k, my paysite security is breached, need help! $$ - GoFuckYourself.com - Adult Webmaster Forum

X

gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#1

k, my paysite security is breached, need help! $$

12-16-2006, 07:47 PM

k, I have proxypass installed, have SQL Auth/htaccess and for over 6 months I have never had a pass shared, traffic to my member section is always where it should be, no spikes on the leased feeds, over the last couple days traffic has skyrocketed, can't find my site listed on password sharing sites, and even if it was proxypass woulda shut em down.

So I'm thinking I'm dealing with someone who is spoofing something to get in and send all his surfers through, but I'm not technical enough to figure it out, host is clueless and I'm eating 12x the normal bandwidth I should be.

Can someone gimme a clue, point me in the right direction, anything?

Contact me: \\// E: webmaster /at/ unprofessional.com
Tags: None
who

So Fucking Banned

Join Date: Aug 2003

Posts: 19593
Share

Post
#2

12-16-2006, 07:48 PM

Can't you see which IP(s) is(are) causing the spike? Can't you then associate that with a customer's account?
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#3

12-16-2006, 07:51 PM

Originally posted by who

Can't you see which IP(s) is(are) causing the spike? Can't you then associate that with a customer's account?

well yes, if any more than 3 IP's uses a login they are automatically blocked by ProxyPass, so this is something else.

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
who

So Fucking Banned

Join Date: Aug 2003

Posts: 19593
Share

Post
#4

12-16-2006, 07:54 PM

But a jerk with a website could be running a proxy, logging in through the proxy, and umpteen users could be going through his website, through his proxy, and into your members area. It would only show the IP of the proxy. That's why I ask if there's any particular IP producing a lot of the activity. Can you check your logs?
Comment
AsianDivaGirlsWebDude

Purveyor, Fine Asian Porn

Join Date: Jul 2004

Posts: 38323
Share

Post
#5

12-16-2006, 08:02 PM

Try putting a limit on bandwidth per IP address until you detect the offender. Set it high at first then start ratcheting it down and you should find him.

Other people more technical than I am should have other solutions too (so bump for that).

Surprised that your ISP can't help more...

Good luck,

ADG Webmaster

Asian Diva Girls - Exclusive Photos and Videos

Asian Diva Girls Affiliate Program (50% ccBill Revshare)
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#6

12-16-2006, 08:02 PM

hmmm.. I can't tell, I have access to apache server status, it all looks like normal http traffic

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#7

12-16-2006, 08:03 PM

Originally posted by AsianDivaGirlsWebDude

Try putting a limit on bandwidth per IP address until you detect the offender. Set it high at first then start ratcheting it down and you should find him.

Other people more technical than I am should have a solution to (so bump for that).

Surprised that your ISP can't help more...

Good luck,

ADG Webmaster

that's the thing, if it were 1 IP address they would have been blocked already

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
who

So Fucking Banned

Join Date: Aug 2003

Posts: 19593
Share

Post
#8

12-16-2006, 08:05 PM

Can you see in your stats the referring URL?
Comment
Barefootsies

Choice is an Illusion

Join Date: Feb 2005

Posts: 42635
Share

Post
#9

12-16-2006, 08:07 PM

Should You Email Your Members?

Link1 | Link2 | Link3

Enough Said.

"Would you rather live like a king for a year or like a prince forever?"
Comment
ramstein

Confirmed User

Join Date: Dec 2006

Posts: 127
Share

Post
#10

12-16-2006, 08:08 PM

I guess your system admin should look into your log files

+ www.PantyhoseOne.com :: Pantyhose Trade + www.PantyhosedSex.com :: Pantyhose Trade +
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#11

12-16-2006, 08:09 PM

Originally posted by who

Can you see in your stats the referring URL?

nope, no reffering url is sending the traffic, it's like a ghost is in my paysite area eating up 12x the bandwidth it should

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
PHP-CODER-FOR-HIRE

Confirmed User

Join Date: Nov 2006

Posts: 1090
Share

Post
#12

12-16-2006, 08:09 PM

I added you to ICQ. I think I know what your problem is. I ran into this same problem about a year ago with a customer of mine.

Get in touch with me ASAP, because it'll get worse if you don't deal with it trust me. Once someone finds out it works, it'll spread like crazy.

Hire a PHP Coder
Comment
Quickdraw

Confirmed User

Join Date: Mar 2004

Posts: 1717
Share

Post
#13

12-16-2006, 08:19 PM

Not sure if you were looking for suggestions for other software but I really like Strongboxxx.
Comment
DjSap

Confirmed User

Join Date: Jul 2002

Posts: 3869
Share

Post
#14

12-16-2006, 08:19 PM

if you have a managed server then I would switch, because if a host can't figure something like this out it's kind of fucked up and they are probably just some reseller without expertise in actual server administration

Blog Themes, TGP Design, Writing Services, Grunt Work
ICQ: 66871495
Comment
woj

<&(©¿©)&>

Join Date: Jul 2002

Posts: 47880
Share

Post
#15

12-16-2006, 08:51 PM

Originally posted by DjSap

if you have a managed server then I would switch, because if a host can't figure something like this out it's kind of fucked up and they are probably just some reseller without expertise in actual server administration

yea, exactly, so who is the clueless host?

Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000
Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager
Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#16

12-16-2006, 09:08 PM

they are friends of mine, so I'm not naming names.

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
venus

Confirmed User

Join Date: Jan 2003

Posts: 3112
Share

Post
#17

12-16-2006, 10:55 PM

how do you know your "security is breached"?
there are other ways to make your bandwidth go up, one is somoene could be hotlinking your images, they could be hotlinking a single large file in an attempt to screw with you. lots of reasons for this, check your log analyzer... you do have a log analyzer program correct?

Muscle/Fitness Adult Affiliate Program
Since 1997 www.venuscash.com
Comment
madawgz

8.8.8.8

Join Date: Mar 2006

Posts: 30509
Share

Post
#18

12-16-2006, 10:58 PM

Originally posted by DjSap

if you have a managed server then I would switch, because if a host can't figure something like this out it's kind of fucked up and they are probably just some reseller without expertise in actual server administration

yep, either that

or the host simply doesnt care or have the time

TAEMDLRMSKRJIXMRLSMRJ.
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#19

12-16-2006, 11:22 PM

Originally posted by venus

how do you know your "security is breached"?
there are other ways to make your bandwidth go up, one is somoene could be hotlinking your images, they could be hotlinking a single large file in an attempt to screw with you. lots of reasons for this, check your log analyzer... you do have a log analyzer program correct?

it's traffic to my content section, I know this because I renamed and took it down for 15 minutes, and bandwidth dropped to next to nothing.

Also I see the traffic going to my leased plugins, so they are in there surfing, not hotlinking, hotlinks woulda showed up easy

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
lazycash

Troll Patrol

Join Date: Aug 2002

Posts: 15214
Share

Post
#20

12-16-2006, 11:28 PM

Most likely getting spoofed, what is the site that is being exploited?

"WTF, on google you can find the answer to every question in human history, EXCEPT how to convert cams..

Its crazy..."

VenusBlogger
Comment
venus

Confirmed User

Join Date: Jan 2003

Posts: 3112
Share

Post
#21

12-16-2006, 11:31 PM

you would think this would show up easy as well...

what log analyzer are you using? wusage ?

Originally posted by gleem

it's traffic to my content section, I know this because I renamed and took it down for 15 minutes, and bandwidth dropped to next to nothing.

Also I see the traffic going to my leased plugins, so they are in there surfing, not hotlinking, hotlinks woulda showed up easy

Muscle/Fitness Adult Affiliate Program
Since 1997 www.venuscash.com
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#22

12-17-2006, 12:53 AM

Originally posted by lazycash

Most likely getting spoofed, what is the site that is being exploited?

www.RevengeTV.com

I got bandwidth download limits on (thanks PHP-CODER-FOR-HIRE), doesn't catch it, IP traps, nothing, I'm done for the night, 5am here.. but I need some more help.. this is a good one.

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#23

12-17-2006, 12:55 AM

Originally posted by venus

you would think this would show up easy as well...

what log analyzer are you using? wusage ?

awstats.. the only odd site that shows up, but with hardly any hits is:

http://www.ya-moon.com/start.asp

it's japanese, but the word "revenge" shows up, but when you click anything you get some sort of message, which I assume is a "you must login" message, so I have no clue.

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
ladida

Confirmed User

Join Date: Nov 2005

Posts: 2179
Share

Post
#24

12-17-2006, 01:14 AM

Originally posted by DjSap

if you have a managed server then I would switch, because if a host can't figure something like this out it's kind of fucked up and they are probably just some reseller without expertise in actual server administration

You people are clueless. Managed or not managed, host in these cases can do jack shit. It's obvious none of you dealt with hacking before..

agentGFY *at* gmail.com
Comment
EDepth

Confirmed User

Join Date: Nov 2005

Posts: 510
Share

Post
#25

12-17-2006, 01:35 AM

You may want to remove the empty login & password from your passlist... i can just log right in with nothing -> thus why its not showing in proxypass i bet.

ICQ: 275335837
Comment
en21

Confirmed User

Join Date: May 2006

Posts: 2640
Share

Post
#26

12-17-2006, 05:03 AM

I tried to login with nothing.. can't get in though

Free Asian Sex : http://www.asian4free.com
Free Amateur Sex : http://www.lustamateur.com
Free Porn : http://www.mysexbookmark.com
Free Sex : http://www.goliathlist.com
Free Hardcore : http://www.xlust.com
Sex For Free : http://www.sexforfee.com
Comment
darksoul

Confirmed User

Join Date: Apr 2002

Posts: 4997
Share

Post
#27

12-17-2006, 05:23 AM

Originally posted by ladida

You people are clueless. Managed or not managed, host in these cases can do jack shit. It's obvious none of you dealt with hacking before..

I think you're the clueless one.

gleem, feel free to hit me up on icq when you get back
157717888

1337 5y54|)m1n: 157717888
BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN
Cambooth
Comment
scottybuzz

Too lazy to set a custom title

Join Date: May 2006

Posts: 14799
Share

Post
#28

12-17-2006, 05:30 AM

bump for help

$$$$$ MAKE HUGE MONEY IN CAMS - CLICK HERE $$$$$
Comment
HighSociety

Confirmed User

Join Date: Jun 2005

Posts: 1786
Share

Post
#29

12-17-2006, 05:36 AM

nice site you have there, hope someone can help you out

http://www.highsociety.com
http://www.playgirl.com
http://www.cheri.com

Jonathan "JC" Maldini
ICQ: 223 643
Comment
ladida

Confirmed User

Join Date: Nov 2005

Posts: 2179
Share

Post
#30

12-17-2006, 06:16 AM

Originally posted by darksoul

I think you're the clueless one.

Haha.. don't be offended. I see you're flying hosting company in your sig, so that's probably why, but it's just how it is. Hosting companies are clueless. Which paysites host with you?

agentGFY *at* gmail.com
Comment
darksoul

Confirmed User

Join Date: Apr 2002

Posts: 4997
Share

Post
#31

12-17-2006, 06:28 AM

Originally posted by ladida

Haha.. don't be offended. I see you're flying hosting company in your sig, so that's probably why, but it's just how it is. Hosting companies are clueless. Which paysites host with you?

Its true most companies don't know jack shit besides restarting apache and mysql. But there are a few that know their shit.
And yes the company I'm flying the sig for its one of them beeing run
by hardcore sysadmins which over the years dealt with sites
like ogrish,score-cash,webcams,spookycash,ebaumsworld and the list could go on. I'm also sure that companies like national-net,techiemedia, etc... know their shit as well.
So your generalization its a bit biased.

1337 5y54|)m1n: 157717888
BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN
Cambooth
Comment
ladida

Confirmed User

Join Date: Nov 2005

Posts: 2179
Share

Post
#32

12-17-2006, 06:54 AM

Originally posted by darksoul

But there are a few that know their shit.
And yes the company I'm flying the sig for its one of them beeing run
by hardcore sysadmins which over the years dealt with sites
like ogrish,score-cash,webcams,spookycash,ebaumsworld and the list could go on. I'm also sure that companies like national-net,techiemedia, etc... know their shit as well.
So your generalization its a bit biased.

Yep, you're clueless, which is seen just from your answer, but you won't get it.
Anyway, which paysites does the company you're supporting currently host? I'd like to check something for you and educate you.

agentGFY *at* gmail.com
Comment
borked

Totally Borked

Join Date: Feb 2005

Posts: 6284
Share

Post
#33

12-17-2006, 07:00 AM

what type of firewall are you running? if it's anything decent like pf, then ask your host to look into the packet filter logs to see where the bandwidth is going.

Also get ntop installed asap - that'll tell you where all the traffic is going.

If you need further help, hit me up on icq

For coding work - hit me up on andy // borkedcoder // com
(consider figuring out the email as test #1)

All models are wrong, but some are useful. George E.P. Box. p202
Comment
darksoul

Confirmed User

Join Date: Apr 2002

Posts: 4997
Share

Post
#34

12-17-2006, 07:01 AM

Originally posted by ladida

Yep, you're clueless, which is seen just from your answer, but you won't get it.
Anyway, which paysites does the company you're supporting currently host? I'd like to check something for you and educate you.

I'm far from clueless, but fortunately I don't have to prove that to some nobody on a message board.

1337 5y54|)m1n: 157717888
BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN
Cambooth
Comment
borked

Totally Borked

Join Date: Feb 2005

Posts: 6284
Share

Post
#35

12-17-2006, 07:02 AM

sorry - forgot to include a link: nTOP

For coding work - hit me up on andy // borkedcoder // com
(consider figuring out the email as test #1)

All models are wrong, but some are useful. George E.P. Box. p202
Comment
ladida

Confirmed User

Join Date: Nov 2005

Posts: 2179
Share

Post
#36

12-17-2006, 07:04 AM

Originally posted by darksoul

I'm far from clueless, but fortunately I don't have to prove that to some nobody on a message board.

As i guessed. GG

agentGFY *at* gmail.com
Comment
darksoul

Confirmed User

Join Date: Apr 2002

Posts: 4997
Share

Post
#37

12-17-2006, 07:05 AM

Originally posted by ladida

As i guessed. GG

btw, I hope you don't consider bruteforcing a u/p as hacking

1337 5y54|)m1n: 157717888
BM-2cUBw4B2fgiYAfjkE7JvWaJMiUXD96n9tN
Cambooth
Comment
ladida

Confirmed User

Join Date: Nov 2005

Posts: 2179
Share

Post
#38

12-17-2006, 07:18 AM

Originally posted by darksoul

btw, I hope you don't consider bruteforcing a u/p as hacking

Just shows how clueless you are.

agentGFY *at* gmail.com
Comment
stef_girls18

Confirmed User

Join Date: Nov 2006

Posts: 355
Share

Post
#39

12-17-2006, 07:18 AM

Parse the server logs and install additional logging, so you can track down the offending user.

All the wallpapers you ever want http://www.wallpapers18.com
And some cash to be made http://www.bucks18.com
Comment
Mutt

Too lazy to set a custom title

Join Date: Sep 2002

Posts: 34431
Share

Post
#40

12-17-2006, 07:22 AM

well it sounds like you're just being spoofed via one of the leased plugins - how any plugin companies are still using referer method is beyond me.

are you seeing a spike in the numbers of your own files in the members area being downloaded? if not then no doubt it's just simple spoofing to get into the plugins.

whick company leases these feeds http://www.revengetv.com/chop1/index2.php ?

I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!
Comment
Mutt

Too lazy to set a custom title

Join Date: Sep 2002

Posts: 34431
Share

Post
#41

12-17-2006, 07:25 AM

Originally posted by gleem

So I'm thinking I'm dealing with someone who is spoofing something to get in and send all his surfers through, but I'm not technical enough to figure it out, host is clueless and I'm eating 12x the normal bandwidth I should be.

12x the normal bandwidth for the leased feeds or your own bandwidth?

I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#42

12-17-2006, 08:15 AM

ok, turns out it was a " : " in the middle of the htaccess file that was indeed allowing anyone who entered blank u/p twice in.. so they never showed up as a user and it was all different IP's getting in not a proxy so it looked like legit traffic.

No the " : " wasn't there before in my htaccess, and I hadn't touched that file in months, the file had proper permissions, was like the server or someone else stuck it in there..

Sometimes I hate this biz, then again, it turns out to be something this simple that causes hours of frustration. crazy

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#43

12-17-2006, 08:16 AM

Thanks to "PHP-CODER-FOR-HIRE" for trouble shooting this for me for like 5 hours too!

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
LiveDose

Show Yer Tits!

Join Date: Feb 2002

Posts: 25792
Share

Post
#44

12-17-2006, 08:29 AM

Glad you got it all firgured out.

Scammer Alert: acer19 acer [email protected] [email protected] Money stolen using PayPal
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#45

12-17-2006, 10:31 AM

actually it was a " : " user inserted into my htpasswd file by paycom back before June 23rd since it created a backup of my htpasswd file automatically and that was the time stamp of the backup.

my brain is gonna explode...

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
venus

Confirmed User

Join Date: Jan 2003

Posts: 3112
Share

Post
#46

12-17-2006, 11:59 AM

hlad you got it going... I was going to suggest the last ditch effor of manually looking though your log files to see if you can spot something strange.
If I have a problem, thats where I go...

but now that all those people no longer have access you should keep that traffic by sending them to your join page, set your 401 error to go to a page, I made this one for people who do not have a valid password
http://www.landofvenus.com/401.html .. converts great for me.

Muscle/Fitness Adult Affiliate Program
Since 1997 www.venuscash.com
Comment
com

Confirmed User

Join Date: Aug 2003

Posts: 4541
Share

Post
#47

12-17-2006, 12:02 PM

Originally posted by gleem

Thanks to "PHP-CODER-FOR-HIRE" for trouble shooting this for me for like 5 hours too!

I don't mean to downplay anyone's efforts here; and I'm glad to hear this was taken care of however this should've taken your host or sysadmin much less than a half an hour to figgure out.

Real. Professional. Hosting.
.:Expect Nothing Less:.
320-078-843 :: www.realprohosting.com :: [email protected]
Comment
fuzebox

making it rain

Join Date: Oct 2003

Posts: 22365
Share

Post
#48

12-17-2006, 12:57 PM

Originally posted by gleem

ok, turns out it was a " : " in the middle of the htaccess file that was indeed allowing anyone who entered blank u/p twice in..

A couple of people have come to me this week and it turned out to be the same thing... I'm wondering if someone has figured out how to exploit paycoms postback system to add these.
Comment
gleem

Confirmed User

Join Date: Jun 2001

Posts: 5593
Share

Post
#49

12-17-2006, 07:20 PM

Originally posted by fuzebox

A couple of people have come to me this week and it turned out to be the same thing... I'm wondering if someone has figured out how to exploit paycoms postback system to add these.

Paycom completely denies it was their fault, says it was "corrupted file or failure to completely delete"

If it was an exploit someone figured out they did it to my file back in June, cause at the end of June I switched to SQL auth system and haven't used their postback since, 6/23 was the date that file was updated. guess I left the htpasswd file active cause it had a few members on it that were still active.

anyways, if you have a "bandwidth ghost" in your members area and you can't pin it to any one login or IP address, look for user " : " in your htpasswd file!

Contact me: \\// E: webmaster /at/ unprofessional.com
Comment
PHP-CODER-FOR-HIRE

Confirmed User

Join Date: Nov 2006

Posts: 1090
Share

Post
#50

12-17-2006, 07:24 PM

Originally posted by com

I don't mean to downplay anyone's efforts here; and I'm glad to hear this was taken care of however this should've taken your host or sysadmin much less than a half an hour to figgure out.

Actually, there was more to it than just that username/password problem. I also implemented bandwidth/traffic restrictions, banned abusers manually by sifting through the logs, etc.

On top of that, this was a server I had never logged into before, so going into someone else's territory isn't quite the same as if I'd been using the system for months and knew the workings of the entire thing.

Thanks for the insult, though.

Last edited by PHP-CODER-FOR-HIRE; 12-17-2006, 07:25 PM. Reason: Added info

Hire a PHP Coder
Comment

Previous 1 2 template Next

Working...