Site hacked!

[gstark]

While I knew that this one was around, the information I had on it didn't tell me that it had capabilities of affecting our database. So much for reliable sources.

We're currently awaiting the database restore - at GoDaddy's liesure, it would seem. The paying client needs to make alternate arrangments to ensure that a database restore can be made in a timely manner.

For now, we should be able to continue posting, but messages posted over the next two or three days - until the restore has been completed - should be treated as temporary only.

Anybody having issues logging in should clear their cookies and cache. If you're then still having issues, email myself or Leigh.

[mic]

The Russian sent me an E-mail which I dared not open, did anyone else get any Vodka.


Dirtbag, low life, mongrel Hacker

GET A LIFE !

Mic.

[Geoff]

Sorry this has happened Gary and Leigh and I know you guys have been working hard at getting the site to where it is now (11:25pm) EST...well done and your work is appreciated!!!!

[Paul]

Yeah he sent me one as well, straight to the spam bin!

[Paul]

A TT or ACA taken out context quote..

your work is greatly appreciated and I think Paul is a great guy!!!

[krpolak]

I thought he was Turkish at least he has their flag

Good we are back

Regards,

K.Polak

[Geoff]

A TT or ACA taken out context quote..

your work is VERY much appreciated!

[Glen]

Well done Gary and Leigh, I know this has been a huge huge effort. Thank You

[sirhc55]

Urah for the Starks’ - much appreciated

[johndec]

Yeah, I got the email as well and I assume everyone who has their email address listed here got one as well

What a strange evening... had to interact with my family instead of staring at my laptop screen reading posts

Thanks to Gary et al for your prompt response.

[leek]

Yeah, I got the email as well and I assume everyone who has their email address listed here got one as well

Yep... I'm looking forward to reams of useless spam in the coming months...

Good luck getting the site up to date guys...

[Geoff]

The Russian sent me an E-mail which I dared not open, did anyone else get any Vodka.


Dirtbag, low life, mongrel Hacker

GET A LIFE !

Mic.

Yup - I got an email from the &*(*)(*& too!

[kipper]

Time to delete that email account I think. Good job I put one here that I don't mind getting spam on. Used to not using my own private emails for forum logins. Too many bad experiences in the past with spam.

Geoff, nice bidding btw.


I'm going to take a look at this email......good luck to the fag if he's attached a virus. Probably one that only affects windows anyway.

[gstark]

Turkey is correct - not Russian - and turkey in more than one sense of the word.

As to a warrior .... ROTFLMAO.

The Turkey is a bigger coward than little Johnnie. Clearly the turk has no father.

[Geoff]

Time to delete that email account I think. Good job I put one here that I don't mind getting spam on. Used to not using my own private emails for forum logins. Too many bad experiences in the past with spam.

Geoff, nice bidding btw.

What a CRAZY price it went for. Do we know the buyer?

[kipper]

Lol, Geoff you were bidding quite happily yourself

Out of interest why? The other week you didn't seem keen on spending > $1800.

[Geoff]

Lol, Geoff you were bidding quite happily yourself

Out of interest why? The other week you didn't seem keen on spending > $1800.

My priorities changed a little and I had an arrangement with the seller..didn't work out ...thems the brakes

[kipper]

What was the arrangement?

[gstark]

Oh goody!
\
I've got a customer service survey to complete.

From GoDaddy!

This should be FUN!

[kipper]

How do you rate our service from 1 to 10:

comments:

Can I put in minus amounts?

[gstark]

How do you rate our service from 1 to 10:

comments:

Can I put in minus amounts?

Hopefully in Kelvin measurements!

[krpolak]

gstark

Turkey is correct - not Russian - and turkey in more than one sense of the word

Hehehe

Regards,

K.Polak

[kipper]

Stay tuned for the D70s revenge on a turkey.

[gstark]

The turkey comes pre-stuffed!

[Alex]

Well done guys in getting the site back. It was a boring night without it

Alex

[Nnnnsic]

Okay, we all shoot pictures of ducks, perhaps the "warrior" wanted us to shoot pictures of turkeys?

Maybe he has a fetish for Thanksgiving... or that episode of Mr. Bean where he has his head stuck up a turkey...

[birddog114]

Time to delete that email account I think. Good job I put one here that I don't mind getting spam on. Used to not using my own private emails for forum logins. Too many bad experiences in the past with spam.

Geoff, nice bidding btw.

What a CRAZY price it went for. Do we know the buyer?

I thought you were the buyer lastly, saw your bids repeating up to over $2100.00, should buy a brand new one with that such of money,

Patience is virtue!

[Oneputt]

Wel done guys for getting the site up and running again. I hate hackers!!!!!

[fozzie]

Thank you very much Gary or Gary/Leigh for restoring the forum. Had a very boring night so ended up going to bed early

[MattC]

I hate this sort of hacker. He did not simply place graffiti over the front page but basically destroyed the data base. The whole exercise is pointless. A quick google had me counting (before I stopped counting) about fifty sites affected in a similar way by the same individual.
My favoured method for dealing with these little turds would involve a large ball pene hammer.

Good work getting things (sort of) back Gary. GoDaddy could probably use a good kick. I hope that you serve it up to them well.

Cheers

[cordy]

Well done for getting the site back up and running so fast guys

Chris

[MHD]

Oh goody!
\
I've got a customer service survey to complete.

From GoDaddy!

This should be FUN!

Move to dreamhost
I have nothing but good things to say about them... the even doubled my storage quota last week!

[NetMagi]

was wondering why I was suddenly getting soo much spam

got 75 emails in a 3 hr period early yesterday

[thaddeus]

While I knew that this one was around, the information I had on it didn't tell me that it had capabilities of affecting our database. So much for reliable sources.

There have been two critical security patches announced on phpbb.com this year.

The first one was phpbb 2.0.13 "cricitical update" in February which plugged a hole which allowed anyone to become the administrator. This is described at http://www.phpbb.com/phpBB/viewtopic.php?t=267563 and is quite a trivial patch.

The second one was phpbb 2.0.16 in June which addressed "one critical security issue" which allowed hackers to send arbitrary SQL statements to the database. This is described at http://www.phpbb.com/phpBB/viewtopic.php?t=302011

So if you are after reliable sources, phpbb.com is the place to go.

I think it is an administrator's duty to protect the email addresses of the board's members by keeping the forum software up to date with the latest security patches. Before leek and embi jump in, I should declare that I run a similar-sized board and fell for the 2.0.13 issue. Luckily administration rights don't allow you to do too much on phpbb so not much damage was done, but I did have to apologise to my members that their email addresses may have been harvested. In the end I saw from the logs that they hadn't, so we were lucky. My setup is a bit different because I have modified the phpbb code to add additional functionality so I need to apply security patches manually, but you can apply them quite easily. I noticed that you have upgraded to 2.0.17 so that's great! I hope that you will continue to stay current.

Regarding GoDaddy, as Birddog so often says, you get what you pay for. Some mates and I run websites on servers hosted in Sydney and in the USA and we have dedicated servers (not virtual servers, actual boxes which we own/lease) with full shell access etc. To back up the database of one site, I issue one postgres command and it generates one massive file which I can use to restore the database any time I wish. I have restored the database a couple of times with one command and not one of the members noticed. So if you are looking for another hosting place, make sure you get one with shell access so you have this flexibility. If you are getting a dedicated box, you'll need to think about security of the box itself. We have shut off all unsecured connections like ftp and replaced them with scp and the like. It's a major job but sometimes you can get managed boxes where they do this type of stuff for you.

[ozczecho]

A great effort by all concerned to be up and running again in such a short time.

Pretty daring hacker hacking a photo enthusiast board forum....

[gstark]

So if you are after reliable sources, phpbb.com is the place to go.

That was my source, but I was looking at the support forums; I had already downloaded the patches for the update, but the information that I could find in the forums made no mention (that I could see) of the fact that the database was compromised by this hack.

I think it is an administrator's duty to protect the email addresses of the board's members by keeping the forum software up to date with the latest security patches.

My setup is a bit different because I have modified the phpbb code to add additional functionality so I need to apply security patches manually,

As with you, we run a fairly heavily modified board, and patching/updating is a manual process, regrettably, to be done as and when time and other duties permit.

That's one of the primary reasons why I make it very clear that this board is for recreational purposes only.

Regarding GoDaddy, as Birddog so often says, you get what you pay for.

Up to now, they've been very good. In this instance we have a disagreement as what constitues a acceptable restore timeframe.

The real issue I have is with Helstra, who are hamstringing the internet industry in this country. As most will know, until April last we were hosting everything locally. were that still the case, I could have had the backup data (backups performed twice daily) back on line well and truly within a few hours. Minutes, most likely. Likewise, the updates and testing that I need to perform before upgrading the software are much more easily performed locally, rather than remotely.

But Helstra still refuse to permit Australians to enjoy the bandwidth that the rest of the world enjoys and that is wehere I see the real problem exists: this board has grown beyond the capabilities of what Telstra's current 1880's network permits to run from a home based server. There is no reason in the world why this system could not be run from home, subject to adequate bandwidth being provided by upstream hosts.

[stubbsy]

Thanks for the quick work in getting things back up & running guys. Your efforts are appreciated. Gary I'd love to see the GoDaddy surevy answers.

Re: the harvesting of email addresses - this is probably a timely reminder to all to use disposable or similar email addresses for your contact address on sites like this. I have an old ISP account which I no longer use for normal email purposes and use that account - 99% of what lobs there is spam so it's pretty easy to get out the non spam that still gets sent there. Sites like hotmail or yahoo are useful in this regard, but themselves can be spam targets because of their high visibility.

My view is that acts like the one we've all been victim of here are part of the (sad) price we have to pay for the utility and ubiquity of the internet.

Let's go take some pics to cheer up - the next comp closes soon

[BBJ]

Well done fella's. I know i was adding a new sound card and usb ports so muy computer was off line and put a new desk in and when i got back online Jonesy had sent me an email making me aware of what was going on and first impressions were, Leigh whats he upto now?? yes sorry Leigh but i thought it was some joke and well turned out to be fair dinkhum when i recieved an email, figured they got all our addies as well in the take over, but i just black banned the addie.

Anyhow good to be back and well done to Gary and sorry Leigh that i thought you had something to do with this.LOL
Cheers
John

[gstark]

From what I can tell, they have taken nobody's email address. All they need to do is invoke the bulk malier that lives on the board, after changing the board's configured email address.

[radar]

From what I can tell, they have taken nobody's email address. All they need to do is invoke the bulk malier that lives on the board, after changing the board's configured email address.

Unlike others that have noticed some extra spam, I have not seen any extra coming in, maybe I'm just lucky

thanks Gary et al for all your efforts,

Cheers,

Radar

[BBJ]

Gary, i did get an email from what looked like an hotmail addy to do with the site being hacked, but i deleted it off the server. With my proggy i can read part of the email before i actually download to my computer as i do with all my emails black ban and bounce back to them so that why i figured they must have got the email addies.

[Nnnnsic]

I'm actually pretty sure that if you've had an increase in spam overnight, it doesn't have anything to do with our hack.

I've only had that one message myself from one of my addresses, which suggests to me he was just invoking the onboard bulk mailer as a way of saying "I 0wn j00" or whatever this script kiddie thinks he was doing.

[birddog114]

I got none of spam as usual and I frequently logged into this forum,
I logged on yesterday whebn this site was hacked.

No spam for me.

[Paul]

Same here, my gmail account is recieving the normal amount which is directed straight to the bin.
Touch wood it stays this way!

[BBJ]

I never get spam from here, just had an email which had the name of that warriors virus thingy and i am sure it said our forum was hacked, thats it.

[birddog114]

I never get spam from here, just had an email which had the name of that warriors virus thingy and i am sure it said our forum was hacked, thats it.

BBJ,

warriorvirus 1 + warriorvirus2 are our friends, haven't you forgotten them? They got their new names by the bastards.

[Nnnnsic]

Actually, I'm pretty sure why he banned both myself and Glen:
We were logged in or were logging in, which poses a slight threat to him if we override him.

[Onyx]

Stark snr and jnr, you did such a wonderful job that I hardly noticed anything was wrong until coming across these 4 page threads...

I signed up with a Gmail addy, and haven't noticed increase in spam yet. Feel free tho - dr.cbtan@gmail.com. Spam away you auto readers...

[Neeper]

Move to dreamhost
I have nothing but good things to say about them... the even doubled my storage quota last week!

yeah, it's been pretty good hasn't it? What a great deal it was too.

[birddog114]

You've been banned and now you're coming back.
What have you done to them? they hated you! Go after them!