Need advice?

GamersGFX · 09-27-2008, 07:14 AM

I recently had 2 of my VB sites hacked

I done all the security checks (How To Make My Forums More Secure), and working in the industry full time (as a designer not a developer) all my sites are very secure

So basicly I had a parse error on the index of my sites and on my forums, so I commented out the following line in my global.php where the error was pointing to:

eval('$spacer_open = "' . fetch_template('spacer_open') . '";');
eval('$spacer_close = "' . fetch_template('spacer_close') . '";');

and I get the following at the top of the site:

ViRuSMaN Ow3nd Your SiTe .. v.-m@hotmail.com

Immediatley I have taken the sites down, but it baffles me how he got in as I looked within the databases and done a search for the above and it is only located in the template table (on both custom and default templates).

So my question is would this be a server problem (ie. with the host bad security)? Or is there something I am overlooking here? As I have all the upto date patches admin/mod cp are secure, I am the only Superadmin on the board and password is pretty tight (changed every month). I do want to restore the database because I have alot of posts and alot of members so any advice anyone can give would be more than greatfull?

Btw. I did try on vB support but they said its either me not securing it prop or the host.. but knowing how they got in the first place would realy strenghten my argument with the host..
And also on 1 of the sites there is no mods installed!

Thanks in advance

**Soliloquy** · 09-27-2008, 07:50 AM

wrong window, please delete

**glennybee** · 09-27-2008, 07:50 AM

Most of the times hackers just want to let you know they can hack into your site and not actually cause any harm. Try replacing your index.php file from a backup if you have one or download it again from the members area of vb.com.

**Soliloquy** · 09-27-2008, 07:57 AM

gack, how did that get in this thread? Sorry, I must have been typing in the wrong window. Just delete, I'll move it myself...

and I agree with glenny, often these guys just indiscriminately hack any and all forums so they can say "I hacked 110,000 forums today!" It's unlikely he'll be back unless he actually has a grudge against you.

**glennybee** · 09-27-2008, 07:58 AM

If you get in quick Soliloquy you can delete it yourself, advanced edit option.

GamersGFX · 09-27-2008, 08:04 AM

What would you suggest regarding restoring my database (obviously taking out the template edits which he has done)?

If he does come back what should I do?

Thanks for your quick replies btw

**Soliloquy** · 09-27-2008, 08:05 AM

guess I missed it glenny, didn't see any option to delete on the advanced edit screen.

**Cerberus** · 09-27-2008, 08:10 AM

I would secure the admin panel with a password. And I would also change all passwords. But before doing so I would run a virus scan on your computer. Maybe even change passwords from a different computer. Most of these people use software to get it by just going to your admin panel and getting in that way. I would secure everything and change passwords.

**Soliloquy** · 09-27-2008, 08:21 AM

also did you change the name of your admin directory? Maybe change it again for good measure.

**Cerberus** · 09-27-2008, 08:24 AM

Yeah I have mine changed and then htaccess password protected. And the password is generated so I have no idea what it is. I was using a script before to secure where the password changed everytime. You used a generated key to put in box and then box would spit out password for that session. But I lost the script. So just normal password now. Plus that was kind of overkill. But always changed admin folder mod folder too. I mean might as well be safe. Though you cant password protect both. If you pass protect mod panel you break features in the admin panel. I found that out LOL

**Soliloquy** · 09-27-2008, 08:32 AM

wow Blake, that sounds like some heavy-duty security...

GamersGFX · 09-28-2008, 03:23 AM

thanks for you replies guys I have the site back online now. I think it was a prob with my host as after I spoke to them 10mins later the site was a ok.. strange huh?

Not trying to make myself look like a novice here or anything, but changing the admin folder for eg to "myvbadminfolder" do I need to mod any other files so that it recognises where it is etc..

**valdet** · 09-28-2008, 04:59 AM

You need to make the change in config.php file too so it reflects the changes to admincp and modcp folder names.

**Soliloquy** · 09-28-2008, 05:52 AM

glad your host got everything working again GamersGFX

GamersGFX · 09-28-2008, 06:21 AM

@valdet
Thanks for the heads up got that sorted now, thats a good little securty feature which I must of overlooked.

@Soliloquy
Thanks I might be wrong they maynot have done anything but it just seems strange that it worked 10mins after the support ticket went in :P

Thanks for the advice all..