My name is Ana and my site was hacked

At the beginning of this week this website was hacked (twice). A security vulnerability in Pivot (the blogging system I use for this blog) was exploited. Fortunately,  the site didn’t suffer much damage. The first of the attackers uploaded a script called PHPShell, which is supposed to give you the possiblity of running shell commands through a web interface. They hid a copy of this script in a file called “quad.jpg.php” and another in “image.php”. The second attacker simply defaced the index.php file, leaving just a line with a greeting from one script-kiddie group to another. The worst thing is that it was all my fault. An update that solved the security flaws was released in the beginning of June, almost two months ago, but I wasn’t aware of it.  Now the site has been patched and I have learned the lesson. I will be much more careful now and won’t dismiss funny little details like weird searches in my search engine referrer log (like the ones that use Googles “allinurl” operator) or files with funny extensions like “.jpg.php”.