HACKED! by megacount.net

**JOHNNY_BUTTHOLES** · 10-05-2006, 01:48 AM

Originally posted by emthree

Yes, it was inserted into both of my footer files.
bottom1.html and bottom2.html

is it gone or is it still showing up?

**emthree** · 10-05-2006, 01:48 AM

Originally posted by RevSand

This does not seem to be a webair OR wordpress issue since I also have been hit and do not use either...

The plot thickens.

I bet the guy behind it all, is reading this and laughing at us.

**emthree** · 10-05-2006, 01:49 AM

Originally posted by JOHNNY_BUTTHOLES

is it gone or is it still showing up?

Since I removed it, I have not seen it back... yet.
How about you? What happened when you removed it?

**chaze** · 10-05-2006, 01:50 AM

Have you host run a rootcheck kit on your account, there may be backdoors still. Also have them to a search for that name in all your files from the command line.

**JOHNNY_BUTTHOLES** · 10-05-2006, 01:51 AM

Originally posted by emthree

Since I removed it, I have not seen it back... yet.
How about you? What happened when you removed it?

as i said i went through all my files (php, html) on all my sites. i found it on non-wordpress sites attached to regular php footers. i deleted it and changed the permissions to read only. it hasn't shown back up... yet.

i'm not on webair either.

**bigalownz** · 10-05-2006, 01:02 PM

Originally posted by emthree

Did/do you have wordpress installed on that site?

no

nothing at all no scipts etc just plan text

i deleted the page and put a new one up and a few days later it was back

i notice it only went on to index.html

**emthree** · 10-05-2006, 02:49 PM

**McCord** · 10-08-2006, 08:58 AM

Originally posted by Superterrorizer

You are going to switch hosts because you didn't keep your scripts up to date and your out dated insecure scripts are being exploited? Unless that service is part of your contract or SLA it's YOUR responsibility to keep your scripts up to date, not your hosts.

While many potential security threats both known and unknown can be blocked, many cannot. If your server gets hacked via an exploit in the OS or an application (apache, php, mysql, etc) then it's your hosts fault (Unless you are unmanaged/colo). If one of your sites gets hacked/defaced due to you not keeping your scripts up to date, it's your fault.

Switching hosts isn't going to magically update all your scripts and fix your security problems.

This guy/gal has it just about right. I work for a hosting provider and I've had to deal with this the past few days. Anyhow - here is a TIP:

STRONG PASSWORDS

it looks like your "hacker" is harvesting passwords (most likely insecure and very weak ones at that) and so far - the offending IP appears as (i've seen the same IP on 2 servers so far):

12.219.246.180

Ask your hosting provider (if you don't know how) to block all access from that IP and change ALL passwords on your system.

**bigalownz** · 10-08-2006, 03:58 PM

looks like Naughty america has had the problem too

there my friends hot mom members area has it too now

looks like its a big problem for all

**Machete_** · 10-08-2006, 04:01 PM

Some say its a hole in PhP itself, other say its in cpanel. in any case its = root access

**Gillespie** · 10-08-2006, 04:03 PM

I have like a 25 char pass for my root account. All letter, numbers and punctuation marks, mixed caps, etc...

I hope I'm safe. :P

**Machete_** · 10-08-2006, 04:12 PM

Originally posted by Gillespie

I have like a 25 char pass for my root account. All letter, numbers and punctuation marks, mixed caps, etc...

I hope I'm safe. :P

If they use a exploit in Cpanel or PhP as mentioned, they dont need your account.

**Gillespie** · 10-08-2006, 04:18 PM

Yeah, I know. I just updated everything as soon as I started seeing these threads in other boards a week and a half ago, so I hope I'm clear.

**facialfreak** · 10-08-2006, 06:00 PM

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

**Gillespie** · 10-08-2006, 06:12 PM

Woot! I was clear anyway =)

**boneprone** · 10-09-2006, 02:18 PM

Seems I got hacked today..

Would like if someone could shed some light on this on how they got in..

icq 66883099

**Machete_** · 10-09-2006, 02:28 PM

Originally posted by boneprone

Seems I got hacked today..

Would like if someone could shed some light on this on how they got in..

icq 66883099

dissipate posted these two pretty usefull links
http://www.securiteam.com/unixfocus/6R0030UH5W.html
http://www.securiteam.com/unixfocus/6M00315H5S.html

Im my case (webair hosted) it was through cpanel

**boneprone** · 10-09-2006, 02:42 PM

Jupiter is looking into it now.

Not sure how he got in..

Looks like he just walked right in by logging in with a password.

**Sosa** · 10-09-2006, 02:48 PM

I noticed this on one of the sites I had a hardlink trade with this morning. Bad news.

**Machete_** · 10-09-2006, 02:49 PM

Originally posted by boneprone

Jupiter is looking into it now.

Not sure how he got in..

Looks like he just walked right in by logging in with a password.

that is what happends when your password is:
From The Nectar Of The Bone Flows All That Clicks

**CaptainHowdy** · 10-09-2006, 02:49 PM

Originally posted by dissipate

Most adult servers lack even basic security measures. It's like shooting fish in a barrel.

!!

**emthree** · 10-09-2006, 02:50 PM

Originally posted by boneprone

Jupiter is looking into it now.

Not sure how he got in..

Looks like he just walked right in by logging in with a password.

I dont think that's the case. I had webair look at my logs, and they said they did not see anything funny.
Let us know what Jupiter says though.

**bigalownz** · 10-12-2006, 07:52 PM

just a qestion

do you use awstats ???

JD · 11-13-2006, 07:55 PM

bump for a fucking solution. got hit again just now

**Kimo** · 11-13-2006, 08:09 PM

theyve been hitting everyone lately

**RyanL** · 11-14-2006, 07:19 AM

ne1? ne1?

**ladida** · 11-14-2006, 07:55 AM

Most of you probably didn't even clean your sites so they don't even need another access.

**Verbal** · 11-14-2006, 08:31 AM

erased the virus and changed my password ... haven't had a problem since

**Ace_luffy** · 11-14-2006, 08:41 AM

any proofs

JD · 11-14-2006, 09:00 AM

Originally posted by Verbal

erased the virus and changed my password ... haven't had a problem since

i've done that about 10 times and it keeps happening

**HEAT** · 11-14-2006, 09:03 AM

still under hitting.

**drjones** · 11-14-2006, 09:47 AM

Originally posted by SPeRMiNaToR

i've done that about 10 times and it keeps happening

It really sucks.. but if your servers been compromised the only 100% solution is to wipe it an reinstall from scratch. If theyve had root access to your machine, they can do ANYTHING.

**pornpf69** · 11-14-2006, 09:54 AM

JD · 11-14-2006, 09:58 AM

Originally posted by pornpf69

yep that's it. there's a new random char .net domain in the mix as well now

**pornpf69** · 11-14-2006, 10:06 AM

Originally posted by SPeRMiNaToR

yep that's it. there's a new random char .net domain in the mix as well now

I had the same isue on my server....I kept that just for the records....heheeh they only infect some of the files....at random....

JD · 11-20-2006, 08:31 AM

buuuuump just got hit AGAIN today

HACKED! by megacount.net

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment