My Smf Forum Was Hacked

electron

Oct 5 2006, 03:28 PM

I dont know how but my board was hacked by some site by the name Spyhackerz.com .
I use SMF as my board and the main settings file Settings.php was hacked.
This file had the password of my DB and i dont know whether they have it or not.

They changed its content to the following:

CODE

<html>

<head>

<meta http-equiv="Content-Language" content="tr">

<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">

<title>Hacked by Spyhackerz.com</title>

</head>

<body bgcolor="#000000">

<a href="http://www.spyhackerz.com">

<img border="0" src="http://rootingsabotage.sitemynet.com/sht.jpg" width="503" height="387"></a>



<a href="http://www.spyhackerz.com">www.spyhackerz.com</a>



 <EMBED

src=http://spyhackerz.com/music/index.mp3

width=20 height=15 autostart="true" loop="true">

 

</body>

</html>

Well do you guys know of this.Do those guys have my password now.
I changed back my file and my Board is working now.

Please help as this is a very very serious matter

Zero Ziat

Oct 5 2006, 03:35 PM

Holy crap! Trap Seventeen security was breached. I think they would have used an FTP server exploit or anything else, which means ALL users security is compromised.

Backup your files in your computer EVERYONE.

*Calling BH or OQ*

jlhaslip

Oct 5 2006, 03:44 PM

*wait*
You might want to check at the SMF Support Site for clarification about whether this is a problem throughout the SMF Community or solely for your site.
Don't start making any assumptions about the Security here at the Trap17 Forums or on other Xisto Sites.
There is no reason to believe this is a Trap17 account holder problem until further information is obtained.

To begin with, alter your cpanel password immediately.

electron

Oct 5 2006, 03:58 PM

Well i have asked the SMF guys lets see.

Zero Ziat

Oct 5 2006, 04:01 PM

Well, yeah, the mod is right (sorry, I can't even pronounce your name, too confusing.

).

I usually enter nervous stats and it ends on this, saying that I don't trust certain security or etc. Anyways, nobody knows if something is 100% secure.

I think that Trap servers are 98% secure. So yeah, change your cpanel pass.

I will be trying to report this to the feds unless it was framing, etc.

But getting with police is actually no good, so unless this gets on high critical status, I should keep my mouse shut.

Kubi

Oct 5 2006, 04:03 PM

Simply, an easy password could be the issue. Sometimes "hackers" are nothing more then "lucky guessers". Make sure your password contains is hard to guess.

Something like "j42dks;;;" would work very nicely infact. (DON'T USE IT). Somelike "coolio" is to easy.

Backup all your files, you should do this everytime you change a setting anyways.

fffanatics

Oct 5 2006, 04:07 PM

Most likely what happened is that they put code into one of your db search fields and or logins and depending on the code they used, it can allow them to pull data from your setting files and or from your database giving them access to it. I used to have a phpnuke site and after being hacked, i read a ton of articles on how to secure it. However, it just cant be done since with every new version of software there are new flaws that are created. I would make sure you update your forum to the newest version since the security vulnerabilites will be the least likley known and always update to the new version no matter what anyone tells you. Also, make sure it is hard to identify exactly what type of forum you are using since it will make it harder hack. Finally, change all your passwords just in the case they found them because they will be back if they do.

BuffaloHELP

Oct 6 2006, 05:23 AM

If your account was compromised, there wouldn't be any left of your files and database... right? Think before you assume.

Which version of SMF were you using? And did you follow all SMF standard setting instruction, such as CHMOD?

QUOTE

A bug in PHP causes a vulnerability in SMF 1.1 RC2-1. You can install this patch (click here to install) to patch your version of 1.1 RC2 to 1.1 RC2-2.

We received a report detailing a bug in PHP (improper deletion of hash values in the zend_hash_del_key_or_index() function), causing a vulnerability in SMF. We have addressed this issue in this release. We urge everyone who is using an earlier release of SMF 1.1 to update immediately.

So have you upgraded to 1.1 RC3?

Panzer

Oct 6 2006, 06:30 AM

You also may have left the install file in, CHMODDed a file where it wasnt neccesary. All of those things can compromise security.

darran

Oct 6 2006, 09:49 AM

I am pretty certain that Trap17's security should not be put into question here. I have been with Trap17 for almost 2 months and there is nothing but praise for them from me. The problem is there are so many hackers out there who are really good in their hacking skills but then again, I don't think they would hack your site without any reason unless they are a group of hackers picking on a random site to hack just for the thrill of it. Another issue would be your usage of SMF forums, IMO price determines everything. You pay for what you get. In regards to forums/message boards it is best to get a paid 1 like IPB and VBulletin because these are the ones who will usually have a very strong security and there are constant updates in regards to the security level in a particular version.

The way I see it, I think this could be more of a settings problem made by you or even a SMF issue. But it is very unlikely to be a trap17 account because from what I know, none of us experienced a problem of getting hacked like that.

Latest Entries

BuffaloHELP

Oct 8 2006, 07:48 AM

That is quite interesting news... only 1.1 RC2 and RC2-2 were effected due to security exploit. RC3 should have fixed this error.

Be sure to change your Settings.php to CHMOD 744 so that it's only read only mode. Whenever you need to upgrade or modifying change back to 777 and then change it back.

This will increase your security.

electron

Oct 8 2006, 06:51 AM

QUOTE(BuffaloHELP @ Oct 6 2006, 05:23 AM)

I am using RC3 and it was only hacked.

Also i am not raising the question the Trap17 has a security hole.
I thought u guys might be knowing something

ADD REPLY / Got an Opinion!	a humble request :-)	RAPID SEARCH!	Free Hosting	[X]
Express your Opinions, Thoughts or Contribute more info. to help others. Ask your Doubts & Queries to get answers, So that "Together We can help others!"	Register FREE for AD-FREE forum, Create your own topics, Ask Questions, track topics, setup subscriptions & notifications and Get a Free Website w/ Email and FTP.		500MB Space No Ads, CPanel, FTP, PHP, MySQL, EMails - 100% FREE