Hacked today

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • kerrya
    Member
    • Mar 2008
    • 89
    • 4.2.X

    [Forum] Hacked today

    The day started off fine, but then half way thru I got a message when logging in about Google flagging my forum for serving up bad software.
    Long story short. It seems some process has embedded iframes tags in posts with links to bad sites. Google actually tells you some same posts and gives the actual iframe contents it found.

    Using myPHPadmin I find and review the posts in question, but I find no hint of the iframe tag at all.

    What am I missing...doing wrong?

    Any help appreciated.

    Kerry
  • Lynne
    Former vBulletin Support
    • Oct 2004
    • 26255

    #2
    The iframe code code be in a template or file and not in the specific post. Also, my guess would be is it base64 encoded, so don't search for the actual code, search for "base64".

    Please don't PM or VM me for support - I only help out in the threads.
    vBulletin Manual & vBulletin 4.0 Code Documentation (API)
    Want help modifying your vbulletin forum? Head on over to vbulletin.org
    If I post CSS and you don't know where it goes, throw it into the additional.css template.

    W3Schools <- awesome site for html/css help

    Comment

    • kerrya
      Member
      • Mar 2008
      • 89
      • 4.2.X

      #3
      my skills are not at that level. Is there somebody I can pay to help me with this? I'm in a jam

      Kerry

      Comment

      • Steve Machol
        Former Customer Support Manager
        • Jul 2000
        • 154488

        #4
        In many cases hackers have inserted their code into the templates to deface the site. If that is the case then you need to run this query on your database in phpmyadmin:

        DELETE FROM template
        WHERE template LIKE '%base64%'

        You can run queries in the SQL tab in phpMyAdmin, or to run queries from the Admin CP:

        Admin CP -> Maintenance -> Execute SQL Query -> Manual Query

        Then enter your query in the Manual Query box and click on 'Continue'.

        To run queries you first need to give yourself permission to run queries in the Admin CP. To do this, edit this section of config.php:

        $config['SpecialUsers']['canrunqueries'] = 'x';

        ...with x being your userid number, not username.
        Steve Machol, former vBulletin Customer Support Manager (and NOT retired!)
        Change CKEditor Colors to Match Style (for 4.1.4 and above)

        Steve Machol Photography


        Mankind is the only creature smart enough to know its own history, and dumb enough to ignore it.


        Comment

        • kerrya
          Member
          • Mar 2008
          • 89
          • 4.2.X

          #5
          I did that, but the confirmation I got was :

          DELETE FROM template
          WHERE template LIKE '%base64%'

          Affected Rows: 0 (0.5607s)

          Is there something else I should try?

          Kerry

          Comment

          • Trevor Hannant
            vBulletin Support
            • Aug 2002
            • 24325
            • 5.7.X

            #6
            I can't view your site to see where else this may be coming from - have you taken it down?
            Vote for:

            - Admin Settable Paid Subscription Reminder Timeframe (vB6)
            - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

            Comment

            • borbole
              Senior Member
              • Feb 2010
              • 3074
              • 4.0.0

              #7
              Can you search the whole database and see if it would report such code in other tables?

              Comment

              • kerrya
                Member
                • Mar 2008
                • 89
                • 4.2.X

                #8
                Yes. I thought I should, but I can restore.

                Kerry

                Comment

                • borbole
                  Senior Member
                  • Feb 2010
                  • 3074
                  • 4.0.0

                  #9
                  Can you please post the link to your forum?

                  Comment

                  • kerrya
                    Member
                    • Mar 2008
                    • 89
                    • 4.2.X

                    #10
                    Originally posted by borbole
                    Can you please post the link to your forum?

                    Comment

                    • Trevor Hannant
                      vBulletin Support
                      • Aug 2002
                      • 24325
                      • 5.7.X

                      #11
                      Check your header template
                      Vote for:

                      - Admin Settable Paid Subscription Reminder Timeframe (vB6)
                      - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

                      Comment

                      • kerrya
                        Member
                        • Mar 2008
                        • 89
                        • 4.2.X

                        #12
                        Originally posted by Trevor Hannant
                        Check your header template
                        I examined it in the admincp, and i see nothing unusual about it. Nothing with base 64 and nothing with iframe. But is this the best way of examining it?

                        Kerry

                        Comment

                        • Trevor Hannant
                          vBulletin Support
                          • Aug 2002
                          • 24325
                          • 5.7.X

                          #13
                          Please fill out a support ticket at:



                          Please include a complete description of the problem and be sure to include the login info to your Admin CP, phpMyAdmin and FTP in the 'Sensitive Data' field.
                          Vote for:

                          - Admin Settable Paid Subscription Reminder Timeframe (vB6)
                          - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

                          Comment

                          widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                          Working...