how do those spammers get the invite code? it surprises me on how they acquire these information but yeah cash released a plugin that could lower your spam a little bit. it's called message controls:

http://community.elgg.org/pg/plugins/costelloc/read/475802/messages-controls

They don't. That's the point. :)

To join the site individuals need an invitation from me. So there are currently no spammers.

doug

oh yeah, i read it wrong lol. i think it's fun to delete spammers :)

That's exactly what Hostgator told me. But it looks like various folders even outside my Elgg instance hierarchy were hacked. They helped me clean some things up and I got my Elgg site working again by replacing all the source from the newly downloaded build. I also had to upgrade a WordPress instance that got hacked.

They say it's unlikely malware on my computer since I only use a Mac. They traced the hacking events (download/upload) to a single IP address in Israel. I've blocked that IP address and changed all my important passwords.

But how it happened remains a mystery.

I believe permission code 664 allows group read permission but not write permission. At least that is what my FTP program is reporting to me.

Thanks for your help. All's well that ends well for now. But still, I think there was a security problem at Hostgator itself.

doug

Wordpress has a bad rep on security. It is possible that wp was the attack vector.

664 means that:

• you have read and write access
  
• your group has read and write access
  
• the world has read access

It will be more secure if it is 644 - then your group does not have write access.

Here is hostgator's article on permissions: http://support.hostgator.com/articles/cpanel/how-to-change-permissions-chmod-of-a-file

Very sorry for the confusion. The permission code was, in fact, 644. I misread it.

Thanks,

doug