TinyPortal

"You Two,Israel And Usa;
Didnt You Think That We Wouldnt Ask You
About All Off These Oppressions You Did.
Today Our Way Is That,
Tomorrow We ll Be Knocking Your Door
Because Of These Oppressions.Be Sure About This.
Sins Can Be Forgiven But Oppressions Never.
Filistin,Iraq Please Try To Stand These Oppressions.
We Came To Broke Hands Which Hurt You.
Now We Are Here Against These Enemies.

We Will be Your Curse on Cyber World ! !

******************************************************************
  LiNuX4AleX  (GeeTz)
******************************************************************
         Dr.hacker - Dr.ExE - Dr.Draman -linuXhak
            BroKeN-PrOxy- hakrawy -MaX -Dr.jr7 - php Emperor
      Mail:Mr.elgaarh@hakrawy.com *_^ ----->...............

Its not hacked, all it seems like is you've left your hosting account unsecured and someone replaced the index.php/index.html :P

//////////// - READ - /////////////
Ok all resolved with BackUps, but warning, our site was absolutly hacked.

We are using SMF RC2 with the last Tiny Portal versión.

The first sintom was a message in the private message secction, and when y attempt to read the private message, all the site was crash with the hacker message and image.

1 _ Ftp was not violated.

2 _ The index.html was mine, while i was deleting all hacked files.

3 _ Is not a unsecure host.

Even secure hosts have security problems

More than likely they guessed a password for a user account.

If thats the case, it could be brute force hackers :(

Brute force doesnt work unless someones stupid enough to have a 3 or 4 number only password. And even then it would take a few hours to crack......i dont know from personal experience of course  ::) ::) i've just read it off some well known hacking sites i like to read through to gain computer knowledge.

As Ichbin siad they probably just guessed....

You know i keep hearing about people getting hacked etc, but have actually yet to be hacked. I probably have being running the tp + smf combo for almost a year now! But then again i do use unique logins and i use different letter and number combinations for each one of my websites and the smf and maybe thats why i have yet to be hacked.

Ok, i have now news. You maybe can explain me about the problem, if is host insecure or what.

Well, we were hacked again today, but only i was need replace those files in root dir:

index.php
Settings.php
SSI.php
Settings_bak.php
ssi_examples.php
index.php~

And with this action, the forum works fine.

Please say me what maybe is the problem, where this hacker can enter.

they can go through the DB on your host, if you leave the SMF_ as prefix, they know the patsh to the files and that way they can change them perhaps

Then need i change the database prefix ?

Could be worth a try

I would change any admin passwords if I was you.

I knew there was a reason i changed the smf_ thing on my forums hahaha

I really don't think that is a problem. Maybe I misunderstand G6. The database prefix doesn't really mean anything unless someone has hacked your database user/pass in the first place.

Do you have FlashChat installed.  That might be a back way for them.  I feel your pain I was hacked 3x this past week.   :tickedoff:

What i meant was that if they found a passage to hack a site, you should change as many things possible in order to ruin their findings so they have a hard time doing the same thing over and over.

If they hack a site like they have done here, i don't think they go through the SMF or TP, i think they go through the host and ruin a lot of sites on the same server.

I read some about it yesterday, and they hack the host, manage to put in some small file that "feel" when a certain file gets active (in this case it seems like it's index.php) and when the file is called for, this little file they have planted, execute and change the file that is called for.

i will see if i can find the site again where i read about it, but i would contact my host and ask them to scan the servers for Trojans and back door programs.

have to add a little more about what i read.
This action is often made to FREE hosting companys, and more then one time it's prooven to be the actuall host itself that put in this type of files to their servers, and why? to get rid of the free hosted users after the testperiod is over and the host want to start to charge people for eather the security, or for a better hostingplan.

If the users get hacked over and over again, they automaticly seek another host, and that way the free host dont have to shut the server down and kick the free users them selfs and gain bad name and reputation.
Sad but true.

Thank you guys for you data.

FlashChat:
I have not it.
_____________________________________________________________________

My host is a pay host ... and is very costous. Today i was speaking with the admin enterprise and he tell me that the host is updated with the last versions of softwares, and no one of the others sites hosted in this host is having problems like our site.

Is weird, but the database was not touched by the hacker, all data is fine. I have changed the user and password for the FTP, and i put very long and hard user and password.

This hacker have access to root php files as "index", "settings", etc,etc.

PD:

Is possible install TP in SMF RC3?.

also please make sure of the following - that you have NOT:

- installed any 3rd party unapproved mods for SMF

- set a password which is relatively simple (best would be use a password composed of alphabet [caps and small] + numbers - and a long one too)

- allowed any other files or scripts to be stored in your smf folders (check the files against a downloaded package to compare how many u should have)

Also it may be a good idea to check with your host about security issues - it could be an issue linked to the for all you know.

Thats all i can really think of - best of luck protecting ur site

Well anything is possible. But if I was your host I would be working my butt off to figure out what caused it so that hopefully it wouldn't affect any of the other clients hosted on the machine. You mind giving a list of EVERYTHING that is installed on your server? This includes all the programs/scripts etc. Even list custom blocks and everything you have that is installed in TP and SMF. Your host should be able to track this down.

My god it is very hard. I dont understan that i was doing by this stupid hacker is having time to bother to me. 

:-\

Quote from: Alan S on September 09, 2006, 07:23:33 PM
Brute force doesnt work unless someones stupid enough to have a 3 or 4 number only password.

I feel relieved. For a second there I thought my two character password to all my sensitive, personal information was subject to brute force. That is the last time I contemplate about adding another character to my passwords with such fragile information. :P

Lol, more info:

Our index.php file was changed to:

____________________________________________________________________
<html>

<head>
<meta http-equiv="Content-Language" content="tr">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Biz Buyuk Turk Milletinin Hizmetindeyiz! Hacked By EKBERSAH AYYILDIZ ViP TEAM
|AYT|International Force|</title>
</head>

<body bgcolor="#000000">

<p align="center"><strong>
<font face="Verdana" color="#777777" EN? Transitional 4.01 HTML DTD W3C ?- PUBLIC <!DOCTYPE>
<b><font face="tahoma" color="#FFFFCC" size="5">
<img border="0" src="http://img220.imageshack.us/img220/1345/logomkt7.gif" width="212" height="209"><br>
<br>
H<span lang="tr">ackeD BY EKBERSAH<br>
</span></font></b></font></strong>
<img border="0" src="http://img220.imageshack.us/img220/6702/bayrakiz5.jpg" width="446" height="322"></p>
<p align="center"><strong><font face="Verdana" color="#FFFFCC"><b>
<font style="font-size: 14pt">|AYT|International Force|<br>
<br>
Turk Hacker's </font></b></font></strong></p>
<p align="center">
<object id="Player1" height="15" width="44" align="left" classid="clsid:6BF52A52-394A-11d3-B153-00C04F79FAA6">
  <param name="URL" ref value="http://www.ayyildiz.org/huo.mp3">
  <param name="AutoStart" value="-1">
  <param name="Balance" value="0">
  <param name="BaseURL" value>
  <param name="CaptioningID" value>
  <param name="CurrentPosition" value="-1">
  <param name="CurrentMarker" value="0">
  <param name="DefaultFrame" value>
  <param name="Enabled" value="-1">
  <param name="EnableContextMenu" value="-1">
  <param name="InvokeURLs" value="-1">
  <param name="Mute" value="0">
  <param name="PlayCount" value="1">
  <param name="Rate" value="1">
  <param name="SAMILang" value>
  <param name="SAMIStyle" value>
  <param name="SAMIFileName" value>
  <param name="Volume" value="100">
  <param name="WindowlessVideo" value="-1">
  <param name="uiMode" value="invisible">
  <param name="stretchToFit" value="0">
  <param name="fullScreen" value="0">
  <param name="enableErrorDialogs" value="0">
  <param name="_cx" value="4294967191">
  <param name="_cy" value="26">
</object>
</p>

</body>

</html>
_______________________________________________________________

Sorry for my ignorance, but if the hacker can change the index.php content, ...then the problem is a host vulnerability?. I think that is vulnerability host now.

I have SMF RC3, with TinyPortal0.9.5. The damnit hacker works again the same.

I would think it's a host security issue too.... But I sure would like to know how they do it.

Few minutes before the Hack, a user was registered with the nick "KaBBala", with a IP 211.62.*.*. I was looking and this IP have parts of Asia and some more.

Another Turkish. A lot of "Islamic Extremist" Turkish are bothering for all places.

Since behind the hacks in our site, (4) times already, all were Turkish.

Check your site and also your hosts at


http://www.zone-h.org/component/option,com_attacks/Itemid,43/
(http://www.zone-h.org/component/option,com_attacks/Itemid,43/)

This lists confirmed defacments etc.

 :tickedoff:  grrrrr.. I was just on my site about an hour ago, I went back to do something and this came up

QuoteHacked by YorumSuz Avcihack Team Leader and SSes Avcihack team admin [www.avcihack.com]

I have checked the index.template, it seems they have removed the ssi.php files completely, but did this litle bugger get in the db and realy screw things up or is there a way to recover without losing everything????

*I am just goin through more files right now, a ton of missing files, and there seem to be a lot of crap messed with...but, will see what I can get going

This happened to us a couple of months ago.  I did a restore of the db and recovered lost files from the server snapshots.

I believe the culprit/backdoor at the time was an older version of Flashchat.  Sorry to hear of your troubles.  I can understand what you're going through. 

Sounds like it was va rootkit attack.. IE: someone on the server had an insecure setup.. letting a hacker upload to the tmp dir or something.. from there they can do anything if the server has insecure /tmp or /temp or /shm dir.. they need to have the temp dir setup as read,write,noexec
. If they have access to that then from Any site on the server thay can effect/hack ALL the sites on that server.. using thuings like cron scripts to replace itself and run itself to delete , edit , create, ANY FILE on the server ANYWHHERE... Very Scary stuff...

Also Don't have any DB's open to remote connection .. only local connection IE: from IP 127.0.0.1 this will prevent access to DB's from outside sources.. If you have it open then they can do dumps and then at their leasure on their own machine change the Pwords and then re-insert that record giving them complete access to your site as an admin..

These attacksa Don't require FTP attacks or anything..

Also Turn off any services like ssh,telnet,irc bots etc.. anything thats not needed

This is a majy problem with shared servers.. you don't know who's done what and who is leaving security holes open.. no matter how secure you are

THERE IS NO SUCH THING AS A SECURE SERVER .. by their very nature having to be able to be accessed from outside sources is always the problem.. the only secure system is one thats not connected to any network and without any external access devices (CD's,Floppy disks, USB, Serial , Parralel, keyboard..

so to have a secure system then all you can have is a mouse attached.. preferably hardwired in  LOL

But serously.. If you check those things then your system/server should be a  lot more secure.. its not a breach in SMF or TP as such.. just makes iit look like it..

I know.. ALL these things have been done to Me on a server I run fore shared hosting..

all that being said anything you put on a server be prepaired to loose any or all of it at any time... IE: keep regular OFF SERVER Backups ..

How the hjacker Gained access to implant a root kit on our server was someone running an insecure poorly written addon for Joomla..

Always keep an eye on the security sites..  (BTW.. this is how many of the hackers learn new vunribilitys and what softwre they are in..) for the latest and oldest , current attacks.. By telling us about the Flaws in software soi that we can fix them or delete them .. they also let the hackers know how to get in..

I don't have flashchat, or even a shoutbox for that matter on the site...

I understand about the vulnerablilty, just not sure where it happened...

I went in and had another look

they removed these just like in GeofMauser's case:

index.php
Settings.php
SSI.php
Settings_bak.php
index.php~

replaced them, but having other issues now when I try to get it to hook back up to the db....

were you all using the same versions of TP and SMF? I get scared when I hear of this sort of thing!

Is this a linux or Windows host?

@JRW - smf rc3 / tp 97beta (don't know if this is relavent in this or not, like I mentioned re: vulnerability... it could have been that one of my chmod settings was left at 777, I have been working in the back a lot lately :( )

@Ich - Linux ;)


still having problems with the db..keeps telling me cant connect to db..
( I did take a break to watch prisonbreak though...) hehe

A couple of days ago my cousin's site was hacked by the same group  :tickedoff: :knuppel2:.

I helped him reconstruct his site from scratch, and really took it step by step: Downloading new files from SMF and TP sites, ftp'ing them to his server and then performed the installation...

Strange thing, though, the permissions on several directories and even php files were set to 777 after the SMF install script was run (also the root index.php  :uglystupid2:), and even more after the TP mod was applied  :o (I think all of the e.g. "TP root" directories were set to 777). In conjuction with that the htaccess file is added/modified by the SMF install, so that mod security is turned off, that really opened up for some really nasty scam and spam files to be planted by the hacker  :tickedoff:.

How in #¤%$ can this in be called a decently secure forum/portal package?!

I think you have got everything abouy file permission and htaccess wrong.
If you point your browser to simplemachines.org and find the post made by [Unknownd] and filepermission and htaccess files, you will see what they really are and what they do.
SMF and TP IS secure, the content users then put in to the site might not be (one of them is FlashChat mod)

Instead of screaming about it here, you should also fill in a form on smf site about you being hacked, also give all the info you can on the content you had in the forum when it got hacked, script blocks, php blocks, html blocks, articles, other mods installed ?

But the again, all you will find in the end is that the HOST is more likly the one to blame for the hack, not the SMF or TP it self.

Its very easy to blame the software, but in many cases its the host or other files allowing hackers to get in. Even here at this site we had a hacker coming in 2 years ago, when we were at a shared server. When we moved to a dedicated it solved itself. Not that you need to have do that lol, just that often shared servers are more vulnerable - as someone else could have a door open, allowing hackers to get in on ALL sites. The reason only common files like index.php, settings.php etc. are targeted is of course that hackers don't know whats there in advance - they use a script that seek files for common names and just replace thsoe. Causing havoc in any script.

For our part back then, the host got it secured after the attack. I suggest checking out the host first, though warned..most hosts will NOT admit it was something they missed lol. Think for yourself instead.

I am NOT saying SMF/TP are flawless either, just that this kind of things is the primary goal for the dev team, even small security flaws results in updates to SMF. Simply because its so important to address them quickly.

I've been hacked quite a few times.

I don't think what your saying makes much sense. I believe it to be the host, or this story is not true.

-My regards.

This is a reply from his webmaster:

Quotehi,
I have also removed this from your htaccess file.

<IfModule mod_security.c>
# Turn off mod_security filtering.  SMF is a big boy, it doesn't need its
hands held.
SecFilterEngine Off

# The below probably isn't needed, but better safe than sorry.
SecFilterScanPOST Off
</IfModule>

If that had not been disabled the hacker may not have gained access as mod
security would help protect the account.

After that was removed, he could monitor what was going on an later report all further attacks that were made.

That is not quite the issue, the issue and the BIG question is, How did they even get so FAR INSIDE the SERVER so they got to the forum files in the first place ?

And really, this is not something we can do anything about here, you have to browse to simplemachines.org and fill in the report about being hacked, leave as much info as you can on both server, host, forum, mods and content used.
They are the only ones that will and can be bale to give you the tru answer after they have investigated it.

Yes - hate to tell you, but if they have gotten to your htaccess, then they have most likely not gotten in through TP... or SMF. if they have, I bet its because your passwords are the same for server access, database, site admin etc etc...

Hackers can also gain access through rootkits and trojans placed on your pc. These can harvest your server and other passwords and links to your sites.

If your site is repeatedly hacked even though your password has been changed you'll need to run various types of anti-spyware and virus programs to try to get rid of them. Remember, not all programs will detect all viruses, spyware, etc. Using different ones while in Safe Mode (if using Windows) will work best.

...and after the TP mod was applied, the forum main index.php permission became 777 - which also goes for all the subdirectories in the forum root folder :knuppel2:... Is that really as it should  :o?? That is why I still find it important to make an (small) issue out of it here too, not on the SMF site alone...

O yes, I've been around much too long not be aware of the issues/arguments between script builders and host owners, so I know what you mean Bloc. And I also follow your idea about the hacker entering into the site through the backdoor, so to say...

BUT, I also know I have spent more then 10 hours by now helping my cousin out, really eager not to breach the host owner's file permission conventions... But, that of course is sometimes hard since the scripts won't work properly then... :buck2:

So, the bottom line for me as an end user to the host owner as well to you devs is just a cry for some common sense about not who to blame but how to reduce the security issues as much as possible. Because after all, nothing much would be the consequences of a hacker's attack on a host if there were nothing much he could to do due to restricted set of permissions. Right? And leaving e.g. the index.php file in a 777 state in the mod install process of TP won't help it up - right?

Thanks for your concern.

Quote from: Skhilled on October 20, 2007, 01:13:10 PM
Hackers can also gain access through rootkits and trojans placed on your pc. These can harvest your server and other passwords and links to your sites.

If your site is repeatedly hacked even though your password has been changed you'll need to run various types of anti-spyware and virus programs to try to get rid of them. Remember, not all programs will detect all viruses, spyware, etc. Using different ones while in Safe Mode (if using Windows) will work best.

Thanks, I heard of this. But it's not my (or my cousins) server. And the host owner says it's just my cousins account that generates attacks - or at least attack attempts. As it seems, someone tries to reach files that don't't exist anymore on the account since everything was moved to a new account. So someone, but probably a script somewhere else, tries to run files that were "planted" on a previous occasion...

Quote from: JRW on October 20, 2007, 01:04:10 PM
Yes - hate to tell you, but if they have gotten to your htaccess, then they have most likely not gotten in through TP... or SMF. if they have, I bet its because your passwords are the same for server access, database, site admin etc etc...

Mmm, but it's probably not someone that has changed the htaccess file, but the SMF install?! And of course separate passwords are used...

As i said before, the folders with 777 permissions are not something hackers can do anything through, look at the htaccess files and you will see that ALL of them have 644

Have you been to SMF and filled in the hack report they have ? There is no use in posting about it here on this site.

Quote from: G6 on October 20, 2007, 02:59:48 PM
As i said before, the folders with 777 permissions are not something hackers can do anything through, look at the htaccess files and you will see that ALL of them have 644

Ehh, maybe so from the http outside but what about the inside?

Quote
Have you been to SMF and filled in the hack report they have ?

About to it... My cousin is away on a holiday trip and there's bunch of emails/msn's from worried forum users to take care of... Yes, I'll do it.

QuoteEhh, maybe so from the http outside but what about the inside?

Exactly, INSIDE the server side, not the portal front side.

Quote from: G6 on October 20, 2007, 03:44:34 PM

QuoteEhh, maybe so from the http outside but what about the inside?

Exactly, INSIDE the server side, not the portal front side.

Yes, but now YOU may miss MY point of view - and that is to not serve the presumtive user from inside with too generous permissions...

The only time 777 becomes an issue is if someone somehow gains access to the inside of the server. If you feel there's a security breach through your site I would highly suggest you take it to the Devs for SMF via http://www.simplemachines.org/about/security.php

Quote from: IchBinâ,,¢ on October 20, 2007, 04:16:39 PM
The only time 777 becomes an issue is if someone somehow gains access to the inside of the server. If you feel there's a security breach through your site I would highly suggest you take it to the Devs for SMF via http://www.simplemachines.org/about/security.php

Yes, now someone is getting my point over here... And yes, I have addressed that security issue form... and just received and email saying

Quote
You have sent an email to info@simplemachines.org.  In order to speed up your request, this email will provide some direction on where to go next.

Due to the volume of emails we receive each day, it is impossible for us to reply to each and every email individually.

If you are emailing regarding technical support, feature requests, or any functional questions pertaining to the forum software itself, please use the support forum at http://www.simplemachines.org/community/

Simple Machines does not accept offers for link exchanges.  If you would like to advertise on our site, please consider a banner campaign
http://www.simplemachines.org/about/advertise.php

If you are emailing regarding a forum running SMF that is not at simplemachines.org you will need to contact the forum's owner. This includes bannings of the forum against you, questionable material on the forum in question, or anything else related to sites running SMF.  Please note that we do not host any forums and have no control over how our software is being used.

If you have legal questions, questions for the project managers, or general questions directed towards Simple Machines LLC, you have the correct address.

Thank you for contacting Simple Machines LLC.

Well, what a warm welcome - exactly what I was looking forward to *NOT*  >:(... But I guess (rather hope) that's just an autoresponder...

I think i will lock this topic now.

Wait for their responce on your submission and keep talking to your host and ask them to check even further on the settings they have. We cant do anything more then what we have asked you to read so you understand how SMF and the permission works.
There is no use in continue with this topic from this point forward.

And for your information, that is an autoresponder mail.