Not sure if you know about this Razormonsta

Status
Not open for further replies.
No I was not aware, thanks.

Do not go to that site, it's a known malicious one. I am trying to remove it now.
 
I have now removed all malicious files on the site.... some pages may be broken. I have a copy of the files and will be investigating them to see what impact it may have on security.

I will try to replace the scripts from a clean install shortly.
 
Thanks for the prompt action RM, now when I type in the url fresh as opposed to using a saved favourite, I go to the Apache 2 test page.

Looking better.
 
I've actually looked at what they uploaded.....

It looks like they were able to get files onto the server via a buffer overload attack. Checking the logs they were able to run one script which tried to install a spam mailer, but were unsuccessful due to good security practice. The webserver user runs completely without any execute rights so it didn't install properly.

I have also looked at the rest, there was an attempt to grab passwords which was again unsuccessful. I copied the VM to a test network, and ran the scripts as the webserver user. Each attempt failed.

I have pulled down all the files modified after mid-october, and then removed them from the server.

Should be good now guys. There is a security update that vBulletin posted a while back, may have been the attack vector. Will patch things asap.
 
Have patched to VB 4.2.2 - there's a few problems with the site but am trying to fix them now
 
Ouch, glad I reported it then.

It was showing up like this a couple of days ago, but I put it down to the fact that I was having to use my phones data connection as my home modem got fried in a lightning strike on Friday night.

I presumed it was a problem but not that the site had been attacked.

/edit Thanks for deleting the link in my original post as it was malicious
 
Yeah, not exactly great..... but we are okay. I have DB copies and backups if we need to restore.

The upgrade to 4.2.2 has broken the theme, and it looks like the place I bought it from is not updating anymore. Only found that out after I had paid my renewal. Paypal dispute lodged. Looks like we will go to a new theme in the next little while..... no ETA on that.

I didn't have access to the administrative back end there for a while either, had to edit a number of files to get it back and running.
 
Status
Not open for further replies.
Top