XOOPS 
Forum
Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk
  1. Board index / 
  2. XOOPS Community Support forums / 
  3. XOOPS general usage questions 
  4.  / Are Xoops sites under attack???
Register
11
irmtfan
Re: Are Xoops sites under attack???

  • 2007/11/8 22:19

  • irmtfan

  • Module Developer

  • Posts: 3419

  • Since: 2003/12/7


@ preachur:
a hacker can found it easily whether you delete all XOOPS related materials or not.

@ freeop:
i suggest to uninstall that module and install "protector" latest version.
also i suggest "tinyeditor" based on TinyMCE it can recognize all bad html codes
12
debianus
Re: Are Xoops sites under attack???

  • 2007/11/8 22:26

  • debianus

  • Not too shy to talk

  • Posts: 179

  • Since: 2006/12/17


just some information about cjay problems:
http://secunia.com/advisories/25665/
13
freeop
Re: Are Xoops sites under attack???

  • 2007/11/8 22:35

  • freeop

  • Just popping in

  • Posts: 25

  • Since: 2002/4/12


Thanks, cjay is long gone.. old test site. learning the hard way, fun,fun,fun..
14
preachur
Re: Are Xoops sites under attack???

  • 2007/11/8 23:10

  • preachur

  • Just can't stay away

  • Posts: 525

  • Since: 2006/2/4 4


Quote:
huum more seems its your PC under attack.


It was coming from the database, not my PC. Luckily it was just a test site... However, I DO plan on launching a site on that domain with 2.0.17.1 in the near future. This made me scared.

I think I know how it was found... I HAD a link to that domain on my profile on this site. The same with the Rocky Mountain Railroad site I ran that was destroyed a year or so ago. I think I will not have a site link on my profile here because that brand new test site wasn't even in the search engines. The only place they could have found it was here.
Magick can never be restrained, but when freely given is thrice regained!
15
tom
Re: Are Xoops sites under attack???

  • 2007/11/9 2:25

  • tom

  • Friend of XOOPS

  • Posts: 1359

  • Since: 2002/9/21


Quote:
I hate to say it, but I am taking all searchable references to XOOPS off of my sites for awhile. I really don't want my work destroyed because I am running xoops.


I'd do that anyway, I'd especially make sure versions of the core and modules are not shown.

I tend to always change module directories and don't use the default table prefix, although not full proof it helps to make it a little harder to get into.

I stay away from designers themes that try to force their links to stay as this simply promotes your website to hackers through search engines.

Personal T Opinion of course.

Quote:
If you're not using Protector 3.04 (or 3.15beta) then do so ASAP.


Hi John,

In the case of the protector module is it really advisable to use a beta version as normally people would say now to beta modules on production sites, I only ask as If it is I shall upgrade my versions.

Quote:
@ preachur:
a hacker can found it easily whether you delete all XOOPS related materials or not.


If someone wants to hack something then yes they will find a way, however if someone wants to hack XOOPS sites, then removing all visible signs that would show in search engines would help prevent them as they may not even know you exist.
Kind Regards.
Tom

http://bassmanthemes.com
http://www.xoopslance.com
16
irmtfan
Re: Are Xoops sites under attack???

  • 2007/11/9 6:55

  • irmtfan

  • Module Developer

  • Posts: 3419

  • Since: 2003/12/7


Quote:

however if someone wants to hack XOOPS sites, then removing all visible signs that would show in search engines would help prevent them as they may not even know you exist.


IMO ( and it is just my opinion) if a CMS can be beat by random recognize attacking programs, it is a waste of time to continue with it.
xoops can not be beat that easy if you do some basic security advices:
1. always use the latest stable version of cores and modules.
2. dont use alpha and beta and unknown modules from unknown developers.
3. use "protector" as an alternative for bad coding in modules and ???Core??? and even misconfiguration in your server.
4. pay attention to security warnings.

Quote:

In the case of the protector module is it really advisable to use a beta version as normally people would say now to beta modules on production sites, I only ask as If it is I shall upgrade my versions.

first i look at the author. second in my experiences with some high traffic sites (+120G per month) 3.15 beta is stable enough.
17
Catzwolf
Re: Are Xoops sites under attack???

  • 2007/11/9 7:03

  • Catzwolf

  • Home away from home

  • Posts: 1392

  • Since: 2007/9/30


I would just like to point out that the ever growing number of attacks are done by scripts written to exploit security holes within the core and modules, most of these scripts are executed not by hackers but little script kiddies.

The fact is that and I have said this before and I will keep saying it till someone decides to listen to me is this, if we had a module developement team or some kind of development team that would take those modules etc and fix the issues at hand then we wouldn't have these issues now. Why can't we take a module or in the case of spaw and fix the security issue and release it to the public? This is the reason I do not advocate this 'let the community do it factor' when it comes to these issues.

But we have this surge of hackings go on day by day and no one things to alert the community of these issues here where it matters and the holes keep growning and growing.

Maybe one day someone will listen before it gets to late.
18
irmtfan
Re: Are Xoops sites under attack???

  • 2007/11/9 7:10

  • irmtfan

  • Module Developer

  • Posts: 3419

  • Since: 2003/12/7


+1

this is the reason we need an official module developement team and official documentation team.
official documentation is important too. eg: when somebody change a critical option in "protector".
19
preachur
Re: Are Xoops sites under attack???

  • 2007/11/9 8:48

  • preachur

  • Just can't stay away

  • Posts: 525

  • Since: 2006/2/4 4


Quote:

irmtfan wrote:
+1

this is the reason we need an official module developement team and official documentation team.
official documentation is important too. eg: when somebody change a critical option in "protector".


What is the problem with protector? I HOPE it works....
Magick can never be restrained, but when freely given is thrice regained!
20
damaster
Re: Are Xoops sites under attack???

  • 2007/11/9 9:06

  • damaster

  • Just can't stay away

  • Posts: 556

  • Since: 2003/5/11


There's no problem with protector.
PHP is not 'strict' as C or Java
For years people learn by copy&past
'pieces' of code, and if that works,
well, that's good enough!
That result on a huge but very fragile
patchwork (core and modules). Among other
reasons, its also why many projects were
'recoded' to get out of what is known
as the nuke era bad habits and evolve
I like people more than machines or money. But that's me!
Lets do something good and great: Lets do open source!
« 1 (2) 3 »

Login

Register now!  |  Lost Password?

Search

Advanced Search

Recent Posts

Who's Online

211 user(s) are online (120 user(s) are browsing Support Forums)

Members: 0

Guests: 211

more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Apr 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits