Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
Pages: [1]
Send this topic | Print
Topic: My site got hacked too!!!  (Read 3552 times)
« on: August 25, 2006, 12:23:12 PM »
IspXmods Offline
Newbie

View Profile
*
Posts: 24



My site was hacked as well and I'm out of town on business and don't have the files to fix it at the moment could you guys do a restore with the latest backups you might have?

My site
www.presidio-texas.com

and the forums
www.presidio-texas.com/vbb/index.htm

I really need you to help me out here!!!

thanks,
Report to moderator   Logged

 
« Reply #1 on: August 25, 2006, 12:26:25 PM »
Alex Melen Offline
President / Founder
Administrator
Addict

View Profile WWW
*****
Posts: 2,179



I don't know if you saw the announcement -> http://www.t35.com/newsaug2406.shtml (it was sent via email, on the site and on the forum) ... but the back up server was hit with the same thing. We had the image host take down the offensive image on the "hacked pages"... but other then that, we can't do too much other then help members get their back ups uploaded.
Report to moderator   Logged

« Reply #2 on: August 28, 2006, 11:16:31 PM »
IspXmods Offline
Newbie

View Profile
*
Posts: 24



ok I just got back into town and replaced all the index files and for the most part my vbulletin forum is working, but I get the following when trying to post a new thread and a few other things....

Quote
You don't have permission to access file name on this server.

I know you guys do not offer support for the vbulletin board, but could this be server related?

thanks,
Report to moderator   Logged
« Reply #3 on: August 28, 2006, 11:35:14 PM »
IspXmods Offline
Newbie

View Profile
*
Posts: 24



actually when I hit the "new Thread" button to post a new thread I get the following....
Quote

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@presidio-texas.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
Apache/1.3.37 Server at www.presidio-texas.com Port 80
Report to moderator   Logged
« Reply #4 on: August 29, 2006, 12:58:28 PM »
Alex Melen Offline
President / Founder
Administrator
Addict

View Profile WWW
*****
Posts: 2,179



Check the permissions on the files you uploaded... Also make sure you uploaded the files in the correct way (ascii vs binary).
Report to moderator   Logged

« Reply #5 on: September 02, 2006, 03:51:54 PM »
IspXmods Offline
Newbie

View Profile
*
Posts: 24



well after much digging around and testing,,, I found out what the problem was...and it was the server related...yup, the mod_security was the one.

I'm sure in your attempt to get the server more secure you installed "mod_security" with its basic set of rules, which can cause problems. mod_security can be a good thing, but when it stops your website from working its not. mod_security was popularized during the phpbb sanity worm attacks (that I am aware of), since then tons of hosts just install it and have no real idea how to configure it. The following code will allow you to disable mod_security and have vBulletin operate normally again.


Make or edit your forum .htaccess file and add the following code
Code:
<IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off </IfModule>

After doing this I was able to use my board again... just as a heads up for somebody else that might have the same probs. Wink
Report to moderator   Logged
« Reply #6 on: December 03, 2006, 01:17:48 AM »
IspXmods Offline
Newbie

View Profile
*
Posts: 24



just got hacked again!!! WTF!!!
Report to moderator   Logged
« Reply #7 on: December 03, 2006, 01:21:55 AM »
IspXmods Offline
Newbie

View Profile
*
Posts: 24



they deleted everything from my public_html folder.... EVERYTHING!! forums are gone!
Report to moderator   Logged
« Reply #8 on: December 03, 2006, 12:25:20 PM »
Alex Melen Offline
President / Founder
Administrator
Addict

View Profile WWW
*****
Posts: 2,179



From the logs I am looking at, it looks like they exploited your forum script. (Since I dont see any foreign logins or any kind of server-wide issues). What forum where you running? Was it up to date?

I double checked the entire server and it doesn't seem to be any kind of server exploit, or even an exploit of your account ... just an exploit of one of your scripts. In any case, I would change the password again just to be safe. Also, check your mysql DB's, if those are still there, your forum data shouldn't be gone (you would just need to re-install the forum).
Report to moderator   Logged

« Reply #9 on: December 03, 2006, 12:31:36 PM »
Alex Melen Offline
President / Founder
Administrator
Addict

View Profile WWW
*****
Posts: 2,179



Just did some checks for you... and it does infact look like an oudated version of VBB was the problem ... You should try to keep your software up to date... hackers find new exploits on a weekly basis. We ourselves had some past security issues with VBB (and thus switched away from it a few years ago). We can't rule out the fact that someone got your password (check your computer for spyware and change your password)... but it does look very very likely that it was a vbb exploit.
Report to moderator   Logged

« Reply #10 on: December 03, 2006, 03:02:31 PM »
Alex Melen Offline
President / Founder
Administrator
Addict

View Profile WWW
*****
Posts: 2,179



Also, if needed we have backups of your entire account from Nov 17th... please email me if you want those files.
Report to moderator   Logged

« Reply #11 on: December 04, 2006, 08:05:34 PM »
IspXmods Offline
Newbie

View Profile
*
Posts: 24



email sent... and thanks so much for all the help, this is what sets you guys apart from the rest of the other hosting sites. Keep up the great work!
Report to moderator   Logged
« Reply #12 on: December 06, 2006, 09:48:59 AM »
Alex Melen Offline
President / Founder
Administrator
Addict

View Profile WWW
*****
Posts: 2,179



I uploaded the backup of your entire account into the root directory of your account.
Report to moderator   Logged

 
Pages: [1]
Send this topic | Print
Jump to:  

Powered by SMF | SMF © 2006-2008, Simple Machines LLC