Stan Posted May 26, 2006 Author Posted May 26, 2006 It does run on Linux, once they gain root access, they had scripts to run to modify thousands of files... We were not alone in the last two attacks... these are mean people..... <img src="/adventist/images/graemlins/smile.gif" alt="" /> Quote If you receive benefit to being here please help out with expenses. https://www.paypal.me/clubadventist Administrator of a few websites like https://adventistdating.com
CyberGuy Posted May 27, 2006 Posted May 27, 2006 From the link on the UBB technical forum it appears the attack was attacking a vunerability in the Microsoft Server program. If that is the case then running our software on Linux would prevent that. Yet you say we are running on linux. Then how did this attack happen if the attack was aimed at Microsoft server vunerabilities. Quote Riverside CA
Stan Posted May 27, 2006 Author Posted May 27, 2006 That is a good question, our server was hacked a few days after that was posted. There is a program to run asp on unix see http://www.ubbcentral.com/boards/showthreaded.php/Cat/0/Number/4560637/an//page/0/vc/1 BUt I can not find it on the server... Quote If you receive benefit to being here please help out with expenses. https://www.paypal.me/clubadventist Administrator of a few websites like https://adventistdating.com
CyberGuy Posted May 27, 2006 Posted May 27, 2006 According to Allen on the UBB tech forum there are patches to prevent this kind of attack and also there were some files that opened up the files to attacks. I assume you read his post and list of files to edit or delete that he posted yesterday on the UBB forum on that thread on this attack. http://www.ubbcentral.com/boards/showthreaded.php/Cat/0/Number/4560659/page/0/vc/1 Quote Riverside CA
Stan Posted May 27, 2006 Author Posted May 27, 2006 the patches are in place... I did not have the php that he mentioned... I just found more files that were changed this PM yet there is no record of anyone being on... That means..... yuk (closest vegetarian word I could find to my thoughts) Quote If you receive benefit to being here please help out with expenses. https://www.paypal.me/clubadventist Administrator of a few websites like https://adventistdating.com
CyberGuy Posted May 28, 2006 Posted May 28, 2006 One way the government thwarts attacks is to change that four digit IP number for the website being attacked. It is obvious the hackers have Club Adventists web site IP number. Could you change the IP number. Is that fesible? Quote Riverside CA
Stan Posted May 30, 2006 Author Posted May 30, 2006 This is a static IP number, which means it does change... not sure how often... The first hack came in through a security hole in the polling option, that hole has been fixed. That somehow gave them root access. It appears those who have polls turned off never got hit. The second one is still a mystery, I have an idea but not going to publish it. Quote If you receive benefit to being here please help out with expenses. https://www.paypal.me/clubadventist Administrator of a few websites like https://adventistdating.com
CyberGuy Posted June 1, 2006 Posted June 1, 2006 </font><blockquote><font class="small">Quote:</font><hr /> The second one is still a mystery, I have an idea but not going to publish it. <hr /></blockquote><font class="post"> That would be a good idea not to publish it. But the fact that these guys hit so many forums so quickly makes me think they are not really visiting each forum directly but hitting every IP that registeres there is a forum with this software on the internet. I doubt this guy visited thousands of forums and got the IP from each one. That seems highly unlikely. Quote Riverside CA
Stan Posted June 1, 2006 Author Posted June 1, 2006 all you have to do is do a google for ubbthreads.php and slight variations of that.. Quote If you receive benefit to being here please help out with expenses. https://www.paypal.me/clubadventist Administrator of a few websites like https://adventistdating.com
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.