1
Ace_Armstrong
Sites being defaced...anyone else seeing a trend here?

In the last month, I have had two of the sites I've designed for clients get hacked into and defaced. Both were XOOPS sites, and they are the only sites I've ever had someone manage to hack into.

Has anyone else had this problem? If so, did you ever figure out how they were getting in, or have any ideas on how to prevent this?

2
Bender
Re: Sites being defaced...anyone else seeing a trend here?
  • 2005/1/24 16:24

  • Bender

  • Home away from home

  • Posts: 1899

  • Since: 2003/3/10


While i would not dismiss XOOPS as being leading to your defacements i would consider it more like to fall into the php troubles of last month.

Is this dedicated hosting or shared hosting?
Did your provider upgraded php before the defacements?
Is your XOOPS version the latest one available at that time?

And most interesting: What about other customers on the same server if you talk about shared hosting?

3
Burnzy
Re: Sites being defaced...anyone else seeing a trend here?
  • 2005/1/24 16:28

  • Burnzy

  • Just popping in

  • Posts: 75

  • Since: 2005/1/23


omg im cracking up here. They hacked ur site and left there email. Thats halarious. wooo

4
Ace_Armstrong
Re: Sites being defaced...anyone else seeing a trend here?

Quote:

Burnzy wrote:
omg im cracking up here. They hacked ur site and left there email. Thats halarious. wooo


Well, they either aren't very good (read: ScriptKiddies) or don't intend to be extremely malicious, because all they did was overwrite the old index.html file. I just uploaded the original and all was well again. What pisses me off is that they got in at all.

For the previous question, this is shared hosting (as I understand the term). I don't know if they upgraded their PHP or not recently. I'll have to find out.

5
basza
Re: Sites being defaced...anyone else seeing a trend here?
  • 2005/1/24 18:00

  • basza

  • Just popping in

  • Posts: 73

  • Since: 2004/6/21


I noticed that when I was asking for some feedback on I site I was working on, for the first couple of days the amount of attacks increased. Lucky I'm running IPCop and none got through

6
Peekay
Re: Sites being defaced...anyone else seeing a trend here?
  • 2005/1/24 19:30

  • Peekay

  • XOOPS is my life!

  • Posts: 2335

  • Since: 2004/11/20


If hackers gain root access to a shared web server, it's likely that every index file on every PHP driven website on the server will get defaced. For example, last year's Santy worm looked for vulnerable versions of phpBB to use as a gateway, but you didn't need to be running phpBB to get hit.

The trend might be due to a hacker competition. They have them now and then.

7
Antoine
Re: Sites being defaced...anyone else seeing a trend here?
  • 2005/1/24 19:59

  • Antoine

  • Friend of XOOPS

  • Posts: 112

  • Since: 2004/11/14


If you want to know if the PHP version is the latest make a file and call it test.php or something.
Make it read:
phpinfo();
?>


That should give you the information you need.
The PHP version should be 4.3.10.

If your host runs Apache, which is quite likely I'd also place a file named .htaccess in your XOOPS root containing:

php_flag   register_globals   off


Which makes it a lot harder for hackers to control all kinds of variables that should not be directly changeable by visitors. Theoretically this can cause some issues with certain scripts but at least the XOOPS core modules should work fine with it.

Login

Who's Online

301 user(s) are online (258 user(s) are browsing Support Forums)


Members: 0


Guests: 301


more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Nov 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits