its exactly the same as the incidents with Godaddy a few weeks ago, you spend hours and hours putting it right to wake up and find it done again.

at least Godaddy have a “revert to date” feature on their backup system so you can just revert to your last known safe date files, MediaTemple is a f’in nightmare by comparison.

The problem for me is I’m an idiot when it comes to this stuff and I’m not tech savvy at all. So, while those of you who know what you’re doing had a rough time searching for code, etc — imagine what it’s like for me, someone who hasn’t a clue what to do, what to look for or even what the hell “grep” is.

The kicker is that my personal site is running WordPress NOT via Media Temple and I haven’t had one issue at all. I feel like I’ve received some sympathy from Media Temple, but not any help. Whether it’s a security issue on their end or not [I still believe it is], I can’t possibly figure out how to fix things by any instructions I’m finding online because when it comes to this stuff, I’m about the intellectual equivalent of a toddler.

I’m really aggravated. I was able to look at a dropdowns.js within my WordPress theme and did find the var st1 = 0;document.write(unescape .. thingy. I’m not even using the dropdown feature so I deleted it, but also have a fresh one that I just downloaded in case I do need it.

Seriously — this entire situation has been frustrating for many people who KNOW what they’re doing, yet what about us who don’t?

PS: I’ve been told so many times by Media Temple to make sure my WordPress and plugins are up-to-date, that it truly makes me believe they feel I am the reason for this happening. My plugins and WordPress were up-to-date, which makes this even more frustrating. I’m basically at the mercy of someone at Media Temple “possibly” helping me. The $20 credit they’ve given me over this doesn’t nearly cover the time and aggravation I’ve spent trying to understand how to fix this myself.

I am so DISENCHANTED with mediatemple! Sure, we can say “they have to” product their business from liability of downed site. But this is so obviously not a general WP issue: it is one specific to WP@ mediatemple! LAME B.S.

The problem with not knowing how the initial upload occurred is that it is difficult to seal definitively.

It might be worth looking around on hacker sites to see if the bragging reveals any details. I could imagine, for instance, an exploit that used some of the file upload plugins for TinyMCE.

thanks to all contributors (what a pain/waste of a day)

thanks to all contributors (what a pain/waste of a day)

(mt) Media Temple Weblog — Security Facts

Thanks!

There’s a lot of very useful and important information here. I’m hoping it will eventually be possible to compile all the known resolution methods into some kind of tutorial for systematically tackling the problem. I’ve already lost one client due to their site being blocked/blacklisted, so I’m not happy.

The main thing that concerns me is that (mt) doesn’t know where the hole is — or precisely how it’s being exploited yet. With all due respect to them and their efforts, I have a sinking feeling I’m going to be hunting for obscure snippets of code until they (and the rest of us) do know for certain.

Based on what I’ve read here and seen on my own account, I’m convinced that TinyMCE does play a significant role in this. Here’s something from last year that seems disturbingly relevant:

http://yehg.net/lab/pr0js/advisories/tinybrowser_1416_multiple_vulnerabilities

I could be wrong, but I suppose we’ll find out.

Honestly, we could not find any consistent connection between users who had been compromised by JohnnyA and users who had edited their /domains/ permissions. Thus, we can’t say for certain that it was the source of the breech. Also, unless you had chmod’d the perms for your /domains directory yourself, your sites would not be vulnerable from your neighbors. With regard to the guarantee that access points are sealed off:

The ACLs that we applied across the entire (gs) Grid-Service has sealed up any possibility of neighboring users from viewing any files regardless of permissions.

If you want more information on security at (mt) Media Temple please visit our security wiki page.