Hack/Spam Files on My Powweb Site?

[joco]

I found a file called "blog.html" on the root of one of my Powweb-hosted sites. It's a spam page linking to a spam site. It's, of course, linked to by many spam pages on many spam sites.

I deleted it.
And I used the Google URL Removal tool to ask for it to be removed from the SERPs.

Are their other threads on here about similar issues? I want to know how it got there.

I don't run any scripts on that site to exploit. Other ways it could have gotten there?

[HalfaBee]

It most likely got there via a forum or CMS.
The common ones are always likely to be hacked.

[joco]

I've never had a forum or any script running on that site. No PHP.

I have a java Google analytics include. That's it.

I was thinking maybe this is why Powweb changed all the passwords on all our accounts a while back.

[HalfaBee]

Did you happen to notice its creation date?
If you have logfiles, it might show how it got there, but if you don't have scripts, it is unlikely to be able to be saved via html.

Maybe you should change your ftp password, just in case.
The password change was basically just a security update after changing from the old servers to the new ones.

[(jj)]

You should be able to check your Site Backups in OPs to find the creation date of that file.

[joco]

The file was apparently created before the security update so there has been a new, super-crazy numbers+letters password issued since then.

Still can't figure how the rogue file was created though. Maybe the original password was just not tight enough. It wasn't very sophisticated. I guess I'll have to start using super-crazy passwords. I have a copy of keysafe or safepass or whatever it's called but I hate using it.

[snowmaker]

I have a copy of keysafe or safepass or whatever it's called but I hate using it.
Here's another one that I find useful, http://keepass.info/

[joco]

Here's another one that I find useful, http://keepass.info/

Oop, sorry, man, that's the one I was talking about. It's a good app . . . I doubt it could be much improved upon but I really don't like using it (just another app to keep open). I've been looking at this Firefox password plugin but still not really sure how it works: http://passwordmaker.org/screenshots.html

[snowmaker]

I've looked at that plugin too. It basically takes passwords exported from Firefox (which requires an extension installed in Firefox) and imports them into Keepass.

[joco]

OK, keypass it is. I'll be using super-secure passwords from now on.

Under the circumstances though, is that what you all the think the problem would be? Someone automagically generated my easy password and FTP'd a file into my account?

Not hard for me to believe, just want to make sure I'm not overlooking anything else. Again, I don't run forums or any other kind of scripts on the site in question and, as far as I know, I haven't had any other problems like this with my other Powweb accounts.

Is this something that is usually done large-scale or one account at a time?

[HalfaBee]

If that is what they did, you had better check to see if they left any scripts to get back in.
I find it hard to beleive they would waste their time cracking oyur password and only putting 1 file in it.