WBTA Forums hacked

bigben2k · 05-01-2005, 08:45 PM

WBTA Forums restored

I'm sorry to report that the Forums on my site have been hacked.

So far, this hacker used the email addresses of registered members, to spam them with an invitation to his new site.

*** I'D URGE ANYONE ELSE WHO'S ALSO BEEN HIT BY THIS SPAMMER TO REPORT THEM TO: reportabuse@yahoo-inc.com . Try to include the message header, which shows the originating information. ***

***TO THOSE AFFECTED; i CAN ONLY HIGHLY RECOMEND THAT YOU RESET YOUR PASSWORDS*** both there and anywhere else that you login, should you be using the same password anywhere else.

(Details in the link above).

pHaestus · 05-02-2005, 12:34 AM

That's no good Ben. What forum software were you using?

jaydee · 05-02-2005, 09:16 AM

IPB 1.2. It is old and broken.

bigben2k · 05-02-2005, 01:18 PM

Yep.

I'm going to use the Mambo Forum software from now on (SimpleBoard).

I suppose that it's my fault really: the attack is apparently an SQL injection (I'm still investigating it). I have a bit more research to do, but I believe that this hacker essentially spoofed himself into the MySQL database, which would require the following information: the table name, and structure. The part where it's my fault is that I didn't change the prefix to the table, I used the default one (so the table name is public knowledge).

I've got a lot of work to do today, to change a number of settings, transfer the forum data to the new software, and reset all the passwords, again.

Otherwise, I don't believe that this hacker had any malicious intent; he just grabbed the list of emails, and sent out invitations to his new site (a hacking site, of course). They didn't deface the site or anything like that, but I have to double check everything.

They don't appear to be too smart either; I've got a long trail of their actions. They're based in Mexico, and get on the net through Prodigy. I have their IP addresses, so I'm going to redirect them to their own site, as soon as I can set it up.

If anyone knows how to setup the ".htaccess" file, let me know.

I'll post updates on the progress.

bigben2k · 05-02-2005, 05:44 PM

Some progress:

I found out that the SQL injection was indeed done through a vulnerability of the IPB forum software.

The hacker essentially followed these steps:
1-Identify a weakness in some open source software, in this case IPB forum 1.2.

2-Google the net for any site running it.

3-Apply the hack.

Much more work to do.

bigben2k · 05-02-2005, 07:25 PM

The old forum software has been disabled.

The whole site was backed up yesterday, along with the database. I'll double check the content later.

The new software has been installed, but needs to be reconfigured (It's been running for two weeks already, so I have to assume that it's compromised).

I reported the hacker to his ISP: I don't expect much though, it's in Mexico...

killernoodle · 05-02-2005, 07:45 PM

Someone must really be bored to hack your website. I mean, really. Come on.

bigben2k · 05-02-2005, 08:18 PM

Yep... an email list is 'bout the most valuable thing on there, as far as other people are concerned.

It amazes me how much work I have to do to fix this. I've got a backup of the DB, but accessing it is not so easy from the office: I don't have any database program here. I'll bring MS Access with me tomorow.

I plan to rename all the tables, because I have to assume that the table names are known now. It's probably not relevant, but I'd rather start fresh.

My hosts on-line tools won't let me rename the DB, so I have to delete it, then recreate it (which I was going to do anyways).

I've isolated the faulty software in its own folder, and removed all permissions. I have to leave it on there, until I complete the data transfer, because I might have to access the old Forums, to make sure that all the data is going to be transferred correctly.

Ugh.

jaydee · 05-02-2005, 08:46 PM

Has your host updated to the newest version of MySQL and PHP? That was supposed to fix the Injection probelms.

bigben2k · 05-02-2005, 09:50 PM

Yeah, they did.

jaydee · 05-02-2005, 10:05 PM

Must just be the old forum software. As far as I can tell SMF 1.3 is pretty secure. Havn't heard of any problems yet. What is also nice about it is it auto updates itself. There is the package manager in the control panel and all you have to do is make a few clicks and it updates to the newest version.

mastermind2004 · 05-02-2005, 10:19 PM

For the IPB 1.x series, current is 1.3. I wouldn't be surprised if there are a few unpatched holes in 1.2. As they've moved to a pay to play system, IPB is a bit hard to justify for a lot of things. It's still a very nice forum software.

bigben2k · 05-03-2005, 01:49 PM

Agreed, thank guys!

I've got MS Access here at the office today, so I'm going to be porting the new content over to SMF. The new forum software is up, but I locked it for "maintenance".

The hardsest part is going to be renaming the DB and tables. Apparently an SQL injection allows one to find out the table names, so even if I did use something custom, it wouldn't have done anything. It really came down to the fault in the old software.

I'll report the progress.

bigben2k · 05-20-2005, 11:18 PM

The forums are now restored. Old passwords are in effect.

There's still a bit of cleaning up of the converted data to do, most of which I've done manually, because I can't setup a database program here at the office (administrator restrictions), and I don't know enough about MySQL to design a query to fix it...

(Anyone have any ideas? I'm very handy with MS Access :shrug: )

Otherwise, I don't believe that the hacker actually got anyone's password; the hack was not *that* involved (but I'm not able to verify that).

mastermind2004 · 05-21-2005, 02:52 AM

What exactly do you need to sort with the query? I'm sure there are several of us here that are handy with mySQL that should be able to help.

bigben2k · 05-23-2005, 11:18 AM

Actually, I need to replace part of a post, with some new code.

For example, an emoticon was listed as <!--emot

> then the html address for it, then an end tag.

Right now, I'm manually correcting the posts, using the PHPMyAdmin interface.

I have to replace the tags for html links, and the Quote feature.

Another bugger is that the new software requires every post to have a "subject", which is the same as the first post in the thread, preceded by "Re:". (I manually set the first post's subject, because otherwise the thread name are blank. The old software kept the thread title in another table).

Joe · 05-25-2005, 04:03 PM

Theres a reason I run vbb

bigben2k · 05-25-2005, 05:30 PM

Must be nice!

All right, I have it down to one last task; updating the post "subject" field. Can anyone help me formulate the SQL query to do this?

The field in table A is called "subject". (Table A contains the post's information)

It needs to be updated to the field called "title" from table B (Table B contains the thread info).

The two tables are linked as follows:
table A , field "ID_TOPIC"
and
table B, field "tid"

The trick is that in the update, the information has to be preceded with "Re: " .

Anyone?

bigben2k · 05-26-2005, 05:54 PM

Never mind, I figured out the query.

The forums are now fully operational, and all data has been converted to the new software.

Pfew!

05-01-2005, 08:45 PM	#1
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	WBTA Forums restored WBTA Forums restored I'm sorry to report that the Forums on my site have been hacked. So far, this hacker used the email addresses of registered members, to spam them with an invitation to his new site. * I'D URGE ANYONE ELSE WHO'S ALSO BEEN HIT BY THIS SPAMMER TO REPORT THEM TO: reportabuse@yahoo-inc.com . Try to include the message header, which shows the originating information. * *TO THOSE AFFECTED; i CAN ONLY HIGHLY RECOMEND THAT YOU RESET YOUR PASSWORDS* both there and anywhere else that you login, should you be using the same password anywhere else. (Details in the link above). __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101 Last edited by bigben2k; 05-26-2005 at 05:54 PM.

05-02-2005, 12:34 AM	#2
pHaestus Big Player Making Big Money Join Date: Aug 2001 Location: irc.lostgeek.com #procooling.com Posts: 4,782	That's no good Ben. What forum software were you using? __________________ Getting paid like a biker with the best crank... -MF DOOM

05-02-2005, 01:18 PM	#4
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Yep. I'm going to use the Mambo Forum software from now on (SimpleBoard). I suppose that it's my fault really: the attack is apparently an SQL injection (I'm still investigating it). I have a bit more research to do, but I believe that this hacker essentially spoofed himself into the MySQL database, which would require the following information: the table name, and structure. The part where it's my fault is that I didn't change the prefix to the table, I used the default one (so the table name is public knowledge). I've got a lot of work to do today, to change a number of settings, transfer the forum data to the new software, and reset all the passwords, again. Otherwise, I don't believe that this hacker had any malicious intent; he just grabbed the list of emails, and sent out invitations to his new site (a hacking site, of course). They didn't deface the site or anything like that, but I have to double check everything. They don't appear to be too smart either; I've got a long trail of their actions. They're based in Mexico, and get on the net through Prodigy. I have their IP addresses, so I'm going to redirect them to their own site, as soon as I can set it up. If anyone knows how to setup the ".htaccess" file, let me know. I'll post updates on the progress. __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-02-2005, 05:44 PM	#5
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Some progress: I found out that the SQL injection was indeed done through a vulnerability of the IPB forum software. The hacker essentially followed these steps: 1-Identify a weakness in some open source software, in this case IPB forum 1.2. 2-Google the net for any site running it. 3-Apply the hack. Much more work to do. __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-02-2005, 07:25 PM	#6
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	The old forum software has been disabled. The whole site was backed up yesterday, along with the database. I'll double check the content later. The new software has been installed, but needs to be reconfigured (It's been running for two weeks already, so I have to assume that it's compromised). I reported the hacker to his ISP: I don't expect much though, it's in Mexico... __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-02-2005, 09:16 AM	#3
jaydee Put up or Shut Up Join Date: Dec 2001 Location: Spokane WA Posts: 6,506	IPB 1.2. It is old and broken.

05-02-2005, 07:45 PM	#7
killernoodle Thermophile Join Date: Sep 2002 Location: Charlotte, NC Posts: 1,014	Someone must really be bored to hack your website. I mean, really. Come on. __________________ I have a nice computer.

05-02-2005, 08:18 PM	#8
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Yep... an email list is 'bout the most valuable thing on there, as far as other people are concerned. It amazes me how much work I have to do to fix this. I've got a backup of the DB, but accessing it is not so easy from the office: I don't have any database program here. I'll bring MS Access with me tomorow. I plan to rename all the tables, because I have to assume that the table names are known now. It's probably not relevant, but I'd rather start fresh. My hosts on-line tools won't let me rename the DB, so I have to delete it, then recreate it (which I was going to do anyways). I've isolated the faulty software in its own folder, and removed all permissions. I have to leave it on there, until I complete the data transfer, because I might have to access the old Forums, to make sure that all the data is going to be transferred correctly. Ugh. __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-02-2005, 08:46 PM	#9
jaydee Put up or Shut Up Join Date: Dec 2001 Location: Spokane WA Posts: 6,506	Has your host updated to the newest version of MySQL and PHP? That was supposed to fix the Injection probelms.

05-02-2005, 09:50 PM	#10
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Yeah, they did. __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-02-2005, 10:05 PM	#11
jaydee Put up or Shut Up Join Date: Dec 2001 Location: Spokane WA Posts: 6,506	Must just be the old forum software. As far as I can tell SMF 1.3 is pretty secure. Havn't heard of any problems yet. What is also nice about it is it auto updates itself. There is the package manager in the control panel and all you have to do is make a few clicks and it updates to the newest version.

05-02-2005, 10:19 PM	#12
mastermind2004 Cooling Neophyte Join Date: Aug 2003 Location: MIT Posts: 78	For the IPB 1.x series, current is 1.3. I wouldn't be surprised if there are a few unpatched holes in 1.2. As they've moved to a pay to play system, IPB is a bit hard to justify for a lot of things. It's still a very nice forum software.

05-03-2005, 01:49 PM	#13
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Agreed, thank guys! I've got MS Access here at the office today, so I'm going to be porting the new content over to SMF. The new forum software is up, but I locked it for "maintenance". The hardsest part is going to be renaming the DB and tables. Apparently an SQL injection allows one to find out the table names, so even if I did use something custom, it wouldn't have done anything. It really came down to the fault in the old software. I'll report the progress. __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-20-2005, 11:18 PM	#14
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	The forums are now restored. Old passwords are in effect. There's still a bit of cleaning up of the converted data to do, most of which I've done manually, because I can't setup a database program here at the office (administrator restrictions), and I don't know enough about MySQL to design a query to fix it... (Anyone have any ideas? I'm very handy with MS Access :shrug: ) Otherwise, I don't believe that the hacker actually got anyone's password; the hack was not that involved (but I'm not able to verify that). __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-21-2005, 02:52 AM	#15
mastermind2004 Cooling Neophyte Join Date: Aug 2003 Location: MIT Posts: 78	What exactly do you need to sort with the query? I'm sure there are several of us here that are handy with mySQL that should be able to help.

05-23-2005, 11:18 AM	#16
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Actually, I need to replace part of a post, with some new code. For example, an emoticon was listed as <!--emot> then the html address for it, then an end tag. Right now, I'm manually correcting the posts, using the PHPMyAdmin interface. I have to replace the tags for html links, and the Quote feature. Another bugger is that the new software requires every post to have a "subject", which is the same as the first post in the thread, preceded by "Re:". (I manually set the first post's subject, because otherwise the thread name are blank. The old software kept the thread title in another table). __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-25-2005, 04:03 PM	#17
Joe The Pro/Life Support System Join Date: Dec 1999 Location: Denver, CO Posts: 4,041	Theres a reason I run vbb __________________ Joe - I only take this hat off for one thing... ProCooling archive curator and dusty skeleton.

05-25-2005, 05:30 PM	#18
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Must be nice! All right, I have it down to one last task; updating the post "subject" field. Can anyone help me formulate the SQL query to do this? The field in table A is called "subject". (Table A contains the post's information) It needs to be updated to the field called "title" from table B (Table B contains the thread info). The two tables are linked as follows: table A , field "ID_TOPIC" and table B, field "tid" The trick is that in the update, the information has to be preceded with "Re: " . Anyone? __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

05-26-2005, 05:54 PM	#19
bigben2k Responsible for 2% of all the posts here. Join Date: May 2002 Location: Texas, U.S.A. Posts: 8,302	Never mind, I figured out the query. The forums are now fully operational, and all data has been converted to the new software. Pfew! __________________ WBTA (Water Block Testing Alliance) Nordic Hardware WC 101

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)