Rebuilding samarthya.me, part 1: The day the blog fell
A six-year-old WordPress blog was compromised. What the attack looked like, and the first hours of triage.
Incident
A copy of the crime scene
The first full database dump: every one of my posts now belonged to an account registered in 1970.
The blog went down
The old WordPress site was compromised. Taking it offline was the first step.
The defences went off
A fake administrator, 20 plugins switched off in one second, and a hidden loader planted to stay.
Casino posts under my name
21 successful logins, and the first of 55 spam posts published on my blog.
The password worked
The first successful logins of the break-in. My reused password had found its way to the wrong people.
Someone was knocking
165 wrong passwords in one day. The busiest day for password guessing the old blog ever logged.