Author Topic: SF defaced (Read 9411 times)

FliesLikeABrick · « **on:** April 28, 2010, 12:09:39 pm »

As you may have noticed, the forums were hacked/defaced around 11:10 AM EST today. I had the forums taken down and was investigating within the hour.

It looks like someone pwned it by using a php file manager they installed via a security hole in phpsysinfo. I am reminded now why I didn't run phpsysinfo on anything of mine for so long...

Unfortunately I had to revert some parts of the forums database to a snapshot from roughly 5:30AM EST (so about 5.75 hours of some data may have been lost). I haven't exactly identified what may have been lost, but I believe it may have been mostly just new threads and members created in that window. It may have also been new replies to existing threads, I am not sure.

It may be a good idea to update your passwords.

jrgp · « **Reply #1 on:** April 28, 2010, 12:17:47 pm »

Ugh.

Nice job restoring everything so quickly though. That mysql replication sure does pay off.

FliesLikeABrick · « **Reply #2 on:** April 28, 2010, 12:19:32 pm »

Actually in this case it didn't. The replication replicated the dropped tables over instantly, and apparently my script that catalogs hourly snapshots of the database stopped working quite some time ago. I had to recover the deleted tables from an rsync snapshot taken during last night's filesystem backup. Getting the database snapshot tool running again now...

jrgp · « **Reply #3 on:** April 28, 2010, 12:25:54 pm »

Ah.

What version of phpsysinfo let this happen btw? The old 2007 'stable' release or one of the new ajaxish beta snapshots?

PANZERCATWAGON · « **Reply #4 on:** April 28, 2010, 12:32:04 pm »

thanks flab you sexy sexy man you

FliesLikeABrick · « **Reply #5 on:** April 28, 2010, 12:51:01 pm »

*does a sexy dance*

One of the newer ajaxy ones.

Dusty · « **Reply #6 on:** April 28, 2010, 12:54:18 pm »

Who is behind all this?

FliesLikeABrick · « **Reply #7 on:** April 28, 2010, 12:55:45 pm »

I don't really have a good way of finding out, they very clearly used a proxy.

Horve · « **Reply #8 on:** April 28, 2010, 01:16:19 pm »

what was the point?

Centurion · « **Reply #9 on:** April 28, 2010, 01:39:23 pm »

I saw it. THere was a baby picture and some email. Any ideas who was the hacker?

Espadon · « **Reply #10 on:** April 28, 2010, 02:27:25 pm »

Quote from: FliesLikeABrick on April 28, 2010, 12:55:45 pm

I don't really have a good way of finding out, they very clearly used a proxy.

jrgp · « **Reply #11 on:** April 28, 2010, 03:17:58 pm »

Quote from: Centurion on April 28, 2010, 01:39:23 pm

I saw it. THere was a baby picture and some email. Any ideas who was the hacker?

Did anyone take a screenshot? I'm interested in seeing that. (all this happened while I was at school)

squiddy · « **Reply #12 on:** April 28, 2010, 03:29:40 pm »

I saw it too.

It was very weird, but now it's working fine, yay

It had some error that said "this is awkward..."

Weird :O

Atredes/GfF · « **Reply #13 on:** April 28, 2010, 03:31:37 pm »

No screenies but it looked like that (you can visualise black background if you really want

)

This is kinda awkward...

Please direct all flames to /dev/null.
Contact: kon@hushmail.com

Boblekonvolutt · « **Reply #14 on:** April 28, 2010, 03:32:39 pm »

Fake edit: Atredes beat me to it. "This is kinda awkward..." was the title.

jrgp · « **Reply #15 on:** April 28, 2010, 03:45:22 pm »

Interesting, thanks.

Mittsu · « **Reply #16 on:** April 28, 2010, 04:06:55 pm »

the guy clearly just needed some attention

PANZERCATWAGON · « **Reply #17 on:** April 28, 2010, 04:11:09 pm »

it was terrorists

five of them

Furai · « **Reply #18 on:** April 28, 2010, 05:07:40 pm »

I saw two of them giving bribe to Flies...

echo_trail · « **Reply #19 on:** April 28, 2010, 06:09:09 pm »

Quote from: Dusty on April 28, 2010, 12:54:18 pm

Who is behind all this?

A foul villain.. Internet warriors assemble! We MUST retaliate.

News:

Author Topic: SF defaced (Read 9411 times)