Do get rid of all the excess .htaccess, but if they keep reappearing in directories where they aren’t necessary (a) delete the code and insert some harmless text eg. #boil your head wpyii2# to stop them affecting the function of your website and (b) you’ve definitely missed some of the fake app’s php files, see (2) below.
Fake php files are hidden in a variety of directories where you may not be familiar with what *should* be there. Obvious vector directories are in the plugins – particularly the ones everyone has. Akismet is an obvious one to examine. File names include a series of numerals, as well as the following that I’ve seen: index2.php, content.php, radio.php. The latter, non-numeral files, tend to be c. 4.41kb in size and will have a date last modified later that the files in which they sit. As previously mentioned wp-admin is also often used, particularly /wp-admin/css/colors/
Some recommendations for those of you that can’t upgrade to the latest (greatest) version of WP – which you should absolutely do if you haven’t a very VERY good reason not to.
Use a fully configurable firewall app such as WordFence – this has a bunch of very useful features straight out of the can. But it is subscription so you might want to also implement the plugins like following instead, or as well as:
Login No Captcha reCAPTCHA (Google) by Robert Peake and Contributors – this will stop hackers getting into the admin area by force – or at least it has so far.
WP Force SSL by WebFactory Ltd if you have SSL – which you should by now.
Make sure you have in your “define( ‘DISALLOW_FILE_EDIT’, true );” config file, and that this file is linked in to your WP install’s directory rather than hosted there.
I am happy to report all websites are now clear and functioning perfectly, even the ones on deprecated versions of WP, plugins and themes.
I’ve just spent a week disinfecting my server from this pernicious bit of ruskyhack. Not only has it completely derailed my working week, its meant that my team have had very little work over that period as my websites have been unable to process orders. Whoever the surnames Skorobogatov, Serebryakov and Biryukov refer to, well, they should be ashamed of themselves.
The context is this. On a server (not the one this blog is hosted on) I have c. twenty installs of WordPress, plus several apps which are collected in three or four directories. I’ve got a variety of domains and subdomains, as well as password-protected directories for particularly sensitive work apps.
Now if I say that some of these apps take data from my WP install DB repackage it and spit it out via the Royal Mail API into their Click and Drop app, you will get why this fake plugin has completely disrupted that workflow. And of course the problem with some of the WP installs I am using is that, because of its wide integration into our production systems, I cannot upgrade either the WordPress version or the plugins associated with it.
WPYII2 found its way onto the server mid-week last week and the first I knew about it was some code appearing at the top of the homepage of several of my sites.
The damage was extensive. I lost three separate bespoke apps we use regularly for business because the fake plugin deletes top level ‘index.php’ files when they are not associated with a WP install. Luckily I had different earlier iterations available on the server so I could cobble together replacements – which ended up improving on the earlier versions.
As for the WP installs, well, they all fell over, repeatedly. I ended up playing whack-a-mole for a couple of days while trying to understand what the hell was going on. It didn’t help that there were plenty of posts from security firms saying, yes, this is a thing, and we’re here to help you get rid of it, but very few saying this is how you do it. I *think* I have done it, and the solution has ended up being cobbled together through trial and error and some helpful non-specific security posts from a variety of sources [for example]
So how to rid your WP install of this vicious fakery?
Open top-level index.php and delete the machine code sitting in lines 1-3
Delete any ‘new’ files at top-level that you don’t expect to see.
In cpanel use phpmanager to flip between php version to disable the fake plugins chron jobs
Replace the .htaccess file text with the single or multiple install vanilla code from here: https://wordpress.org/support/article/htaccess/
Delete all .htaccess files below the top level on the WP install.
Delete any folder in plugins which isn’t something you have installed eg. the folder called “wpyii2”
Look for any folders / files which have a recent ‘last modified’ date which you don’t recognise as being something you did.
Repeat 1 through 4 if at anytime the website won’t display / shows the code at the top of the page again.
Check 5-7 if you have to repeat 1 through 4
Once you have a clean install, or at least as clean as you can make it, and you don’t have to maintain an outdated version of WP, upgrade to the latest version of WP.
Upgrade all your plugins and themes. If you have made bespoke versions of themes by changing the code, I’d recommend trying to find a different way of creating the same effect through the customization options for that theme rather than altering the php.
Protect the ‘wp-admin’ directory with a password (check to see whether this works for your install of WP – I’ve had mixed results)
Install a firewall plugin – eg. BBQ Pro or similar
Install a 2FA plugin
Install captcha on login plugin.
Install a SSL/HTTPS force plugin – assuming you have a live SSL certificate for the relevant domain.
For 13-15 remember to do this for all iterations of a multisite – although BBQ Pro will activate across the network without further configuration (which I like).
With your wp-config.php file, add the following code before the ‘Happy Blogging’ message –> “define( ‘DISALLOW_FILE_EDIT’, true );” – this stops all editing of php / css / html within the WP environment (see note 11 re: editing themes etc.)
Consider moving the config file to the top level of your server, ie. above the ‘public_html’ directory, using the php code ‘require_once ‘/home/username/wp-config.php’;’ on the ‘wp-config.php’ file within the WP install directory.
As of 15th June 2022 I seem to have reached a stable environment with the fake plugin effectively being locked out by the abovenoted steps. However, I continue to monitor the server, and use downnotifier.com to give me immediate intel if things go awry. Any recommendations on other steps to keep this stuff away, let me know!
The cost of all of this to my business? Who knows? My time / stress? The lost orders? The lost IP? Those who black hat hack should reflect on their lives and wonder whether their skills could be better used elsewhere.
Over the last month, watching the horror of Putin’s unwarranted invasion of Ukraine, the horror has emerged on the page. The mad bear was obvious. Dancing While No-One is Watching and Lost In The Woods not so much until the gimlet eyes starting appearing.
As web developer and visual designer I’ve been working on ZippedyZoom.club which is part of TWTC’s response to Covid-19 – providing both a portal for kids to access fun activities and awesome stories, and a place for creative practitioners of all sorts to keep working. With funding for an initial 12-week run, we’re focussed on delivering content beyond that endpoint. Have a look here.
After several requests, and given that we are nearing the festive season, I thought I would finally try my hand at developing a cross-stitch pattern! The results can be found here and below is a gif of the unrestricted palette version (you’ll need 95 colours!!).
Readers will be aware of my ongoing design and illustration work, as well as installations and videos I have produced over the years. Last year, inspired by a series of illustrations I produced prior to delivering a show in Birmingham, I launched Selwyn & Ink a portfolio website and overall brand to encapsulate this work and separate it from ScottishLaird and Dunans Castle. The website is available here.
One of TWTC‘s perennial favourites travels to Pitlochry this summer. A night not to be missed. I designed the poster, and also produced the video below – which will give you the idea!
We wanted to do something different with our signage, refresh it yes, but more than that. Reflect our ambition, create something familiar yet original. I think we’ve done it. (Please ignore the calibration and cropmarks!)
For the last couple of months it has been my privilege to work on the album artwork for this superb set of 10 songs, not least because I have been listening to the album as I designed it. And the songs are now truly part of my soul! Man, they are good, and all written and performed by Argyllachs – or at least adopted Argyllachs. Produced by Joe McAlindan (AKA _linden) and mixed and recorded by David Donaldson, the album is called, In The Wild Country and will be released in the next 6 weeks or so, with previews available as EPs on various digital outlets.
You may have wondered why I have been quiet of late, well, for the last month I have been adding a t-shirt a day to tee.uno inspired by something that’s happened during the day, it’s become a sort of blog. A tee-blog if you will. One of the first posts was that tee about BoJo for president …
Why? Well, obviously in the hope that some of the t-shirts sell, but more because I enjoy designing visuals to be seen. At the moment these designs feel as if they are scratching the surface of the type of tee I wish to create and that after a while I’ll start to develop a typographical / editorial modus operandi that will distill visual and meaning into really pithy, well-wrought slogans.
I am also working on commissions for a certain theatre company I design for. The Ninja tee (pictured above) is a line from one of their shows… there’ll be a series of these over time!
