• Hey Guest!
    British Car Forum has been supporting enthusiasts for over 25 years by providing a great place to share our love for British cars. You can support our efforts by upgrading your membership for less than the dues of most car clubs. There are some perks with a member upgrade!
    **Upgrade Now**
    (PS: Upgraded members don't see this banner, nor will you see the Google ads that appear on the site.)

Dodged a bullet!

Share this page

Basil

Basil

Administrator
Staff member
Boss
Offline
<span style="color: #CC0000"><span style='font-size: 17pt'>Blank-ity blank hackers!</span> </span> Boy were we lucky tonight (this morning). I have my server setup to email me anytime there are ANY files with executable code uploaded to my server. Usually when I get these emails it just because a member hosting their web site on my server may have uploaded some script file, like a mail form, etc. But this time, it said a file had been uploaded to the images directory in the Knowledge Base program here. The file name was .php (which since it starts with a . means it is a hidden file when the directory is viewed with a standard UNIX ls command with no options.

Anyway, luckily I happened to be sitting here when it was uploaded and I received the warning email, so I immediatly logged into my server and looked at the file with a text editor - it was clear that it was an exploit (backdoor) designed to give the bad guy access to the server. Well, I deleted the file before he could do anything and then I looked in my secure log files and found the IP address that had uploaded the file. I traced the IP to Russia. So, I added the entire BLOCK of IPs from that place to my firewall. Then I did a Google search and learned that I had an older version of the Knowledge Base which had a known security vulnerability in one of the script files, so I have now also upgraded to the latest version which fixers that security flaw.

Boy, staying ahead of the hackers can be a full time job!

Basil
 
Thanks so much for all the work you do in keeping BCF up. We certainly appreciate it, even if the Russian hackers don't.
 
5695hb2.gif
 
...and Basil: Email me that block of IP addy's, PLEASE?!?! /bcforum/images/%%GRAEMLIN_URL%%/laugh.gif
 
DrEntropy said:
...and Basil: Email me that block of IP addy's, PLEASE?!?! /bcforum/images/%%GRAEMLIN_URL%%/laugh.gif
Click to expand...

91.122.0.0/16

There ya go!
 
Nice work, Boss. When I first started in the web business, I was amazed at the requency of attacks, even against our relatively small-town school web server here. Now, it's just a part of doing business.
 
I had no idea how pervasive it was either until I started with my own dedicated server.
 
Basil said:
I had no idea how pervasive it was either until I started with my own dedicated server.
Click to expand...

Same here. I got hit dozens of times a day. They've managed to get a few things into my website a time or two, but I've put an end to that.
 
<div class="ubbcode-block"><div class="ubbcode-header">Quote:] had no idea how pervasive it was either until I started with my own dedicated server.[/QUOTE]

One of the reasons I've stayed with a shared server so long - though there are things I can do on it that sometimes make me think I've got it all to myself.
 
tony barnhill said:
<div class="ubbcode-block"><div class="ubbcode-header">Quote:] had no idea how pervasive it was either until I started with my own dedicated server.
Click to expand...

One of the reasons I've stayed with a shared server so long - though there are things I can do on it that sometimes make me think I've got it all to myself. [/QUOTE]

I was on a shared server that time we were hacked and it took 36 hours to fix. Dedicated server is MUCH better if you have a good management behind it because you have total control.
 
AMEN!!!
 
You have th' same info I do....

No way to "thump" 'em but just for GP:

<<<91.122.0.0/16 (Reverse lookup failed)>>>


GRRRR!!!!
 
You have th' same info I do....

No way to "thump" 'em but just for GP:

<<<91.122.0.0/16 (Reverse lookup failed)>>>


GRRRR!!!!


nmap result with no switches:

[root@Badger root]# nmap 91.122.0.0/16

Starting nmap V. 3.00 ( https://www.insecure.org/nmap/ )
Interesting ports on ppp91-122-0-6.pppoe.avangard-dsl.ru (91.122.0.6):
(The 1591 ports scanned but not shown below are in state: closed)
Port State Service
80/tcp open http
135/tcp filtered loc-srv
136/tcp filtered profile
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
990/tcp open ftps
1720/tcp filtered H.323/Q.931

Interesting ports on ppp91-122-0-16.pppoe.avangard-dsl.ru (91.122.0.16):
(The 1594 ports scanned but not shown below are in state: closed)
Port State Service
135/tcp filtered loc-srv
136/tcp filtered profile
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
1720/tcp filtered H.323/Q.931

caught SIGINT signal, cleaning up


RUSSIAN IP!
 
..at least he knows he's been tapped now.

/bcforum/images/%%GRAEMLIN_URL%%/devilgrin.gif
 
DrEntropy said:
You have th' same info I do....

No way to "thump" 'em but just for GP:

<<<91.122.0.0/16 (Reverse lookup failed)>>>


GRRRR!!!!
Click to expand...

That wasn't the specific IP, the specific IP did not have 0.0 on the end. The actual address was 91.122.14.23 BUT, by adding 91.122.0.0/16 to my firewall ANY IP that begins with 91.122 is blocked.
 
Back
Top