Author Topic: SF defaced  (Read 9411 times)

0 Members and 1 Guest are viewing this topic.

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
SF defaced
« on: April 28, 2010, 12:09:39 pm »
As you may have noticed, the forums were hacked/defaced around 11:10 AM EST today.  I had the forums taken down and was investigating within the hour.

It looks like someone pwned it by using a php file manager they installed via a security hole in phpsysinfo.  I am reminded now why I didn't run phpsysinfo on anything of mine for so long...

Unfortunately I had to revert some parts of the forums  database to a snapshot from roughly 5:30AM EST (so about 5.75 hours of some data may have been lost).  I haven't exactly identified what may have been lost, but I believe it may have been mostly just new threads and members created in that window.   It may have also been new replies to existing threads, I am not sure.

It may be a good idea to update your passwords.
« Last Edit: April 28, 2010, 12:11:32 pm by FliesLikeABrick »

Offline jrgp

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 5037
Re: SF defaced
« Reply #1 on: April 28, 2010, 12:17:47 pm »
Ugh.

Nice job restoring everything so quickly though. That mysql replication sure does pay off.
There are other worlds than these

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: SF defaced
« Reply #2 on: April 28, 2010, 12:19:32 pm »
Actually in this case it didn't.  The replication replicated the dropped tables over instantly, and apparently my script that catalogs hourly snapshots of the database stopped working quite some time ago.  I had to recover the deleted tables from an rsync snapshot taken during last night's filesystem backup.  Getting the database snapshot tool running again now...

Offline jrgp

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 5037
Re: SF defaced
« Reply #3 on: April 28, 2010, 12:25:54 pm »
Ah.

What version of phpsysinfo let this happen btw? The old 2007 'stable' release or one of the new ajaxish beta snapshots?
There are other worlds than these

Offline PANZERCATWAGON

  • Camper
  • ***
  • Posts: 261
  • oh god: blowjobs
Re: SF defaced
« Reply #4 on: April 28, 2010, 12:32:04 pm »
thanks flab you sexy sexy man you

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: SF defaced
« Reply #5 on: April 28, 2010, 12:51:01 pm »
*does a sexy dance*

One of the newer ajaxy ones.

Offline Dusty

  • Veteran
  • *****
  • Posts: 1015
Re: SF defaced
« Reply #6 on: April 28, 2010, 12:54:18 pm »
Who is behind all this?

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: SF defaced
« Reply #7 on: April 28, 2010, 12:55:45 pm »
I don't really have a good way of finding out, they very clearly used a proxy. 

Offline Horve

  • Flagrunner
  • ****
  • Posts: 692
  • Vig
Re: SF defaced
« Reply #8 on: April 28, 2010, 01:16:19 pm »
what was the point?

Offline Centurion

  • Flagrunner
  • ****
  • Posts: 699
Re: SF defaced
« Reply #9 on: April 28, 2010, 01:39:23 pm »
I saw it. THere was a baby picture and some email. Any ideas who was the hacker?

Offline Espadon

  • Global Moderator
  • Rainbow Warrior
  • *****
  • Posts: 2606
  • GO BEAT CRAZY
    • Tabnir at deviantART
Re: SF defaced
« Reply #10 on: April 28, 2010, 02:27:25 pm »
I don't really have a good way of finding out, they very clearly used a proxy. 
CRYSO | HLT                        

    CRY0 | NAN0 2.1 | 0MEN 1.0 | PYR0 1.1M | B0RG 1.0

Offline jrgp

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 5037
Re: SF defaced
« Reply #11 on: April 28, 2010, 03:17:58 pm »
I saw it. THere was a baby picture and some email. Any ideas who was the hacker?

Did anyone take a screenshot? I'm interested in seeing that. (all this happened while I was at school)
There are other worlds than these

Offline squiddy

  • Soldat Beta Team
  • Camper
  • ******
  • Posts: 333
  • Flagger assassin
    • SoldatX
Re: SF defaced
« Reply #12 on: April 28, 2010, 03:29:40 pm »
I saw it too.

It was very weird, but now it's working fine, yay :)

It had some error that said "this is awkward..."

Weird :O
www.soldatx.com.br - The brazilian Soldat community.

Offline Atredes/GfF

  • Major(1)
  • Posts: 25
  • Arghhhhhhhhhh!
Re: SF defaced
« Reply #13 on: April 28, 2010, 03:31:37 pm »
No screenies but it looked like that (you can visualise black background if you really want  ;) )
This is kinda awkward...

Please direct all flames to /dev/null.
Contact: kon@hushmail.com

Offline Boblekonvolutt

  • Soldier
  • **
  • Posts: 222
  • "YOU are a CAR."
Re: SF defaced
« Reply #14 on: April 28, 2010, 03:32:39 pm »
Fake edit: Atredes beat me to it. "This is kinda awkward..." was the title.

Offline jrgp

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 5037
Re: SF defaced
« Reply #15 on: April 28, 2010, 03:45:22 pm »
Interesting, thanks.
There are other worlds than these

Offline Mittsu

  • Soldat Beta Team
  • Flagrunner
  • ******
  • Posts: 617
Re: SF defaced
« Reply #16 on: April 28, 2010, 04:06:55 pm »
the guy clearly just needed some attention
Realistic-Soldat.net
<+elerok> soldat is dead
<+AThousandD> shit happens

Offline PANZERCATWAGON

  • Camper
  • ***
  • Posts: 261
  • oh god: blowjobs
Re: SF defaced
« Reply #17 on: April 28, 2010, 04:11:09 pm »
it was terrorists




five of them

Offline Furai

  • Administrator
  • Veteran
  • *****
  • Posts: 1908
    • TransHuman Design
Re: SF defaced
« Reply #18 on: April 28, 2010, 05:07:40 pm »
I saw two of them giving bribe to Flies... :)
"My senses are so powerful that I can hear the blood pumping through your veins."

Offline echo_trail

  • Global Moderator
  • Rainbow Warrior
  • *****
  • Posts: 2222
  • ménage-à-trois
    • my last.fm
Re: SF defaced
« Reply #19 on: April 28, 2010, 06:09:09 pm »
Who is behind all this?

A foul villain.. Internet warriors assemble! We MUST retaliate.
I fucking miss all you cunts!