News About The Turkish Hack

Yes, it's true. Apparently some turkish hackers group (confirmed via their routed IPs - both in turkey) found an Vbulletin Exploit (the forum software) and was able to wreak havoc on my day.


They were NOT able to penetrate the server itself, but rather the entire exploit was using the tools provided through the forum software.


So, i was on the road today and have only now been able to deal with this.


But first I had to get my account re-established. And then the laborious procedure of redoing all my template mods.


I have take further actions at the router level to restrict access to the admin sections to my specific IP only now. And since I am certain they didn't penetrate there server I believe this will end their ability to do much here.


But with things like this you have to wait for the hole to be exploited usually so you can see it and plug it up.


Extra hard when you didn't write the forum code yourself. Cleaning up someone else's mess is always 10x as hard.


Hopefully we won't be seeing them again.


Alex

(ps... now I want to know who turned some turkish hackers onto my forums :mad: )

Oh yeah... absolutely no threads or data was lost. Just the few hours it took me to get to my machine to fix it.

Thanks, darlin'. :*

Thanks, Alex, for all you do and put up with to make this forum available to us. I was getting Silco withdrawal symptoms after just a few hours without this forum!

Thanks for all your work, Alex. What a PITA! You're amazing and we're lucky that you provide the space/time for this doomtique. Also, it's a heads up for other server admins out here, I think I will be reviewing some firewall settings.

So, do you really think a disgruntled visitor ratted on you? Or a large swathe automated scan? Or your toaster oven?

much appreciated and thank you! xox

Thank you!

Yes...thank you Alex!

Oh you're all most welcome.
I took the opportunity to lock down the other forums I have as well.

I upgraded this forum to the latest version (which messes with template mods of course) in a hope that the exploit is closed. But if they still manage to brute force an account it wont matter as the entire admin directory is now locked down above the data level so they shouldnt get anywhere.

Quote:

---

Originally Posted by Annihilatrix

Thanks for all your work, Alex. What a PITA! You're amazing and we're lucky that you provide the space/time for this doomtique. Also, it's a heads up for other server admins out here, I think I will be reviewing some firewall settings.

So, do you really think a disgruntled visitor ratted on you? Or a large swathe automated scan? Or your toaster oven?

---

Eh, I dont know. There are few online 'personalities' that chap my ass everytime they have a server issue and blame it on NSA, DOD, CIA and/or turkish hackers. :-P
UntilI I had absolute proof that someone fed the url to a database, I wouldnt suggest it to be fact.

I do find it odd though. Odd indeed.

Well, if you think about not just individuals having wordcloud tracking but entire forums -- kinda makes sense this place would be a target.

actually thats the odd part.
There is no word cloud on this forum because ALL the thread text is behind logins.

No crawlers from google, nor tagging... no FB connections.

Doesnt mean it could just be a random target, but the keyword theory only works if you have public content :P

Make's ya wonder huh?

Oh, them Turks...

It does make me wonder, as well.
So.

Log-ins = Schmog-ins???

Quote:

---

Originally Posted by NYLongbow

actually thats the odd part.
There is no word cloud on this forum because ALL the thread text is behind logins.

No crawlers from google, nor tagging... no FB connections.

Doesnt mean it could just be a random target, but the keyword theory only works if you have public content :P

Make's ya wonder huh?

---

Too many smarties here, Alex, face it, you're on the target list. Cool!

Quote:

---

Originally Posted by Doomsteader

Thanks, Alex, for all you do and put up with to make this forum available to us. I was getting Silco withdrawal symptoms after just a few hours without this forum!

---

Double Ditto on the thanks. Sad but true on the withdrawal.

Thank you!!!

Sending a mental cruise missile their way! Thanks, Alex.

Draftlady

I haven't a clue what it means to 'feed the url', nor why Turks would mess here in particular. Weird. Glad you're back on track.

wow.. have been reading the horror stories that some of these poor bastards have gone through.
Looks like more than a few are just giving up and starting completely AGAIN...
wow.

Hopefully the above-the-data-locks I have in place will be sufficient.

Quote:

---

Originally Posted by NYLongbow

actually thats the odd part.
There is no word cloud on this forum because ALL the thread text is behind logins.

No crawlers from google, nor tagging... no FB connections.

Doesnt mean it could just be a random target, but the keyword theory only works if you have public content :P

Make's ya wonder huh?

---

woah... so they just hacked a random forum they knew nothing about WHAT the forum discusses? so it was completely random?

i don't understand this stuff but KNOW you are very security conscious. So it was a roulette wheel attack? just our turn?

Thank you for all your time and effort, Alex. Odds are it was either a random attack or the work of a mole. Does anyone know if it has been happening to other forums that see through the BS?

OR someone who visits here 'helped' it happen?

Thanks Alex.... as I noted in the original thread... three hours without access and I needed two coffees! :)

Nice reminder how dependent we are on online information - and how much of the stuff I want access to at a later date is still only bookmarks, not downloaded. I think my Christmas holidays ( I get around 6 weeks) will be spent with a 1Tb hard drive and some downloading will go on...yes, the DoomerDrive will happen!

Well, my BIL is a Turk, but I'm pretty sure he didn't do it. They are flying out tomorrow back to turkey for a month.
I'll have him put the evil eye out...
Nice to have this back up, thanks!!!

Back to normal. That was probably the most unexpected thing that could have happened this morning when I started my computer. Thanks for getting things back. I suspect it was random since the page was just defaced and nothing terribly malicious done. The pic and music seemed more playful and lulz oriented than anything with an agenda.

Thanks Alex, the hacking thing is "Greek" to me.

Thanx Alex for all your work! The life of a SysAdmin is one that never rests!

I missed my visits but I did get a lot done. Maybe it's a sign. Thanks for the hard work.

Thanks Alex. We are so lucky to have you.

Thanks but it's just my role in our little tribe of doomers.

It appears as if the safeguards I put in place above the data have held. I see numerous attempts in the logs last night to get by them and nothing got through.
I feel sorry for the poor bastards that got hit harder. Many of them had to basically throw it all out and start again.
Cant imagine.

Anyway... not willing to call mission accomplished yet but first 24 hours was successful.

Thanks for a timely up and re-running of SilCo Alex. And thankful the damage was minimal.

Thanks for your hard and skilled work, Alex. It means a lot to have a place like this to discuss what we do.

As for the word cloud--isn't the Susco section visible without a login? Therefore there'd be a word cloud there, right?

I'm wondering if somehow "Syria" or "Turkey" came up in a discussion on the Susco section, and they found this site when they used one of those search terms? "Let's see who is talking about stuff we care about and then screw with one of them!"

Nope.. the ONLY section open to the public is Site News.. and even then, only the thread listing page. You cant see into any of the threads at all without loggin in.

Then when we see "guests" online they're looking at the thread listing page? 'cause there's 8 guests online now, and I hope they're not up to no good!

Thanks for all your efforts Alex. Much appreciated.

@Changer. Only 2 coffees? I'm way ahead of you LOL.

I didn't get any music when I saw the hack. Where was my music?

Quote:

---

Originally Posted by houseoftang

Then when we see "guests" online they're looking at the thread listing page? 'cause there's 8 guests online now, and I hope they're not up to no good!

---

A lot of times they are spiders trying to get to subpages but they just get the login screen. Technically it will show them online if they are looking at the "you must login to see this page" message.

Aussie-- I didn't get any music either (viewed w/Firefox). I looked at the source code and the image was supposed to shake on mouseover (didn't for me).

Seems like it would be easy enough for hackers to find forums employing VBulletin just using Google a la https://www.google.com/search?q=vbul...-US%3Aofficial --as most sites will place a link to whatever software they use in the page footer.

Quote:

---

Originally Posted by Annihilatrix

Aussie-- I didn't get any music either (viewed w/Firefox). I looked at the source code and the image was supposed to shake on mouseover (didn't for me).

Seems like it would be easy enough for hackers to find forums employing VBulletin just using Google a la https://www.google.com/search?q=vbul...-US%3Aofficial --as most sites will place a link to whatever software they use in the page footer.

---

It's a license requirement to have the footer VB tag.
I know I know... but most forum apps require it.

Quote:

---

just my role in our little tribe of doomers

---

You fulfill your role very well, and without you, none of the rest of us could be a part of this tribe. Thank you.

One thing that does seem to be new is that I make a reply and lose it when getting the message that I must log in. But I have logged in. Frustrating.

Quote:

---

Originally Posted by graveday

One thing that does seem to be new is that I make a reply and lose it when getting the message that I must log in. But I have logged in. Frustrating.

---

The next time you login, make sure the "remember me" box right below the password is checked. This will stop it from timing out every so often and always remember you.

The link to a youtube video was in the page source but included nothing to 'make it play'.

The video linked was this(uploaded 2 years ago):

http://www.youtube.com/watch?v=apIr93Cq5NA

Thanks for fixing the forum and keeping it safe, Alex. It's much appreciated :)

Quote:

---

Originally Posted by NYLongbow

The next time you login, make sure the "remember me" box right below the password is checked. This will stop it from timing out every so often and always remember you.

---

Will do, thanks.

Weird stuff, I am especially intrigued by the Turkey locale, cuz, I mean, Turkey?! being ticked off at what we post here? Really? I'm not here much, but I do appreciate the place.

TY Admins.

According to Benjamin Fulford, Turkey is one of the 8 countries still under the control of the dark cabal(or is it 12? will have to double check) View it as simply another outsourced job.

Quote:

---

Originally Posted by NYLongbow

Yes, it's true. Apparently some turkish hackers group (confirmed via their routed IPs - both in turkey) found an Vbulletin Exploit (the forum software) and was able to wreak havoc on my day.


They were NOT able to penetrate the server itself, but rather the entire exploit was using the tools provided through the forum software.


So, i was on the road today and have only now been able to deal with this.


But first I had to get my account re-established. And then the laborious procedure of redoing all my template mods.


I have take further actions at the router level to restrict access to the admin sections to my specific IP only now. And since I am certain they didn't penetrate there server I believe this will end their ability to do much here.


But with things like this you have to wait for the hole to be exploited usually so you can see it and plug it up.


Extra hard when you didn't write the forum code yourself. Cleaning up someone else's mess is always 10x as hard.


Hopefully we won't be seeing them again.


Alex

(ps... now I want to know who turned some turkish hackers onto my forums :mad: )

---

I really hope it was random, Alex, and not some asshole. You'd have to be pissed and a bit of a geek to know how to pass this shit on, right?