's a new link, buried on a page of other links. No where on the site is
a place for people to post comments.

Ugh, I guess this means someone got in.
Maybe. Maybe not.

When was the link added? If you haven't kept your own archives, then
http://www.archive.org/ may help. But you really should have your own
archives.

Where was the link added? Was it added on your development system (from
which it migrated to your production system)? Was it added directly on your
production system (bypassing your development system)?

How was the link added? Who added it?
Ok, now what do I do? I'm assuming changing the password isn't good enough
once they're in... or is it? Should I switch hosts?

It doesn't make any sense to change your hosting service if the security
breach occurred elsewhere. You need more information.
--
Darin McGrew, mc****@stanfordalumni.org, http://www.rahul.net/mcgrew/
Web Design Group, da***@htmlhelp.com, http://www.HTMLHelp.com/

"FAILURE IS NOT AN OPTION. It comes bundled with the software."