Teams Webpages and Security [Archive]

Fordman

7th December 2005, 07:32

hi Guys,

Just a quick note, for all you who have Team websites. Please make sure your security is upto date, i.e. no Flaws, or Holes or anything like this. The T7R website has been tampered with, as you can see, so this is just to inform you all, check your software.

Regards

Fordie

P1lot

7th December 2005, 07:48

These meddlers are scum of the earth!

Fordman

7th December 2005, 08:05

Thanks to Lippy, we are back up and running now. The index.php file had been changed, as well as a strange modification date to another file. Again, just a heads up on check your software for updates.

Vykos69

7th December 2005, 08:35

These meddlers are scum of the earth!
Hmm, what's up with your teampage then, Link doesnt work in your sig there...:shrug:

inCogNito

7th December 2005, 08:45

:ices_rofl

Fordman

7th December 2005, 09:25

Hmm, what's up with your teampage then, Link doesnt work in your sig there...:shrug:

It does :scratchch

noemfie

7th December 2005, 09:30

It does :scratchch

I think he was refering to p1lots sig :)

Fordman

7th December 2005, 09:56

I think he was refering to p1lots sig :)

:doh:

P1lot

7th December 2005, 15:52

Ah, but ours is planned maintenance... Honest :)

Vendetta

7th December 2005, 16:11

Well, at least things are fixed and all fine now :)

Bismarck

7th December 2005, 18:31

Wanna see a hacked teampage, have a look at ours now. :bigeyes2::thumbsdow:mad::bigeye::evil::bananadea
At least the freak spent us a nice picture.

Some people have too much time.

ayrton senna 87

7th December 2005, 18:33

the T7R site says 'hacked by shadow' to me, unlucky lads

Tweaker

7th December 2005, 18:34

Well, at least things are fixed and all fine now :)

I still see a hacked page. Bummer.

three_jump

7th December 2005, 18:39

it's hacked again.....

Anarchi-H

7th December 2005, 18:49

Heh, mister shadow has lame html skills; infact, isn't 'MSHTML' MSWord or Frontpage? Haha, 1337 h4xx0r!!!1!oneone

It was fixed earlier, cos I visited it, but it appears you are still vulnerable Fordy.

<HTML><HEAD><TITLE>( PAGE NOT FOUND) ERROR 404</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR></HEAD>
<BODY bgColor=#000000>
<CENTER>
<IMG height=542 src="http://img225.imageshack.us/img225/9677/shadow2hg.jpg" width=800>

 
Hacked By Shadow
Thanx - Thehacker
<div align="center"> 

</div>

Presuming mister 1337 h4xx0r reads this; I mean, really dude, for a start you could at least use xhtml, and at the absolute minimal close your bloody tags... Where the hell is your closing HTML tag?
Not to mention STRONG and FONT are so 1997. Get with the times mate, go lookup some CSS, and do some research on semantically correct markup.
Sheesh.

I recommend changing all FTP / file management & admin script passwords. Whoever did this is a script kiddie with as much technical ability as my rather tasty spicy chicken wing. If it is a hole phpnuke, upgrade it after changing password and see if the little prat does it again.

Bob Smith

7th December 2005, 20:36

Hahaha, and the proper term is "cracked" anyway, not "hacked". Foo.

Fordman

7th December 2005, 21:19

Heh, mister shadow has lame html skills; infact, isn't 'MSHTML' MSWord or Frontpage? Haha, 1337 h4xx0r!!!1!oneone

It was fixed earlier, cos I visited it, but it appears you are still vulnerable Fordy.

<HTML><HEAD><TITLE>( PAGE NOT FOUND) ERROR 404</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR></HEAD>
<BODY bgColor=#000000>
<CENTER>
<IMG height=542 src="http://img225.imageshack.us/img225/9677/shadow2hg.jpg" width=800>

 
Hacked By Shadow
Thanx - Thehacker
<div align="center"> 

</div>

Presuming mister 1337 h4xx0r reads this; I mean, really dude, for a start you could at least use xhtml, and at the absolute minimal close your bloody tags... Where the hell is your closing HTML tag?
Not to mention STRONG and FONT are so 1997. Get with the times mate, go lookup some CSS, and do some research on semantically correct markup.
Sheesh.

I recommend changing all FTP / file management & admin script passwords. Whoever did this is a script kiddie with as much technical ability as my rather tasty spicy chicken wing. If it is a hole phpnuke, upgrade it after changing password and see if the little prat does it again.

Cheers Anarchi-H

Fordman

7th December 2005, 21:28

Anarchi-H,

What do you make of this?

Rumiko

7th December 2005, 21:38

sir, you need to update to latest phpbb
http://nukecops.com/postt44102.html

Fordman

7th December 2005, 21:49

sir, you need to update to latest phpbb
http://nukecops.com/postt44102.html

Cheers, Lippy is working like a mad man trying to fix it. :thumb:

lippy

7th December 2005, 21:50

Thanks for the pointers guys. This is just what you need on a Wednesday!

Would have found the first exploit earlier, but the provider had just rolled the raw access log into the site stats system.

As we have all the data, I'm reading lots to make sure I dont break anything more important to us while upgrading the phpbb stuff.

Lippy

Krane

10th December 2005, 22:22

http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=348139
There appears to be a new worm on the loose. If your phpBB has been defaced, please do the following:

1. Immediately get full backups of your entire website including phpBB
2. Immediately get full backups of your database
3. Get log files
4. Do not delete anything!
5. Do not use these backups to restore your site.
6. These backups are to be used to send to the Incident Investigation Team, and only the Incident Investigation Team. If the poster asking for logs or backups does not have a Support Team rank, do not do anything they tell you to do.
7. PM NeoThermic or myself to tell us you need assistance. Do not post in support asking for help.
8. Close your website (including phpBB!) until the IIT tells you it is okay to reopen.I guess that affects users of PHP-Nuke too, isn't it based on phpBB?

the_angry_angel

11th December 2005, 16:55

What do you make of this?Looks like the Ronin-style attack. This file which is part of phpBB allows a user to remotely execute code. Usually they apply a wget command to download a file, and then run it. I cant see this in the provided log extract, but you never know.

Check your server for additional files, rootkits, etc. You can use chkrootkit, and rkhunter for this (presuming its debian, run apt-get install chkrootkit rkhunter, as root, or a user with similar privs). Check the rest of your logs, including syslog. Its also a good idea to run the rootkit checkers on a cron. Also check the currently running processes for anything funny (ps aux).

I believe theres a patch for this.

Edit: A suggestion would be to run a non-standard package to manage your websites. The more popular site management tools do attract crackers, and its easier to look through the code for vulnerabilities. I'm no fan of security through obsecurity, but custom written websites are harder to crack if you dont provide the source.

Rumiko

11th December 2005, 17:31

I believe theres a patch for this.
It's already been said, ver. above 2.0.15 do not have this vulnerability. Most of phpbb hacks are a result of people using code, which is sometimes even several years old.

the_angry_angel

11th December 2005, 17:42

It's already been said, ver. above 2.0.15 do not have this vulnerability. Most of phpbb hacks are a result of people using code, which is sometimes even several years old.
See, now thats the problem with forums/mailing lists. You read past what everyone says and say the same thing. You dont get that issue with IRC.

:)