Our website has been hacked...

Hey. This is Ian from www.watermanstudios.com.

Waterman is an online flash cartoon which has been around for a while now. But recently, it seems hackers have gotten into the website. At first, it was brazilian hackers who came in and defaced the main page, and deleted the content pages. Now however, they have damaged our administration over the blog, and have posted 99 comments flaming waterman. We have no idea why we were attacked, and I would like to know if there would be any way to either STOP them, or report them for this.... we're thinking of overhauling the website, as there is a lot of old php sitting around... any suggestions on what to do?

If you've been hacked...and if you know who hacked you...and it sounds like you do...report them to their ISP and the local police agency that investigates internet crimes. And if your website is old as you say...it would be wise to update it and fill those holes that let hackers in.

I'm sure other people here could help you more than me...but that's the best advice I can give at this point.

Could you post us some information about the services your running ?

If your running prebundled software (phpnuke/bb/etc) and not keeping it up to date, then your as good as dead.

If you've coded the website yourself, perhaps a security check of the code you used ? if its in php, then theres some GREAT tutorials on how to fix php security flaws

Also, it COULD just be because your server was hacked, and as a result, they got access to your website. In that case, there was nothing you could do

Quote:

---

Originally posted here by SuburbanNinja
(...) We have no idea why we were attacked (...)

---

Probably just because someone found a way. Most hacks don't have an explisit reason to hack any one particular site - they try to hack a site to leave a mark, just to show off. If you're interested in motivation: there is an old (but still valid) paper by JP (founder of AntiOnline) that goes in depth of the motivations of hackers. I'm unable to find it right now. Link, someone?

Quote:

---

Originally posted here by SuburbanNinja
(...) I would like to know if there would be any way to either STOP them (...)

---

There's not just one good advice that someone can give you, other than check the code you use. Check your own code and third party code for vulnerabilities. I'm not very familiar with Movable Type, but you seem to be running an older version (3.121) when a newer version (3.15) is available. That version is a bugfix release. I'm not sure what bugs though. You might find other products you use out of date as well. Start securing your site by updating those packages.

<edit>I found that link I mentioned. It's here</edit>

A quick glance at the Movable Type homepage shows that version 3.14 fixes some spamrelated issues, something that seems to be part of your problem as well. Might be worth to look into.

Okay...well thing is, I wouldn't be having so much trouble, but there have been many webmasters in the past... messy ones. The first thing that got hacked were the message boards, which are invision power board.. and then they continued to delete/deface etc.. but it seems as if they haven't gone outside of the public html folder. Is it possible that his webmail etc that is outside of that folder are safe? Again, sorry for not giving too much information.. and thanks a lot for the help so far.

Quote:

---

Originally posted here by SuburbanNinja
At first, it was brazilian hackers who came in and defaced the main page, and deleted the content pages.

---

By any chance, were the Brazilian hackers part of Data Chaos?


PuRe

Ahm.. not sure about that, didn't write down their manifesto. But it seems that they are claiming this guy who used to post on the forums as responsable.. but it seems really obvious and I'm thinking it might be a frameup. Also, those links in the comment spam link to other flash toon sites... it's really hard to tell what's going on. But.. say they got in through the forums... what would I have to do to replace the damage? I trashed the forums, and just replaced them with Phpbb2..

Ninja:

Looking at this thread I have to say that you don't have an "approach" to this situation do you?

Determining what happened, when, where and how is called computer forensics. Like forensics in the real world it is a very disciplined science. In fact, it is a more disciplined science than traditional forensics because the legal "specifications" have not been determined and, more importantly, by the nature of current operating systems, the slightest action or lack of pre-planning, can reduce your chance of finding out those details impossible.

It seems to me that in this situation there was no pre-planning leaving you with no, or limited, log files.... There may have been no policy to update the software in a timely fashion and, certainly, no effort to preserve any evidence that might help you determine what happened.

While you seem to 'feel' that nothing occured outside the public folder you have no idea of that really. The painful truth is that the box needs to be brought down, formatted and recreated from trusted media.

That's the truth of the situation..... As an aside.... that might be relevant to you deciding what really happened I will say the following.....

You claim that the start of the problems was the Brazilians.... Hardly a stretch, they get into everything.... However, since in some way, you seem to have had some kind of contact with them where they are claiming it was someone "who used to post" is beyond belief.... The person who cracked your site is someone who posted to your site and was pissed about something. When they exploited it they used copied defacements to place the blame somewhere else _or_ the brazilians did the original deed and this user found and exploited their back door. The person who is "claiming" that it's another user is most probably the attacker....

Since you clearly have a situation that is now beyond your control my advice above stands.... Failing that, get another host for your site.

Quote:

---

But it seems that they are claiming this guy who used to post on the forums as responsable..

---

Originally posted by SuburbanNinja

Quote:

---

You claim that the start of the problems was the Brazilians.... Hardly a stretch, they get into everything.... However, since in some way, you seem to have had some kind of contact with them where they are claiming it was someone "who used to post" is beyond belief.... The person who cracked your site is someone who posted to your site and was pissed about something.

---

Originally posted by Tiger Shark

Ok, let's do a bit of elementary checking based on the typical forums.

1. To post to a forum, you have to register - at the very least name and email address.

2. Usually the forum verifies the email address by sending a link to it - given you've stated that your site has had several webmasters, some quite messy, we'll assume yours didn't so that's out.

3. You have their IP address.

Ok, let's add all that together - you have an IP which by using a whois will tell you what ISP the guy's using (unless he's in a proxy, which somehow I doubt he did each and every time he posted to your forum), you have his 'handle' from your forum, and with it somewhere in your logs a copy of each IP address he used, you may or may not have a good name and email address for him (assuming that he didn't intend to hack your site when he first registered, at least one of these is probably correct info).

Nail his Ass to the wall! Contact his ISP, tell them what he's done and how you found him.

Hope that helped.

Well.. Thank you for your help. As to your comment about not having logs etc... the problem here was that I was just tossed in to try and fix the website after it was hacked, since the last webmaster seems to have jumped ship. I was just asking if you knew about any probable exploits that they may have used and their limitations. And yes, it was brazilians. I've seen their work before ;)

So thanks guys. I don't have to worry about the site anymore, I think waterman's getting one of his old webmasters to clean up his sloppy php mess :P

You still may want to make sure it wasnt the server itself that was exploited, rather then the webpage. That webpage could be as secure as you want but if you have a gaping hole in your OS they can walk right in and do as they please.

Hi Ninja,
sounds like many of our heavy hitters have weighed in on this for you, but I have one point to mention. I haven't been able to tell with my quick reading of this thread, but it sounds like waterman is hosting with a service...is he on a shared/managed hosting option, or does he own the server and have responsibility for admin? If its the latter, I would definitely consider moving it to a shared service. There are quite a few good ones, and it's a competitive industry so you can usually find decent pricing.
If he is paying for hosting, he (you?) should be actively working with the hosting company on this as well.
Just my $0.02. Best of luck.

I am thinking from reading this thread it is a disgruntled poster. They could so easily BS you into thinking they are some "1337" group from Brazil, and maybe so, but there are some things to check:

Canned (or custom) scripts paid or not can have exploits, and CGI vulnerabilities, SQL injections, cross site scripting exploits are common. I am suspecting the sploit came from either a known exploit in your software I see you are using Movable Type 3.121 the newest is 3.15. It clearly says it is a bug fix release. Perhaps getting the update would have helped. Or poor file permissions.

Here is an article on CGI vulnerabilities: http://www.net-security.org/article.php?id=91

Quote:

---

Naturally, malicious CGI's exist, and can be set up, but I will not disscuss them, instead I will focus on the damage that can be done via your CGI's on your own host, not on the user surfing your web.

In order for an attacker to find an vulnerable CGI, all he has to do is to connect to port 80 and repeatedly send a GET request to CGI's on the server or suspecting they are on the server. Simply by checking your logs for repeated GET requests from a single remote host resulting in a 404, the 'file not found' error can give you an idea that something wicked is going on. As time passes, that same attacker may come up with an unsecure CGI on your system. If that is the case, he'll most probably try to exploit the vulnerability.

---

and if you plan to use CGI:

Quote:

---

If you're planning on creating some CGI's of your own, bear in mind these few things: in perl and bash scripts, don't use the 'eval' statement used for creating strings which will be executed, be careful with popen() and system() calls, and turn off the server side includes. Also, don't leave any means for a client to manipulate with input of your scripts, don't rely on the fact that it will escape any special characters for they will be used by an attacker. It would be smart to check the 'suexec' documentation, for apache web server and use it on your server.

---

and further, the now defunct phrack has an article about CGI: http://www.phrack.org/phrack/49/P49-08

and is summarized in the following:

Quote:

---

2. Vulnerabilities

The vulnerabilities caused by the use of CGI scripts are not
weaknesses in CGI itself, but are weaknesses inherent in the HTTP
specification and in various system programs. CGI simply allows access to
those vulnerabilities. There are other ways to exploit the system security.
For example, insecure file permissions can be exploited using FTP or telnet.
CGI simply provides more opportunities to exploit these and other security
flaws.

The CGI specification provides opportunities to read files, acquire
shell access, and corrupt file systems on server machines and their attached
hosts. Means of gaining access include: exploiting assumptions of the
script, exploiting weaknesses in the server environment, and exploiting
weaknesses in other programs and system calls. The primary weakness in
CGI scripts is insufficient input validation.

---

Some of the best ways to see how things are exploited is to see what the kiddies are doing. Look around and see what canned exploits are out there and see if there is a work around. There are also advisories for known products such as

http://secunia.com/

I wish you the best of luck