Cybersecurity small business concern
Hello All,
Our products are very innovative in a competitive market, and we have been very careful with our online presence. However, without offering all of our products online, we won't be able to succeed.
We have also been battling unexplained security issues (store disconnecting from payment gateway, plugins removed, clients complaining of order processing issues even though they do not appear on our side, etc.).
We have tested for malware, intrusion, scanned everything by various means, changed web design from scratch, passwords, login data, etc. That seem to have eliminated the majority of the issues (although this might be temporary again), but we noticed something really strange and hope that someone here might be able to point us into the right direction.
When 'running' a Google search for the first time, we get a result that fits our needs. Going back the next day, running the same search does not show any of the previous results anymore. Sounds weird, and for a long time we thought that we just don't remember. However, tested it on another computer simultaneously with the second computer showing the same result as the first one a day before. In the second search, it appears that when ever we run the 'same' search again it does not go to google page 1 anymore but rather jumps to page 1000 which will not answer any of the questions we originally had. This also applies to name searches. For example, looking for a person 'John Doe, Rockford, IL email address'. Will result in several John Doe listings with email, LinkedIn, twitter, fb, and what ever else and or in the city we asked for. Running that exact same search later in the day or days later will not show any of the previous results, but list a history professor named John Doe who wrote a poem about someone living in Illinois in the 1800s.
We now had a developer mentioning potential sabotage and suggested reaching out to cybersecurity experts. How would we be able to find someone to solve or help with this? Has anyone ever heard of this before?
Thanks in advance
Hey @Idefix01 - security is honestly overcomplicated at times. If you're interested in a free vulnerability assessment or just want to chat security, happy to talk!
https://calendly.com/securestate/lets-talk-security
What tech stack are you using including database?
Thank you so much for your response. Currently, we are using Wordpress (re-built some sites from scratch to get 'rid' of the problems without success), then switched to Shopify and started from scratch again. Hosting via a hosting company. Several other platforms in e-commerce and had several email servers with one being a dedicated high security monitored server. Nothing helped. Windows, Linux (not an expert around here) and MAC. Brand new equipment several times without outside connection set up behind firewall, switching phone numbers, email addresses, you name it, we tried it. Had several 'experts' advising and all threw in the towel as it won't take longer than 2 weeks and the problems are back.
The issue we now have confirmed is that our 'Google searches' (same with Duck Duck and other browsers) all seem to show results from 2012.
We are hoping that anyone would know of how the 'google issue' is being done, as that might provide a clue of how this is set up and can be traced and removed.
Not a techie here, just hoping to learn from this extensive network.
Thank you in advance.
And when you install your WP plugins, do you do so using the admin control panel or do you manage your code using Git?
(It won't make any difference how many firewalls and scanners you put in place if you can't track the code in your system.)
Yes, we are using the admin control panel
Which means anyone can upload code onto your site via the admin panel. The WP plugin system uses FTP. You should really be maintaining your plugins manually and tracking your codebase using Git with GitHub or another git provider.
If you had done so, you'd have an audit trail of any changes applied to your system. You'd also be able to spot extraneous files written to your install that weren't under revision control (i.e. hacking rootkits etc).
Is your database hosted on the same server as your wordpress install?
Is your wordpress installation up to date?
Most importantly, are your passwords auto-generated or did you choose them yourself?
This makes total sense, thank you.
Does this mean, we would have to start from scratch again and then set up all this to have a basis we can build upon and track potential changes?
The database and the Wordpress install are on the same server now. All though in different accounts with different passwords, but that did only delay things, not prevent them from happening. Changed hosting companies and had them on different servers before making the switch. We even had it split in different countries/continents. It did not help.
Regarding passwords, we tried both and still do. At least 18 signs and as difficult as they come, but that did not seem to help much either. Which is better?
We also have 2fa, used a yubikey and password managers. None of that helped either.
Thank you so much for your kind help!
You should rebuild your wordpress install from ground up.
Install the base system locally and commit your code to git.
Then create a git branch install your theme. Use the theme direct from the vendor. Commit your changes and merge them back to your master branch.
Incrementally add each plugin to your repository in the same manner. Each commit represents a discrete unit of work.
Build it up layer by layer.
Setup a fresh Linux machine and update the OS security patches. Setup SSH with password connections. To deploy your code clone your repository on to the machine.
Use a managed database external from the machine in the same region. This way you can easily build a Linux machine from scratch or update without issues. The managed database will usually have automatic updates and backups and this will mean you won't be burdened with the responsibility of managing it - you should be focusing on running your business.
Make sure you don't commit passwords and sensitive data into your repository by adding appropriate files to the .gitignore file of your repository (a file that contains a list of files, patterns and directories not to ever be tracked).
Document and write down a procedure to rebuild your wordpress install ground up using am external doc (Google Doc should do it ). You can share your procedure with anyone, including other Indie Hackers. Your system isn't less secure by telling others about how your security works. Your system is only as strong as the keys and procedures protecting it.
You need to cultivate a security conscious attitude throughout your company. You need to rotate passwords frequently. If employees leave, you need a policy to remove accounts. You shouldn't share passwords between users, don't ever recycle them and don't choose them manually - use a password generator.
There are many levels of security in your system. Make sure you're using TLS for your site. Make sure the connection between your database and server does so also.
Also, don't feel bad about it (I'm sure it's stressful). Work forward from here and learn as you go along. Some of the Google search stuff you mentioned might have nothing to do with this. You should use Google search console to get data about your pages. It will show you when they last trawled your pages and if they consider any of your pages a risk.
Thank you for your time and all the information provided. This is truly helpful, however, not sure of how to attempt this as we sure do not have the knowledge for such a daunting task.
This is thoroughly overwhelming.
How would this secure the email server or is this unrelated?
The info regarding the WP install is unrelated. Not entirely sure of the details of how your email is setup.
It's been many years since I used PHP. In the past I had Postfix running on my Linux server and it was configured to relay email to the SMTP server ("the email server"). PHP has a mail function that can be configured also.
As general advice with regards to email, you should not run your own mail server. Use a third party service like AWS Simple Email Service (SES). You can configure it so that only mail from your application will be delivered. Look into SPF records and DMARC and take a read about securing mail servers in general. If this is beyond your knowledge, better to hire a professional (don't ask me as I'm not doing PHP or managing other people's infrastructure - but i expect there are plenty of people on here who would help you out).
Also have someone check your DNS and host it with someone like CloudFlare who offer a free tier with various protection services.
Keep in mind, I'm giving very technical advice here and I'm not expecting you to understand it all and act on it yourself, but it might be useful as a bunch of points you can raise with your next developer and ask them to implement some of them on your behalf.
A good starting point might be for you to document how and where your project is running. From database server versions, where you host it and what you're paying. The DNS where it's held etc . Which versions of PHP you're using and versions of plugins etc. You can include usernames for database and admins and roles (don't write the passwords in it).
Although that information is tedious to write down, it will help any developer work faster to provide a solution. Otherwise they're going to have to ask you a ton of questions like i have on here.
Thank you so much! Indeed very technical, but gives us a lot of info that we can research and understand the whole process a bit better when heading out to find a new developer.
We truly appreciate all the time you took to provide this information. Thank you.
If your system has already been compromised, you're in a tough spot and will probably need to hire an expert to do cleanup.
Going forward, if you can afford it, I highly recommend setting up bounties with HackerOne. It will make your system dramatically safer over time and ultimately the cost is small compared to the cost of real attacks.
Thank you so much for your response and suggestions. It is greatly appreciated.
I have been very brief in my response, which can only be attributed to being completely overwhelmed. Thank you again for your suggestions, we already reached out to HackerOne, even though we are too small of a company compared to their usual client. However, we do not want to leave any stone unturned.
It is very difficult for someone not versed in this to decide who is an expert and who might not be, as they all seem to have so much more knowledge than us.
We followed every advice and had many experts working on this, just to return to the same situation. Many had said that they underestimated the situation, and that is understandable.
The amount of damage this has caused is beyond belief.