News About The Turkish Hack

[NYLongbow]

Yes, it's true. Apparently some turkish hackers group (confirmed via their routed IPs - both in turkey) found an Vbulletin Exploit (the forum software) and was able to wreak havoc on my day.


They were NOT able to penetrate the server itself, but rather the entire exploit was using the tools provided through the forum software.


So, i was on the road today and have only now been able to deal with this.


But first I had to get my account re-established. And then the laborious procedure of redoing all my template mods.


I have take further actions at the router level to restrict access to the admin sections to my specific IP only now. And since I am certain they didn't penetrate there server I believe this will end their ability to do much here.


But with things like this you have to wait for the hole to be exploited usually so you can see it and plug it up.


Extra hard when you didn't write the forum code yourself. Cleaning up someone else's mess is always 10x as hard.


Hopefully we won't be seeing them again.


Alex

(ps... now I want to know who turned some turkish hackers onto my forums )

[NYLongbow]

Oh yeah... absolutely no threads or data was lost. Just the few hours it took me to get to my machine to fix it.

[DoomNymph]

Thanks, darlin'. :*

[Doomsteader]

Thanks, Alex, for all you do and put up with to make this forum available to us. I was getting Silco withdrawal symptoms after just a few hours without this forum!

[Annihilatrix]

Thanks for all your work, Alex. What a PITA! You're amazing and we're lucky that you provide the space/time for this doomtique. Also, it's a heads up for other server admins out here, I think I will be reviewing some firewall settings.

So, do you really think a disgruntled visitor ratted on you? Or a large swathe automated scan? Or your toaster oven?

[♥RÉĎRËÅMÊR♥]

much appreciated and thank you! xox

[Jag Farlane]

Thank you!

[JohnLudi]

Yes...thank you Alex!

[NYLongbow]

Oh you're all most welcome.
I took the opportunity to lock down the other forums I have as well.

I upgraded this forum to the latest version (which messes with template mods of course) in a hope that the exploit is closed. But if they still manage to brute force an account it wont matter as the entire admin directory is now locked down above the data level so they shouldnt get anywhere.

Thanks for all your work, Alex. What a PITA! You're amazing and we're lucky that you provide the space/time for this doomtique. Also, it's a heads up for other server admins out here, I think I will be reviewing some firewall settings.

So, do you really think a disgruntled visitor ratted on you? Or a large swathe automated scan? Or your toaster oven?

Eh, I dont know. There are few online 'personalities' that chap my ass everytime they have a server issue and blame it on NSA, DOD, CIA and/or turkish hackers. :-P
UntilI I had absolute proof that someone fed the url to a database, I wouldnt suggest it to be fact.

I do find it odd though. Odd indeed.

[Annihilatrix]

Well, if you think about not just individuals having wordcloud tracking but entire forums -- kinda makes sense this place would be a target.

[NYLongbow]

actually thats the odd part.
There is no word cloud on this forum because ALL the thread text is behind logins.

No crawlers from google, nor tagging... no FB connections.

Doesnt mean it could just be a random target, but the keyword theory only works if you have public content :P

Make's ya wonder huh?

[GrievousBodilyHarm]

Oh, them Turks...

[Annihilatrix]

It does make me wonder, as well.
So.

Log-ins = Schmog-ins???

actually thats the odd part.
There is no word cloud on this forum because ALL the thread text is behind logins.

No crawlers from google, nor tagging... no FB connections.

Doesnt mean it could just be a random target, but the keyword theory only works if you have public content :P

Make's ya wonder huh?

[Annihilatrix]

Too many smarties here, Alex, face it, you're on the target list. Cool!

[tofu2u2]

Thanks, Alex, for all you do and put up with to make this forum available to us. I was getting Silco withdrawal symptoms after just a few hours without this forum!

Double Ditto on the thanks. Sad but true on the withdrawal.

[Arabi]

Thank you!!!

[Draftlady]

Sending a mental cruise missile their way! Thanks, Alex.

Draftlady

[graveday]

I haven't a clue what it means to 'feed the url', nor why Turks would mess here in particular. Weird. Glad you're back on track.

[NYLongbow]

wow.. have been reading the horror stories that some of these poor bastards have gone through.
Looks like more than a few are just giving up and starting completely AGAIN...
wow.

Hopefully the above-the-data-locks I have in place will be sufficient.

[♥RÉĎRËÅMÊR♥]

actually thats the odd part.
There is no word cloud on this forum because ALL the thread text is behind logins.

No crawlers from google, nor tagging... no FB connections.

Doesnt mean it could just be a random target, but the keyword theory only works if you have public content :P

Make's ya wonder huh?

woah... so they just hacked a random forum they knew nothing about WHAT the forum discusses? so it was completely random?

i don't understand this stuff but KNOW you are very security conscious. So it was a roulette wheel attack? just our turn?