We're back - unexpected forums outage

[Janet H]

An exploit in our software was taken advantage of by some hackers who linked to a malicious site. It appears there was a little over 4 hours between the time it happened and the time we took the servers offline Thursday.

In an effort to minimize damage to the board we opted to shut everything down while we investigated the issue and formulated a game plan. Our team (server admins, programmers, and software vendors) coordinated and developed a plan to remove the malicious files and secure the servers. We believe that forum members should not have any system issues associated with this so long they didn't visit the malicious site AND install anything.

While the service interruption was unfortunate, it was important to us to make sure this issue was fully addressed before returning to business as usual. Protecting our community from this kind of intrusion is paramount and we'll post more info here as it becomes available. It's possible that we may need to continue tweak the forum setup and if so, we may have another service interruption.

We thank you for understanding

[wolverine]

Congratulations on your quick response in dealing with this problem. Tried to log on earlier this evening and got your message on the alternate page of what had happened. We're glad you caught it in time before further problems were created. Thanks.

[nti06]

This begs the question:

If a hacker is clubbed in the forest, will anybody care?

[rashton]

club away!! no I don't care!

[2airishuman]

and for now were back!

good job!

from scanning the issue...

apparently this has been happening to social network sites for several weeks...

and especially to communities using vbulletin, specifically IF using the search engine optimizer ???

looks like we are at version 3.3.0

and 3.3.2 was released recently to deal with some of these issues and venerability?

i have very little understanding of this but wonder if THIS thread is relevant???

vBSEO Security Bulletin - vBSEO 3.3.2 Released - vBulletin SEO Forums

and i found this quote on another forum related to the issue yesterday...

""One of the most popular plugins that tons of forums run (VBSEO) has been compromised, and many forums will be having errors about Centiyo, such as "Visiting This Site May Harm Your Computer". It's caused by VBSEO.

Disable, then update VBSEO. Then if you're a webmaster, go into your Vbulletin templates and remove any code about it from the HEADER part of your template, on ALL styles. Search your templates for "Centiyo".""


cheers
2air'

[Frank's Trailer Works]

Stupid question... what is a "malicious site"?

[65CV]

... and a followup to Frank's question:

What effect, if any, did the security breach have on members who accessed the site during the time the malicious code was in place? Any links?

I read the thread provided by 2air, but it was aimed at board admins, not users. Hopefully that's the only compromise.

[LI Pets]

Hey guys I run several forums with vBseo, they sent a notice out around Oct 27.

I guess you missed it!

I assume you do daily backups correct

[Gene]

Thanks for acting quickly. This stuff goes on all the time across the internet

My knowledge of this stuff is purposely minimal. but I think a malicious site would be one that downloads a program or application on your computer to get personal and/or financial info and exploit it. It enables them to take over your computer remotely. It is similar in intent to those phony e-mails that claim your bank needs to update your personal info. Very few people take the bait on those e-mails,k but the cost to the bad guy is so low, it's a money maker. I think a malicious site would be more technically complicated and more of a challenge for the bad guy techie, but could pay off pretty well because you may not know it's happening. Another kind use if they can take oivere your computer is to link many computers to send spam using your address book, or to spread the malicious program thru using your address book. Some bad guys use this to spread just do it for their version of fun to take down websites, screw up computers and cause general havoc.

Gene

[dieseleagle]

A hearty thank-you to the forum administrators. I'm sure it involved a lot of work in a stressful circumstance.

[Wayne&Sam]

Yup, thanks folks. It's good to have the forum back.

[Jim & Susan]

Originally Posted by nti06

This begs the question:

If a hacker is clubbed in the forest, will anybody care?

A large caliber device would be more efficient.

Good job Andy, Janet, et al. Thanks for getting us back on line quickly.

Jim

[Lily&Me]

Good job! Comforting to know you're on it when these kinds of things happen.

[richinny]

bravo to the staff. i did get to bed early last night due to the outage, lol.

[john hd]

good job guys!

we got hit with "backdoor.bot" over at that site i admin for antique harleys.

the hackers inserted the malicious code in our photo gallery, specifically in the icons we use to run the board.

it took almost 3 weeks to get rid of it because the bug would not run all of the time so alot of scans missed it.

i wish the people who write this stuff could be tied out on a virtual ant hill.

john

[Beginner]

You guys are Wizards.

[sd90mac]

Sooooo, How many of our fine posters had withdrawl issues last night?

Thanks, Andy and staff, for your quick responce.

Marie

[Minno]

Not only thank-you for finding and fixing the issue, but also for the alternate web page that came up and let all of us know what was going on.

Chris

[RangerJay]

The response to this was pretty impressive.

It also validates the need for a good security program in our own PC's - we dropped Norton some time ago in favour of the one that our ISP offered as part of the package - but we have always wondered if this was a wise decision. Seems as though the ISP package came through - the issue was picked up instantly with clear direction on "disinfecting" the computer. Problem solved.


Jay

[eleighj]

Originally Posted by nti06

This begs the question:

If a hacker is clubbed in the forest, will anybody care?

Who cares!