One of my sites recently got hacked with the dreaded pharma-hack. The hacker inserted
base64_decode'd code into
Initially I thought the FTP password was discovered since the password was quite weak.
However, the Hosting providers indicate that there has been no FTP access from other than my I.P. address. And also the file bootstrap.inc's "Last Modified" date has not been changed.
I let the client know to change his FTP password, and he's only done it a day after. However during that time, they changed another file
includes/cache.inc (must've realised the code has been removed from
bootstrap.inc), but the cache.inc's Last Modified date didn't change either. So now he's (client) changed his FTP password, but I'm worried that this hacker is gaining access not by through FTP, but by some other means.
I've thoroughly went through the site, and haven't noticed any abnormal, or out of place *.php files uploaded into the directories. Maybe I haven't looked hard enough? What other means are there to change a file's contents without using FTP? And how to change a file without changing the modified date?
Update: Most likely an FTP breach, as the affected site had a very weak FTP password (8 char only, all lowercase, only alphabets). This was probably done through brute force guessing the password, and then uploading a file that's sort of like a file manager. I seen this file cleverly (well not so I guess) disguised as
LICESNE.php (hacker can't spell :) ) and ironically I managed to hack this file and gain access to the administration screen.
From this page you can create new files, modify existing files and run scripts on the server, delete files, manage databases etc. It was a 1 page hacker administration page!
The sites have not had a breach now as I've done the security updates and changed the passwords to secure ones.
Again thanks for all the answers and comments. Much appreciated.