My Phpwcms site hacked !!!

Dave_LOgic · Post by **Dave_LOgic** » Wed 22. Dec 2004, 00:46

I've now uploaded a fresh install into a seperate directory and still getting the same page up. This would indicate that the Database has been hacked?? Two questions If anyone has the answers.

1 ) Is it possible that a .htaccess could be forcing the index to read this header info?

2) What, if anything is stored in MySQL as far as HTML is concerned..??

Pappnase · Post by **Pappnase** » Wed 22. Dec 2004, 00:49

hello

1. that was the sam question i ask you before

did you have looked into the htaccess!?

2. make a database dump and search with an text editor if you find something! would be the simplest i think!

Dave_LOgic · Post by **Dave_LOgic** » Wed 22. Dec 2004, 00:53

Pappnase wrote:hello

1. that was the sam question i ask you before did you have looked into the htaccess!?

2. make a database dump and search with an text editor if you find something! would be the simplest i think!

1 - I copied empty .htaccess files into most folders to copy over any possible causes but nothing changed.

2 - Excellant idea - Thanks..

Peekay · Post by **Peekay** » Wed 22. Dec 2004, 01:17

You really need to see if your host is addressing this issue. I found this copy of an email sent by a host to their customers about the worm on a portal forum I also belong to.

There is a worm that exploits PHPBB forums and injects a Perl script that will traverse the server, looking for worldwritable files. The script will also search google for other phpBB forums and try to infect them as well.

The overwritten files were all with 666 or 777 permissions (worldwritable) and thus were overwritten.

You need not use 777 or 666 permissions on our server anymore. We have started using SuExec on the server, which greatly improves the security and stability. This environment also executes scripts with the user credentials, instead of the Apache ones, so your scripts can access all your files and folders.

We have urgently patched all the faulty customer phpBB boards to stop the worm attacks against our servers already.

We can restore your site from our backups, dated 10 and 17 Dec. Please advise which backup we shall use.

Best Regards,
Support"

Dave_LOgic · Post by **Dave_LOgic** » Wed 22. Dec 2004, 01:57

Peekay wrote:You really need to see if your host is addressing this issue. I found this copy of an email sent by a host to their customers about the worm on a portal forum I also belong to.

There is a worm that exploits PHPBB forums and injects a Perl script that will traverse the server, looking for worldwritable files. The script will also search google for other phpBB forums and try to infect them as well.

The overwritten files were all with 666 or 777 permissions (worldwritable) and thus were overwritten.

You need not use 777 or 666 permissions on our server anymore. We have started using SuExec on the server, which greatly improves the security and stability. This environment also executes scripts with the user credentials, instead of the Apache ones, so your scripts can access all your files and folders.

We have urgently patched all the faulty customer phpBB boards to stop the worm attacks against our servers already.

We can restore your site from our backups, dated 10 and 17 Dec. Please advise which backup we shall use.

Best Regards,
Support"

Just sent my host a long email regarding this issue......Crossing my fingers....

Peekay · Post by **Peekay** » Thu 23. Dec 2004, 12:43

I have read that additional security will be gained by hosts updating PHP to version 4.3.10. (and upgrading the Zend Optimiser if applicable). It is important they upgrade both.

Like yourself, I have now emailed our host(s) to find out what exactly they are doing to protect our websites against this threat. I particularly want to know if they are patching any vulnerable phpBB installations on the server.

Peekay · Post by **Peekay** » Fri 24. Dec 2004, 13:42

Peekay wrote:Like yourself, I have now emailed our host(s) to find out what exactly they are doing to protect our websites against this threat. I particularly want to know if they are patching any vulnerable phpBB installations on the server.

And their reply today was... "The worm spreads using Google. Google have now blocked the search it's using so the worm no longer poses a threat."

Let's hope that is the case. This is however one email I intend to keep.

Dave_LOgic · Post by **Dave_LOgic** » Tue 28. Dec 2004, 22:43

Just wanted to say that I've fixed my site and thanks to all those that gave help me in doing so...

Pappnase · Post by **Pappnase** » Tue 28. Dec 2004, 23:31

hello dave

no problem the most important thing is that we all find the problem!

jsw_nz · Post by **jsw_nz** » Fri 31. Dec 2004, 04:58

Not all hosting services are created equal.

My service, after the worm deleted a number of *.htm and *.php files on my 'not too important' site, told me that they plan to implement daily backup-ups. When the worm hit, no such policy was in place....even though they advertised that daily backups were supported....for some time. Lucky that my domain is non-essential...just a parking place for page comps and prototypes.....but for others who depended on their domains for more essential and important purposes....the lack of daily backups....was likely a major pain....

So the saying goes, just because they advertise daily backups...does not mean that they are in fact taking place.....(http://www.webserve.ca)

happy new year,
john

Peekay · Post by **Peekay** » Fri 31. Dec 2004, 14:24

Not all hosting services are created equal.

This is very true John. I now take and file screen shots of significant pages of our host's website. In particular any statements regarding backups, server facilities, uptime promises, hosting fees and (if they also host our domains) their domain transfer fees.

We had noted that several ISPs had been quietly increasing their domain transfer fees each year to make it prohibitively expensive to leave. The first you'll know of this is when you try to move away.

I would like to think my host would respond to a hacking incident or hardware failure with an email similar to the one shown earlier in this thread. However, the only way to be sure of this is to have a written service level agreement with them. Something I am going to investigate next year (tomorrow!)

O.K... maybe when hangover has gone!

jsw_nz · Post by **jsw_nz** » Sun 2. Jan 2005, 07:54

"I now take and file screen shots of significant pages of our host's website. In particular any statements regarding backups, server facilities, uptime promises, hosting fees and (if they also host our domains) their domain transfer fees."

Yes, to be sure Peekay...need to look into 'false advertising'. schemes. This time I am going to give my host the 'benefit of the doubt' ...but if history repeats itself (as it often does), may start looking elsewhere.

Happy New Year.....

...

John