| Author |
 Topic  |
|
|
Dan Martin
Average Member
USA
528 Posts |
 Posted - 08 May 2002 : 03:58:12
|
My forums at http://www.councilofgrey.com/forums were hacked tonight by someone calling himself the "Interhacker". I mean utterly and completely hacked. He deleted every forum but one. He edited my account info. I am the only admin, so obviously he access my account.
I am running the latest version of Snitz, highly modified including the RTE MOD. Do you think the RTE allowed someone to paste in javascript that redirected cookies? I know this can be done if you allow HTML in a forum.
I am so sad right now, he deleted 10,000 posts including many of our policies. I think I'll go cry for a while.
People hacking community websites - they are so cool aren't they.
|
|
|
RichardKinser
Snitz Forums Admin
USA
16655 Posts |
Posted - 08 May 2002 : 04:13:02
|
check out this forum: Announcements: Security Related Bug Fixes
and make sure that you have implemented all of them. From looking at your site, it doesn't look like you implemented the members.asp fix. |
 |
|
|
Davio
Development Team Member
Jamaica
12217 Posts |
Posted - 08 May 2002 : 04:17:00
|
See here Dan: http://forum.snitz.com/forum/forum.asp?FORUM_ID=118
Unfortunatly, you're not the only one. He is going around hacking users forums.
«------------------------------------------------------»
Want to know when the next version comes out,
as soon as possible? Join our Mailing Lists ! |
|
|
|
guney
Starting Member
26 Posts |
Posted - 08 May 2002 : 08:38:50
|
I am from Turkiye and our 2 forums were hacked yesterday. And the other one has been visited by the hackers!!!
We changed the database name immediately, deleted members.asp file and changed the passwords to try to protect it while we are adapting security bug codes --but we noticed that after changing the name of database name some of the turkish fonts were changed and couldnt be corrected..
Do you know the reason? and can you help me?
The other forums were hacked but before we got the mails from hackers, first some of our turkish fonts were broken. Is there any connection between being hacked and the change of the fonts?
Also, how can we stop accepting direct membership? We want to keep the applied members wait for some time to get necessary info about them?
Thanks..
Edited by - guney on 08 May 2002 08:39:54 |
|
|
|
Chiz
Junior Member
245 Posts |
Posted - 08 May 2002 : 09:18:08
|
With the increased occurrence of attacks, I think these guys have a new tag line: "Where do you want to hack today?"
I mean, we're all like sitting ducks here. Even if we apply the patches/fixes how could we be sure that all security holes are fixed. 
Pls. don't get me wrong, all of you guys are doing a great work for Snitz. I just hope that we could have someone who would help pinpoint these security holes so that it would be fixed before some hacker brings a someone else's forum down again. Sort of a hacker against a hacker.
Just my 2Kb's worth...
My websites: PalmVenue :: PV Mobile
My Snitz MODs: Categorized Icons
|
|
|
|
Dan Martin
Average Member
USA
528 Posts |
Posted - 08 May 2002 : 14:55:36
|
I'm quite sure what he's done is searched for "Snitz". If you know Snitz's security vulnerabilities, a quick Google search will lead you to plenty of hacking ground. Since every Snitz forum is required to have the "powered by" logo or text, it is a simple matter to find targets.
My site is down, but I don't think I'm going to be lucky like you guys. I don't hold much hope for a backup. I didn't have any. My WSP is looking right now, but that's probably not going to happen.
As for security patches - quite honestly I had no idea until this happened that Snitz had security patches available. Quite sadly I think I've lost over 10,000 posts.
On the bright side, I do have my hacker traced (he didn't cover his tracks very well). I know his name, home phone, and address. This won't be the last he sees of me. After I confirm to my satisfaction that it's not someone's kid, I will provide you with the info. Perhaps you'd like to order him a pizza or flowers, or some COD packages.
|
|
|
|
Gremlin
General Help Moderator
New Zealand
7528 Posts |
Posted - 08 May 2002 : 18:34:10
|
1/2 Ton of gravel delivered and dropped off on their front lawn always used to work for me 
www.daoc-halo.com |
|
|
|
Nathan
Help Moderator
USA
7664 Posts |
Posted - 09 May 2002 : 01:27:56
|
The RTE mod, because it requires HTML to be left ON, will leave your forum wide open.
 Nathan Bales
Snitz Exchange | Do's and Dont's |
|
|
|
rlpendleton
Starting Member
USA
17 Posts |
Posted - 09 May 2002 : 01:44:48
|
I don't know if this could fix the Google problem, but there is a meta tag that can prevent a webpage/site from being indexed on search engines. I can't recall it at the moment... but it prevents pages from being indexed. Couldn't you use that on all pages containing your form? That would save you a bit-hackers couldn't look up your forum(s) on search engines. Does anyone know the meta coding and actually, does anyone know if this would even work?
--RLP |
|
|
|
Davio
Development Team Member
Jamaica
12217 Posts |
|
| |
Topic |
|
Topic Locked
