GoFuckYourself.com - Adult Webmaster Forum

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)
-   Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)
-   -   We got HACKED! (https://gfy.com/showthread.php?t=77620)

TheFLY 09-17-2002 03:17 PM

Damn this all sux...

Juge 09-17-2002 04:09 PM

Quote:

Originally posted by GFED


None that I'm aware of... I don't think... but F-secure has a SSH File Transfer utility that is just like an FTP program (I haven't really used it much though)... I usually use Dreamweaver to update/synchronize my files coz it's simpler than loading another program... I only use WS_FTP when I have to install CGI scripts and CHMOD files... :)

Thanks for the info. I must say that WS_FTP LE sucks big time for chmod of files... it remembers the last file permission set the LAST time you set them. It DOES NOT show you the current permissions of the file you clicked on... completely unintuitive.

So, your dreamweaver is secure in uploading files?

Juge 09-17-2002 04:17 PM

Quote:

Originally posted by buran
Hey,

You want to make sure you're using ssh2, in fact. SSH1 has crypto vulnerabilities -- they're unlikely, but possible.

The goal is to make sure that no traffic to your box is using plaintext passwords. Of course, your paysite users are, but those accounts aren't important. If you implement your pop3 accounts as virtual (ie, no associated UNIX account) then you can also start treating those passwords as unimportant (worse case scenario: someone's email gets read)

Another option, setup a VPN between your office and your servers and route all traffic over it. This requires a linux box in the office, but the cost of setting one up is low and the benefits are great.

Don't forget you're just as likely to be sniffed on your local subnet as you are in the colo facility.
Perhaps more likely, if your colo has proper subnets.

As for FTP, I recommend setting up FTP over SSH2 (using SecureFX) or an SFTP client. Either method requires a special client, so you'll have to kiss WS_FTP goodbye. Is it worth it? Only if you don't want to post a GFY thread entitled "We got hacked!"

Staying secure is a matter of staying current, slashdorque will have an item for almost all the vulnerabilities you'll encounter.

Good luck, Buran

Buran, thank you for all of your useful information... (and people say GFY is no good for anything! bah!)... yes, this has been a wake up call for me to realize that every damn comminucation that I have been using uses plain text to send password. I feel stupid for not knowing this, but I assumed in this day and age that this would already be taken care of with any OS that was made in the past 5 years. I guess I assumed wrong.

I have no problems dumping WS FTP, I was only using the LE edition anyway, and it was bad. If anyone can confirm that the PRO version is any better, then please let me know. The makers of WS FTP sure cannot tell me the differences, so I must assume they are minimal, and thus they have given me no reason to buy it.

Juge 09-17-2002 04:21 PM

Quote:

Originally posted by TheFLY
Damn this all sux...
Yes it does... and I really hope this thread is not just educating me.

My damned password was being transmitted over the net 50 times a day... this was a bomb waiting to explode; it was bound to happen. You all should think about this.

HQ 09-17-2002 04:24 PM

Quote:

Originally posted by TheFLY
Damn this all sux...
I know, I hate being bothered by hackers.


So... to recap...

4 FTPing, use SFTP
4 TELNETing, use SSH or SSH2

anything else while it's on your mind?

playa 09-17-2002 05:33 PM

ok i am bout to get a headache,,
my lack of server knowledge and this thread
is scaring me

GFED 09-17-2002 05:48 PM

Quote:

Originally posted by Juge


Thanks for the info. I must say that WS_FTP LE sucks big time for chmod of files... it remembers the last file permission set the LAST time you set them. It DOES NOT show you the current permissions of the file you clicked on... completely unintuitive.

So, your dreamweaver is secure in uploading files?

After you CHMOD your files in WS_FTP try refreshing the directory... that works for me...

Yes, DreamweaverMX has a SSH plugin called PUTTY that is secure. I'm not sure about the ealier versions.

HQ 09-17-2002 06:51 PM

Quote:

Originally posted by playa
ok i am bout to get a headache,,
my lack of server knowledge and this thread
is scaring me

I already have one. Fucking hackers. :feels-hot

The lesson here is if you are insecure, you will eventually get hacked... it is only a matter of time.

pentae 09-17-2002 06:53 PM

PuTTy :thumbsup

spanky 09-17-2002 07:19 PM

Quote:

Originally posted by KC
{is WS_FTP secure?}

No, not if you're using the FTP protocol. The protocol is where the vulnerability exists. Any application that uses that protocol to transfer files sens your username and password across the internet in plain text.

-KC

The WS_FTP server can use SSL. It is probably one of the only secure ftp servers out there that isn't sftp. I think the pro version of the client is needed to work over SSL .

KDizzla 09-17-2002 08:14 PM

SSH is much better then Telnet. Get rid of telnet and stick with ssh.

KD

Juge 09-18-2002 03:55 AM

Quote:

Originally posted by GFED


After you CHMOD your files in WS_FTP try refreshing the directory... that works for me...

Yes, DreamweaverMX has a SSH plugin called PUTTY that is secure. I'm not sure about the ealier versions.

WS FTP doesn't show the file permissions, unless you press 'dir info', which shows you a dir listing in a text file. Why can't it show the permissions on the screen? And when you click a file to change permissions, it shows the permissions of the last file you set permissions on, so you THINk that this new files has those permissions because it is unintuitive. What exactly would refreshing the directory do? You're using PRO, right? I'm talking about LE.

Juge 09-18-2002 03:57 AM

Quote:

Originally posted by spanky


The WS_FTP server can use SSL. It is probably one of the only secure ftp servers out there that isn't sftp. I think the pro version of the client is needed to work over SSL .

Sounds good...

It's funny that I was jus telling the makers of WS FTP LE all the bugs in the program that I hate (like it's inability to deal with files that have a space in them, and some other problems I have mentioned in this thread), and I told the girl that I would never purchase the PRO version unless it had fixed these bugs. She couldn't tell me if it had or not... just that it was 'better', and that I shouldn't judge the PRO version of the software based on the LE edition.

....ok. How about I rate you, then... :321GFY

easyjesus 09-18-2002 08:54 AM

anyone know anything about FlashFXP? If so, is it ok to use? :helpme

Diluted O2 09-18-2002 08:58 AM

I don't believe it, why do people have to hack? I mean seriously what's the point? Is there some dood sitting in his "speacial hacking chair" giggling to...himself? I can see it now.

"Muhahaha, those jerks! I'll teach them to overload me with banners and pop-ups! Muhahaha"

Somebody needs to move out of his mom's basement

Juge 09-18-2002 10:24 AM

Some hackers (as opposed to crackers) do it for the thrill and to show people what could happen... I hope to god that this dude did this to me to show me the flaws of the net. But, he didnt show me how he did it, I just figured it was via sniffing since I just found out that I had all of this insecurities with my setup. But, maybe he was just trying to show that my server was not hack-proof, in fact, it was easily hackable, and thus I have a better server now, and it won't happen to me again (this easily, anyway). So, for that, I thank the guy. I also thank him for not running "rm *" heh.... yeah.

salsbury 09-18-2002 10:50 AM

Quote:

Originally posted by Diluted O2
I don't believe it, why do people have to hack? I mean seriously what's the point? Is there some dood sitting in his "speacial hacking chair" giggling to...himself? I can see it now.

"Muhahaha, those jerks! I'll teach them to overload me with banners and pop-ups! Muhahaha"

Somebody needs to move out of his mom's basement

imagine what you could do if you could hack some big site and replace their affiliate code with yours - randomly, so there's less of a chance of getting caught. you could make some good money for a while. the webmaster might just think they're having a slow month.

easyjesus 09-18-2002 01:13 PM

roflmao :thumbsup

Juge 09-18-2002 04:11 PM

Quote:

Originally posted by salsbury
imagine what you could do if you could hack some big site and replace their affiliate code with yours - randomly, so there's less of a chance of getting caught. you could make some good money for a while. the webmaster might just think they're having a slow month.
I don't think it would take long to get caught doing something like that...

GFED 09-18-2002 05:36 PM

Quote:

Originally posted by Juge


WS FTP doesn't show the file permissions, unless you press 'dir info', which shows you a dir listing in a text file. Why can't it show the permissions on the screen? And when you click a file to change permissions, it shows the permissions of the last file you set permissions on, so you THINk that this new files has those permissions because it is unintuitive. What exactly would refreshing the directory do? You're using PRO, right? I'm talking about LE.

You're right... I usually go to CHMOD to show what it's set at instead of dirinfo... then you have to refresh the screen after you do any actions like copy, move, CHMOD to see the updates... you said you were not seeing the updated permissions? Thats would be the reason...

If you haven't tried F-Secure yet, I'd suggest checking it out... They have a free download and trial and I think you'll really like their File Transfer utility better than WS_FTP...

HQ 09-18-2002 07:45 PM

How do I protect my outlook-using, plain-text-sending, pop3-protocoling server-downloading email-checking?

Juge 09-19-2002 06:10 AM

Quote:

Originally posted by GFED
You're right... I usually go to CHMOD to show what it's set at instead of dirinfo... then you have to refresh the screen after you do any actions like copy, move, CHMOD to see the updates... you said you were not seeing the updated permissions? Thats would be the reason...

If you haven't tried F-Secure yet, I'd suggest checking it out... They have a free download and trial and I think you'll really like their File Transfer utility better than WS_FTP...

WS FTP LE doesn't show any file permissions, unless you click on dir info. I thought when you went to change file permissions, the box that pops up would show the current file permissions, but it shows the permissions that were last set (of whatever file that was) while using this box...

Yes, I know you have to refresh after everything - another reason why WS FTP sucks. Once you change a file, and upload it, the timestamp is the same, so when you change the file again, and reupload it, it thinks you are overwritten the file with the same file, and gives that stupid message (are you sure?)... very annoying. I know this can be turned off, but I don't want it to be - to make sure I don't do anything stupid. The window should simply refresh so this function works 100% of the time.

I will try F-secure, thank you.


All times are GMT -7. The time now is 06:02 AM.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2025, vBulletin Solutions, Inc.
©2000-, AI Media Network Inc123