Unicyclist.com Forum Hacked and Back Under Control - Page 2

MUniMac · 2004-11-14, 09:33 PM

Gilby, Thanks for making this forum available to us (even when you have to deal with the unexpected!) Great job...

-Malcolm

GILD · 2004-11-15, 09:29 AM

adding to the chorus of "THANK U's"

DarkTom · 2004-11-15, 10:07 AM

Gilby, there's a guy in my internet class who knows about this kind of thing and he reckons you should:

"Check the full sites DIr structure and check for any PHP or ASP or CGI scripts pages or documents that you dont know.

What an attacker will do while attacking a site is gain some sort of access to the site's direcotry, if this is whats happened here then they didnt just get access to the forums, they will have prob uploaded a backdoor .asp,.php.cgi file to the site that will allow them to come back any time they like and change edit delete or upload new pages.

They will also prob wait a wee while , this wait allows the site admin, this being you, to feel ok and confident that the attack has been stopped but then in a week or so some pages might start to get changed or files uploaded."

This is what he typed in for me, I don't know anything about all this, I just saw your post, said to him and he told me all this.

Hope it helps.

Thomas.

gossi · 2004-11-15, 01:09 PM

In Fact "vBulletin" stands for Security, and out of my point of view, I see vB as a save Software. So, I dont know what kind fo custom scripts Gilby adds to this, but maybe there was a SQL-Injection possible. And than, it's no problem to gain administrator access. That is a possible reason and an often used exploit on webthings. So, check every SQL-Statement, be sure that the arguments surrounded by Quotes and addslashes is active either by its function or by magic_quotes_runtime :-).

Ride On,
gossi

Antimatter · 2004-11-16, 10:57 PM

thanks gilby

who would go and hack the unicyclist forums? i mean honestly its not like we're out to get anyone or do anything harmful to society. do we have any enemies i dont know about?

fexnix · 2005-01-13, 09:52 PM

no I don´t think so, but many two wheelers sees us as enemies sometimes

CRAZY legs · 2005-01-15, 02:55 AM

i dont know if this is the same thing but when I go to this site the resent forum topics are gone. I dont know maby its my comp?

leeman180 · 2005-01-16, 04:22 AM

Quote:

i dont know if this is the same thing but when I go to this site the resent forum topics are gone. I dont know maby its my comp?

The same with mine. I think the website has just changed a little.

-Lee

Gilby · 2005-01-16, 04:34 AM

The vulnerability was in the script that showed the recent topics.

2004-11-15, 09:29 AM	#17
GILD Waffle-Tosser, Time-bider and JCTK Join Date: Feb 2002 Location: the bustling metropolis of Nelspruitia, south africa Age: 45 Posts: 15,569	adding to the chorus of "THANK U's" __________________ Three short Gs and a long E-flat™ - UniHoki If I'm Murdered, Don't Execute My Killer. harper MikeFule Seager BluntRM NAMASTE! Dave

2004-11-15, 10:07 AM	#18
DarkTom Get up on your roof! Join Date: May 2004 Location: Glasgow Age: 34 Posts: 872	forum attack Gilby, there's a guy in my internet class who knows about this kind of thing and he reckons you should: "Check the full sites DIr structure and check for any PHP or ASP or CGI scripts pages or documents that you dont know. What an attacker will do while attacking a site is gain some sort of access to the site's direcotry, if this is whats happened here then they didnt just get access to the forums, they will have prob uploaded a backdoor .asp,.php.cgi file to the site that will allow them to come back any time they like and change edit delete or upload new pages. They will also prob wait a wee while , this wait allows the site admin, this being you, to feel ok and confident that the attack has been stopped but then in a week or so some pages might start to get changed or files uploaded." This is what he typed in for me, I don't know anything about all this, I just saw your post, said to him and he told me all this. Hope it helps. Thomas. __________________ "DarkTom of Glasgow, one of the few uni riders here that you really musn't mess with" - GkMac "mondeos can fly" - Pebbles 24" uni for sale koxx/onza trials uni for sale

2004-11-16, 10:57 PM	#20
Antimatter Tetris Master Join Date: Mar 2004 Location: Ajax Ontario Canada Age: 26 Posts: 24	thanks gilby who would go and hack the unicyclist forums? i mean honestly its not like we're out to get anyone or do anything harmful to society. do we have any enemies i dont know about? __________________ "I drink a whisky drink, I drink a vodka drink, and when I have to pee, I use the kitchen sink"

2005-01-13, 09:52 PM	#21
fexnix I got infinite skillz Join Date: Aug 2004 Location: Stockholm Sweden Age: 23 Posts: 2,330	no I don´t think so, but many two wheelers sees us as enemies sometimes __________________ My 29er page My fresh album

2005-01-15, 02:55 AM	#22
CRAZY legs team YAMS member Join Date: Jan 2005 Location: Camden, Maine Age: 23 Posts: 128	i dont know if this is the same thing but when I go to this site the resent forum topics are gone. I dont know maby its my comp? __________________ -fat guy in little coat- TOMMY BOY

2004-11-14, 09:33 PM	#16
MUniMac Flying MUni-ist Join Date: Oct 2004 Location: Ontario, Canada Age: 29 Posts: 57	Gilby, Thanks for making this forum available to us (even when you have to deal with the unexpected!) Great job... -Malcolm

2004-11-15, 01:09 PM	#19
gossi Freistiel mit Freibier Join Date: Jan 2003 Location: Dudenhofen, Germany Posts: 1,313	In Fact "vBulletin" stands for Security, and out of my point of view, I see vB as a save Software. So, I dont know what kind fo custom scripts Gilby adds to this, but maybe there was a SQL-Injection possible. And than, it's no problem to gain administrator access. That is a possible reason and an often used exploit on webthings. So, check every SQL-Statement, be sure that the arguments surrounded by Quotes and addslashes is active either by its function or by magic_quotes_runtime :-). Ride On, gossi

2005-01-16, 04:34 AM	#24
Gilby Unicyclist.com Webmaster Join Date: Feb 2001 Location: Minnesota, USA Age: 33 Posts: 4,854	The vulnerability was in the script that showed the recent topics. __________________ Get educated about the legitimacy of government.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread: