GoFuckYourself.com - Adult Webmaster Forum

Page 2 of 3

Show 40 post(s) from this thread on one page

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)

- Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)

- - HACKED! by megacount.net (https://gfy.com/showthread.php?t=662380)

DateDoc

10-05-2006 12:04 AM

not just a wordpress issue: http://www.gfy.com/fucking-around-and-business-discussion/662468-martina-warren-trojan-site.html

RobV	10-05-2006 12:40 AM

Quote:

Originally Posted by emthree

Not really. I've seen the chat log with RobV.
This is something effecting a lot of their customers. They need to address it publicly.

Webair and I are still bouncing emails. They haven't notified me of anything changed or any issues they see with my site.

The most recent email I recieved from them just said:
########## Begin Message ##########

Are you sure ALL version of wordpress were updated BEFORE this last occured. Even if 1 site was running an older copy, other sites could have easily been modified since they're on the same account. Please advise.

Thanks,

And for the ........blah time I just had to answer, YES.

Ill keep anyone who is interested updated.

emthree

10-05-2006 01:32 AM

I spoke to them earlier. Since i've ONLY been running the newest version of WP on that virtual account, they say it must be an unpatched hole. We need to take it up with WP.

Gillespie

10-05-2006 02:36 AM

Are you absolutely sure that they're getting in through WP? I've looked at their forums and didn't see a single hacked thread in the first two pages.

JOHNNY_BUTTHOLES

10-05-2006 02:42 AM

Quote:

Originally Posted by emthree

I spoke to them earlier. Since i've ONLY been running the newest version of WP on that virtual account, they say it must be an unpatched hole. We need to take it up with WP.

have you gone through all of your template files to see if the iframe code is on there?

emthree

10-05-2006 02:42 AM

Quote:

Originally Posted by Gillespie

Are you absolutely sure that they're getting in through WP? I've looked at their forums and didn't see a single hacked thread in the first two pages.

That's the same thing I said to the tech. I checked the forums and google before I contacted them. He insists that it's a WP Hole. He says it shows nothing on my logs. I dont know who to believe.

Gillespie

10-05-2006 02:44 AM

Do you have access to your /var/log/messages file?

emthree

10-05-2006 02:44 AM

Quote:

Originally Posted by JOHNNY_BUTTHOLES

have you gone through all of your template files to see if the iframe code is on there?

Yes, it was inserted into both of my footer files.
bottom1.html and bottom2.html

RevSand

10-05-2006 02:45 AM

This does not seem to be a webair OR wordpress issue since I also have been hit and do not use either...

chaze

10-05-2006 02:47 AM

There is several ways a account can be hacked, If it's web air then other accounts would be hacked and the server would be taken offline. Once a server is hacked from root it's toast.

They couldn't risk running it if it was the server.

Most likly some php somewhere on your site, maybe even with your pasword.

I would love to tell you otherwise and to switch over to us but php is a hackers playground and has to be carefully watched.

On the other hand there is additional security to detour hackers like removing telnet and trace route whois details. Makeing apache look like it's not running from a basic ping and ect.. brute force protection might help too..

JOHNNY_BUTTHOLES

10-05-2006 02:48 AM

Quote:

Originally Posted by emthree

Yes, it was inserted into both of my footer files.
bottom1.html and bottom2.html

is it gone or is it still showing up?

emthree

10-05-2006 02:48 AM

Quote:

Originally Posted by RevSand

This does not seem to be a webair OR wordpress issue since I also have been hit and do not use either...

The plot thickens. :helpme
I bet the guy behind it all, is reading this and laughing at us.

emthree

10-05-2006 02:49 AM

Quote:

Originally Posted by JOHNNY_BUTTHOLES

is it gone or is it still showing up?

Since I removed it, I have not seen it back... yet.
How about you? What happened when you removed it?

chaze

10-05-2006 02:50 AM

Have you host run a rootcheck kit on your account, there may be backdoors still. Also have them to a search for that name in all your files from the command line.

JOHNNY_BUTTHOLES

10-05-2006 02:51 AM

Quote:

Originally Posted by emthree

Since I removed it, I have not seen it back... yet.
How about you? What happened when you removed it?

as i said i went through all my files (php, html) on all my sites. i found it on non-wordpress sites attached to regular php footers. i deleted it and changed the permissions to read only. it hasn't shown back up... yet.

i'm not on webair either.

bigalownz

10-05-2006 02:02 PM

Quote:

Originally Posted by emthree

Did/do you have wordpress installed on that site?

no

nothing at all no scipts etc just plan text

i deleted the page and put a new one up and a few days later it was back

i notice it only went on to index.html

emthree

10-05-2006 03:49 PM

:Oh crap

McCord

10-08-2006 09:58 AM

Quote:

Originally Posted by Superterrorizer (Post 10994392)

You are going to switch hosts because you didn't keep your scripts up to date and your out dated insecure scripts are being exploited? Unless that service is part of your contract or SLA it's YOUR responsibility to keep your scripts up to date, not your hosts.

While many potential security threats both known and unknown can be blocked, many cannot. If your server gets hacked via an exploit in the OS or an application (apache, php, mysql, etc) then it's your hosts fault (Unless you are unmanaged/colo). If one of your sites gets hacked/defaced due to you not keeping your scripts up to date, it's your fault.

Switching hosts isn't going to magically update all your scripts and fix your security problems.

This guy/gal has it just about right. I work for a hosting provider and I've had to deal with this the past few days. Anyhow - here is a TIP:

STRONG PASSWORDS

it looks like your "hacker" is harvesting passwords (most likely insecure and very weak ones at that) and so far - the offending IP appears as (i've seen the same IP on 2 servers so far):

12.219.246.180

Ask your hosting provider (if you don't know how) to block all access from that IP and change ALL passwords on your system.

bigalownz

10-08-2006 04:58 PM

looks like Naughty america has had the problem too

there my friends hot mom members area has it too now

looks like its a big problem for all

Machete_

10-08-2006 05:01 PM

Some say its a hole in PhP itself, other say its in cpanel. in any case its = root access

Gillespie

10-08-2006 05:03 PM

I have like a 25 char pass for my root account. All letter, numbers and punctuation marks, mixed caps, etc...

I hope I'm safe. :P

Machete_

10-08-2006 05:12 PM

Quote:

Originally Posted by Gillespie (Post 11026263)

I have like a 25 char pass for my root account. All letter, numbers and punctuation marks, mixed caps, etc...

I hope I'm safe. :P

If they use a exploit in Cpanel or PhP as mentioned, they dont need your account.

Gillespie

10-08-2006 05:18 PM

Yeah, I know. I just updated everything as soon as I started seeing these threads in other boards a week and a half ago, so I hope I'm clear.

facialfreak

10-08-2006 07:00 PM

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

http://www.securityfocus.com/bid/14088/solution

Gillespie

10-08-2006 07:12 PM

Woot! I was clear anyway =)

boneprone

10-09-2006 03:18 PM

Seems I got hacked today..

Would like if someone could shed some light on this on how they got in..

icq 66883099

Machete_

10-09-2006 03:28 PM

Quote:

Originally Posted by boneprone (Post 11033950)

Seems I got hacked today..

Would like if someone could shed some light on this on how they got in..

icq 66883099

dissipate posted these two pretty usefull links
http://www.securiteam.com/unixfocus/6R0030UH5W.html
http://www.securiteam.com/unixfocus/6M00315H5S.html

Im my case (webair hosted) it was through cpanel

boneprone

10-09-2006 03:42 PM

Jupiter is looking into it now.

Not sure how he got in..

Looks like he just walked right in by logging in with a password.

Sosa	10-09-2006 03:48 PM

I noticed this on one of the sites I had a hardlink trade with this morning. Bad news.

Machete_

10-09-2006 03:49 PM

Quote:

Originally Posted by boneprone (Post 11034145)

Jupiter is looking into it now.

Not sure how he got in..

Looks like he just walked right in by logging in with a password.

that is what happends when your password is:
From The Nectar Of The Bone Flows All That Clicks

CaptainHowdy

10-09-2006 03:49 PM

Quote:

Originally Posted by dissipate (Post 10990939)

Most adult servers lack even basic security measures. It's like shooting fish in a barrel.

:helpme !!

emthree

10-09-2006 03:50 PM

Quote:

Originally Posted by boneprone (Post 11034145)

Jupiter is looking into it now.

Not sure how he got in..

Looks like he just walked right in by logging in with a password.

I dont think that's the case. I had webair look at my logs, and they said they did not see anything funny.
Let us know what Jupiter says though.

bigalownz

10-12-2006 08:52 PM

just a qestion

do you use awstats ???

JD	11-13-2006 09:55 PM

bump for a fucking solution. got hit again just now

Kimo	11-13-2006 10:09 PM

theyve been hitting everyone lately

RyanL

11-14-2006 09:19 AM

ne1? ne1?

ladida

11-14-2006 09:55 AM

Most of you probably didn't even clean your sites so they don't even need another access.

Verbal

11-14-2006 10:31 AM

erased the virus and changed my password ... haven't had a problem since

Ace_luffy

11-14-2006 10:41 AM

any proofs

JD	11-14-2006 11:00 AM

Quote:

Originally Posted by Verbal (Post 11312494)

erased the virus and changed my password ... haven't had a problem since

i've done that about 10 times and it keeps happening

All times are GMT -7. The time now is 06:22 PM.

Page 2 of 3

Show 40 post(s) from this thread on one page