The Day My Blog Was Hijacked and How to Protect Yours

One day this week, I was sitting at my desk and clicked on my blog home page. What I saw was the screenshot in this post, combined with a eerie instrumental tune. I had been hacked by so-called “Turkish Hackers”. I panicked and instantly called the one who maintains my blog (Thank you Tony!) He tells me the hackers replaced my index page with their own. To fix it, he downloaded the latest version from wordpress.org and uploaded the default index.php file to replace the hacked one. (I don’t understand how to do that, but that’s what he said he did.) My Twitter feed then went wild with people asking me what I did or what they could do to protect their blog.

One of our resident tech gurus (Thanks Jim) at Grace Community Church says this is done as a game. They gain points for how many hits they can get from your blog while it’s been hijacked.  This is supposedly called “ethical hacking” (Whatever that means).  Jim offers these suggestions to protect yourself from being hacked:

1. Have back up of your bog or website Index file and the entire site if possible, this not only helps to restore if you are hacked but also in the event of data loss with your provider you can restore. (most hosting providers provide backups as part of the service but nothing is 100%)
2. Keep your anti-virus software on your computer up to date
3. Use a non-public email for login ID when an email is required
4. Use a strong password

• Be seven or fourteen characters long, due to the way in which encryption works. For obvious reasons, fourteen characters are preferable.
• Contain both uppercase and lowercase letters.
• Contain numbers.
• Contain symbols
• Contain a symbol in the second, third, fourth, fifth or sixth position (due to the way in which encryption works).
• Not resemble any of your previous passwords.
• Not be your name, your friend’s or family member’s name, or your login.
• Not be a dictionary word or common name.

E. Be aware of your surroundings and people when on public wifi or hotel network and not log into secure sites such as your blog, bank or work server.

F.  If you are going to be using your laptop on a public or non-secured wifi network or a hotel network and login to secure areas consider using and/or subscribing to a secure SSH Tunneling service or VPN if appropriate.

Again, I don’t know how to do all those things, but I rely on a lot of people who do.  What suggestions do you have?  Has this ever happened to you?

UPDATE:  (Later in the week another friend of mine emailed to tell me he was in the same coffee shop in Nashville where we had been earlier that week; the day before my blog was hacked.  Someone tried to get onto his computer while he was there.  He thinks that’s where mine was accessed.)

Be careful.