12-22-2004, 12:16 AM
All right, I'm pissed. Whoever the stupid son of a bitch is that did this better hope I don't find out who they are, because if I do, I'm going to prosecute them to the full extent of the law.
Although I don't know who did it, I have some suspicions. This attack came just a few days after Mark Hall posted a message on my forum warning me to upgrade my version of PHPBB because of the security exploit in version 2.06. I took this message seriously, but it came at a very busy time (finals), so I decided to put off upgrading for a few weeks. Unfortunately, I assume that this posting actually inspired some asshole to go out and figure out how to hack my site -- it's not very hard at all. (I searched "PHPBB exploit" in Google and came up with instructions on how to hack into someone's server within the first ten results.) Anyway, in the past few weeks, there have been a bunch of Nazi types posting on my forum... "Skinhead", some guy with "SS" in his name, someone that always posted "Oi!" at the beginning of every message... I'm not sure if he/they (might be the same person) had anything to do with it, but I wouldn't be at all surprised if it turned out to be him/them. (They just seem to be the right demographic of lamers that would destroy a site for fun.) Otherwise, it could have been anyone that visited the board. At any rate, I'm betting that it's probably not some random person that had never been to my site before. If anyone knows what I can do to track down this person, let me know.
As far as the damage goes, luckily it's looking like I'll be able to recover most of the old content from my backup. The worm program that hacked my server went through every directory and replaced all .html, .htm, .shtml, .xml and .php files with the "This site has been defaced" HTML page. It's a 270 byte file.
Luckily, the worm didn't delete any other files/directories or mess with anything but the html and php files on the server. That means that all .txt, .zip, images and anything else are still intact. Had the .zip, .cgi and .txt files been messed with, I would have lost quite a bit of irreplaceable content that I didn't have backed up -- everything that people have submitted since August, as well as all the old news archives. Thankfully, that stuff wasn't touched.
What I'm most worried about right now are the archives of the forum. Hopefully I haven't lost anything from that database. I'll look into that soon.
Thanks to everyone who posted support since this happened. I'm kind of reluctant to restore my site after this. I put hundreds of hours of work into that site and then some asshole motherfucker goes and destroys it for some kind of sick pleasure. For now, I'm going to try to replace the site...but if this ever happens again, that will be the end of both QB Express and Pete's QB Site. I have better things to do than deal with this bullshit. What a fucking pain in the ass.
Although I don't know who did it, I have some suspicions. This attack came just a few days after Mark Hall posted a message on my forum warning me to upgrade my version of PHPBB because of the security exploit in version 2.06. I took this message seriously, but it came at a very busy time (finals), so I decided to put off upgrading for a few weeks. Unfortunately, I assume that this posting actually inspired some asshole to go out and figure out how to hack my site -- it's not very hard at all. (I searched "PHPBB exploit" in Google and came up with instructions on how to hack into someone's server within the first ten results.) Anyway, in the past few weeks, there have been a bunch of Nazi types posting on my forum... "Skinhead", some guy with "SS" in his name, someone that always posted "Oi!" at the beginning of every message... I'm not sure if he/they (might be the same person) had anything to do with it, but I wouldn't be at all surprised if it turned out to be him/them. (They just seem to be the right demographic of lamers that would destroy a site for fun.) Otherwise, it could have been anyone that visited the board. At any rate, I'm betting that it's probably not some random person that had never been to my site before. If anyone knows what I can do to track down this person, let me know.
As far as the damage goes, luckily it's looking like I'll be able to recover most of the old content from my backup. The worm program that hacked my server went through every directory and replaced all .html, .htm, .shtml, .xml and .php files with the "This site has been defaced" HTML page. It's a 270 byte file.
Luckily, the worm didn't delete any other files/directories or mess with anything but the html and php files on the server. That means that all .txt, .zip, images and anything else are still intact. Had the .zip, .cgi and .txt files been messed with, I would have lost quite a bit of irreplaceable content that I didn't have backed up -- everything that people have submitted since August, as well as all the old news archives. Thankfully, that stuff wasn't touched.
What I'm most worried about right now are the archives of the forum. Hopefully I haven't lost anything from that database. I'll look into that soon.
Thanks to everyone who posted support since this happened. I'm kind of reluctant to restore my site after this. I put hundreds of hours of work into that site and then some asshole motherfucker goes and destroys it for some kind of sick pleasure. For now, I'm going to try to replace the site...but if this ever happens again, that will be the end of both QB Express and Pete's QB Site. I have better things to do than deal with this bullshit. What a fucking pain in the ass.
Pete's QB Site: http://www.petesqbsite.com