FSO SEPTEMBER Frame 1 Logs Delayed

[ghostdancer]

Big thank you should go to spikes here. He has put in some very, very, very long hours (basically anytime he is not working) hunting things down and working on this whole issue. I don't think the boy has gotten any sleep in a couple of days now.

[HighGTrn]

Yep, they did two things:

1) They installed a mod_rewrite in the .htaccess file and then created additional .htaccess files in the various subdirectories (this causes anybody coming from Google, Bing, Yahoo, etc. search results to be redirect to the Russian site instead of getting to the events site).

2) Next they modified all the JavaScripts to write a hidden iframe on our pages which allows them to run a cross side scripting attack.


We have reinstalled the CMS from a clean backup and the database from a clean backup but it was reinfected (for lack of a better word) shortly after we did this. So basically we have been hunting down exploit / weakness / loop hole that they are using to get in and modify files. Once we track that down and close it up we should be good. Problem with this is just takes a bit of time to hunting down the issue and resolve it and then test to make sure it stays resolved.

Ghost, there are open source Web vulnerability scanners out there. It will make your work alot easier. Good luck and thanks for the hard work.

[blazer65]

Site is back up.  I just viewed the logs on the site, everything seems to be working fine.

[forHIM]

Site is open, but we are waiting to see if a re-infection happens.  It may go down at any time.  Spikes and I have cleaned up what we could, patched and secured a number of items.  There are a few more items to patch, but to do so would take the site offline for weeks as we update code for latest versions of the programs. 

Please use caution on the web site.  Until Chrome & Safari & Firefox drop the malware warning, be forewarned that it could still be a problem.  Once we see the site is clean for a day or so, we'll request a review by the search engines to remove the blacklist we are currently on.

[CAP1]

Site is open, but we are waiting to see if a re-infection happens.  It may go down at any time.  Spikes and I have cleaned up what we could, patched and secured a number of items.  There are a few more items to patch, but to do so would take the site offline for weeks as we update code for latest versions of the programs. 

Please use caution on the web site.  Until Chrome & Safari & Firefox drop the malware warning, be forewarned that it could still be a problem.  Once we see the site is clean for a day or so, we'll request a review by the search engines to remove the blacklist we are currently on.

 THANK YOU GUYS!!!!!!

 we know you all spent hours and hours of your valuable time getting this squared away for the community. 

[Devil 505]

Big thank you should go to spikes here. He has put in some very, very, very long hours (basically anytime he is not working) hunting things down and working on this whole issue. I don't think the boy has gotten any sleep in a couple of days now.

Indeed, Spikes has been busting his hump to get this all sorted out. We all owe him a big salute.

  Spikes.

[Wildcat1]

  spikes, great job

[tunnelrat]

spikes, great job

Seconded, Thirded, etc 

Thanks for spending your time for us!

[Big Rat]

Thanks for getting things back up

 
BigRat

[Stampf]

Well Done.

<S>

[perdue3]

Shouldnt have taken you that long Spikes, jeez.

[Bannor]

Outstanding work Spike and the gang! Much appreciated! 

[SIK1]

 
Spikes

For all of your hard work. 

I appreciate it, as I'm sure many others do too.

 

[ELD66]

Thanks Gent's.
 

[CAP1]

you guys are forgetting mrmidi, forhim, ghostdancer, and i think skuzzy too......and a couple others. they all worked their buttocks off. 

 you guys rock!!