Warning to FlashChat users - security hole

[MPDev]

GET /chat/inc/cmses/aedatingCMS.php?<exploit data>

Warning to users who use FlashChat - this script was just used to add an exploit script to my server.

[Paul M]

Please don't post full exploits where everyone can see them (and then go try them ....).

Anyone with Flashchat integrated with their VB should remove all the files from /chat/inc/cmses/ except the vbulletin##CMS.php file they are using (where ## is either 30, 35 or 36) as they are not used.

[PamelaE]

If you have already been 'hacked' into via this hole. Then do you need to do anything addtionally to resolve it ?

[Ascor]

thank you for information MPDev :)

[FLMom]

Please don't post full exploits where everyone can see them (and then go try them ....).

Anyone with Flashchat integrated with their VB should remove all the files from /chat/inc/cmses/ except the vbulletin##CMS.php file they are using (where ## is either 30, 35 or 36) as they are not used.


Thanks Paul for this! I removed all files but the 30, 35, and 36 because I just wasn't sure which one I needed :surprised:

[Ntfu2]

FLMom

which version of vBulletin do you use?

I'd assume 30 is for the 3.0.x series, 35 is for 3.5.x and 36 is for vBulletin 3.6

Hope that helps, and glad i dont have this anymore :D

[jw00dy]

Thanks for the heads up. I'm a nut about space, so these already didn't exist, but it's still great to know.

[bashy]

Cheers peeps...issues pre-resolved :)

[steven s]

Thanks Paul for this! I removed all files but the 30, 35, and 36 because I just wasn't sure which one I needed :surprised:
Look in your chat directory /inc/config.php

Line 55 in my file//your CMS system
'CMSsystem' => 'vbulletinXXCMS',// defaultCMS - default CMS, blank - stateless CMS

[Rebecca217]

Thanks for posting the fix, Paul. :)

Rebecca

[FLMom]

I am running 3.5.4, so now I know which ones to remove...didn't even think about those numbers meaning that..oops!

Thanks for the help everyone!

[MPDev]

The little buggers used the hole to install a shell script and an IRC relay service; they then went through my web directory and replaced all my index files with "you've been hacked" files. It took me a few hours to get everything off the server; but then they struck again via a security flaw in SiteBuilder - fortunately I caught that one live and stopped them before they could do anything.

You are only as secure as your weakest script; if you are like me and like to offer your users a variety of add-ons to your websites, then it makes sense you would want to keep up on any updates to those pieces. I was a version or two behind on FlashChat (update a mere few months ago).

[puertoblack2003]

is not only thru flashchat i don't even have that installed a new user subscribed to my forum and pluged this in the post look at this post here https://vborg.vbsupport.ru/showthread.php?t=125628 and look at the picture of what that user did but i beat him to the punch i was down for like 3 mins and back online

[Transverse Styles]

That's why I built www.flasherize.com, the chat can't be hacked.

[steven s]

That's why I built www.flasherize.com, the chat can't be hacked.
Don't jinx yourself.:surprised:

[Adramelech]

Please don't post full exploits where everyone can see them (and then go try them ....).

Anyone with Flashchat integrated with their VB should remove all the files from /chat/inc/cmses/ except the vbulletin##CMS.php file they are using (where ## is either 30, 35 or 36) as they are not used.

So let me get this right. I just deleted EVERY file inside the directory you specified EXCEPT vbulletin36cms.php due to I run vBulletin 3.6. So this will fix the hole in Flashchat so I don't get hacked? Thanks!

[gavinzac]

deleted this piece of crap after my site was hacked and all index pages replaced.

[b6gm6n]

Im gonna remove flashchat anyways now...

-b6

[GoTTi]

if you have high traffic, use IRC server. its much better and stable for high high high traffic forums.

i went from holding 100+ users in the flash chat and laggy as hell to 600+ users in the irc server smooth sailing.

[puertoblack2003]

hey guys it 's not only flash it's the topXstat hack too i was hacked as well and i was able to recover from it i was told by steve at .com that the topXstat also has a hole so i uninstalled it and i should be ok i don't know if it had an effect of the newer for 3.6 for i still using .4.

[Nuguru]

hey guys it 's not only flash it's the topXstat hack too i was hacked as well and i was able to recover from it i was told by steve at .com that the topXstat also has a hole so i uninstalled it and i should be ok i don't know if it had an effect of the newer for 3.6 for i still using .4.

Hello,

I am using Top X Stats 1.6.1a on vb 3.5.4., is there a way to keep this mod and fix the security issue?


Thank You,

Nuguru :)

[The Finman]

Hello,

I am using Top X Stats 1.6.1a on vb 3.5.4., is there a way to keep this mod and fix the security issue?


Thank You,

Nuguru :)

Yes, this will take care of both problems

These little script kiddies are using some really lame (actually calling them "script kiddies" is being overly generous for these lamers) tricks (more like an annoyance), but here is a very simple fix.

Go into you AdminCP and under vB Options choose Censorship Options.

In the Censored Words window add this.

{meta} >>>> {http-equiv} "Refresh" """"

That will put an end this nonsense.

[Kohhal]

I got hit aswell, removed Flashchat now as it's not worth having for the risks involved...

[Nuguru]

Yes, this will take care of both problems

These little script kiddies are using some really lame (actually calling them "script kiddies" is being overly generous for these lamers) tricks (more like an annoyance), but here is a very simple fix.

Go into you AdminCP and under vB Options choose Censorship Options.

In the Censored Words window add this.

{meta} >>>> {http-equiv} "Refresh" """"

That will put an end this nonsense.

Hello Everyone,

I gotta say, it's times like this when we are all under the pressure of getting matters quickly dealt with that you can really see how users at vbulletin.org come together and help one another. Great job to all for the excellent exchange in communication and support. We'll beat those little shits!

Regards,

Nuguru :)

[trilOByte]

I got hit as well last night.

The little nobs overwrote files all accross my site, they killed off virtuanews, photopost and vbulletin for a time and left just this message...

"by Thehacker own3d **** israel n0 war"

I was running flashchat, which I have now removed. The scarry thing is once they were in, it seems they had the freedom to roam right accross my domain. They replaced every index.html file in virtuanews with a hacked version and there are dozens in all the sub directory's.

Therer were several other people also hit from my host last night, with the same message.

[Rickie3]

thanx for the heads up and fixes people,really appreciate it

[b6gm6n]

I've removed FC for good because of this... i know it's not their fault...but still... don't want the hassle... anyways...another thing you can do to stop these kiddy-fiddlers is remove the version number from your vBulletin... it's legal and can stop these ++++nuts googling your forum for the right version or whatever... just incase

-b6

[trilOByte]

An update. The hackers came back tonight and somehow gained access again, even after uninstalling the flashchat plugin and all associated plugins, and totally removing all the flashchat files and deleting the chat dir. It seems they must have left some script behind to keep the door open. The first thing that happened was that my chat dir re-appeared and a new set of flashchat files dropped in from the ether.

If we can pin down this backdoor, script, pl file or whatever it is, I'll let you know.

[wacnstac]

Please keep us updated, I've been hacked through flashchat too.

[F5-MVH]

One of the other issues to deal with is new installs after the cleanups occur. For now we have new cronjobs looking for flashchat installs and removing the unneeded files.

[Transverse Styles]

If you're looking for a very secure chat, check out www.flasherize.com... try the demo. :)

[jw00dy]

Have any of you tried running chkrootkit (http://www.chkrootkit.org/) or rkhunter (http://www.chkrootkit.org/) to see if it finds the back door?

[MPDev]

Look for files with a creation or modified date of the day of the hack (or later). I found an IRC relay setup posted in an obsecure directory that I had to remove - they had also placed an entry in the apache crontab to restart itself every 10 minutes that I had to remove.

Check your cron files; check your site directories for new files/directories; try something like:

find . -name "*" -exec grep c99 {} \;

to see if you get any files which have the c99 tag in them (the shell script that are installing).

[JGM007]

I was running flash chat and was not as lucky as most people when I was hit yesterday. The message board was the only thing left, the index file for that had been replaced with something to the effect HACKEYD BY STOUNE!!! and a link to http://stounee.ifrance.com/

I went to replace the index file and found every single other directory and file was gone! for some reason they left the board though.
The web host did have a recent backup for me thankfuly, but at a price of course. :(
I ended up dumping my whole vB directory and upgrading to 3.6 and changed passwords on everything.

[The Finman]

The web host did have a recent backup for me thankfuly, but at a price of course. :(

I ended up dumping my whole vB directory and upgrading to 3.6 and changed passwords on everything.

That's horrible.

We at RonaldReagan.com use VPS hosting from KnownHost.com and they back up all our sites and subdomains daily with no extra charge for it or restore. I would have a serious problem with any web host trying to profit off a client's hour of need.

[smacklan]

We at RonaldReagan.com
Nice domain! Great man too...I may just have to join up and fellowship with other RR admirers :)

[The Finman]

Nice domain! Great man too...I may just have to join up and fellowship with other RR admirers :)

We would be glad to have you! http://www.ronaldreagan.com/forums/images/smilies/hello.gif

[JGM007]

Heh I wish my host was as friendly in a time of need like you are.
Since cleaning up, I have been checking the web site error logs and in the last six hours there been 20 hits looking for aedatingCMS.php, all different IP addresses.
I wonder how long before they realize it is gone give up trying to find it.

[belindaj]

An update. The hackers came back tonight and somehow gained access again, even after uninstalling the flashchat plugin and all associated plugins, and totally removing all the flashchat files and deleting the chat dir. It seems they must have left some script behind to keep the door open. The first thing that happened was that my chat dir re-appeared and a new set of flashchat files dropped in from the ether.

If we can pin down this backdoor, script, pl file or whatever it is, I'll let you know.

FYI -

Your host needs to check the contents of /tmp. Any of the following rogue files/directories needs to be removed from there. (Reference: RSTbackdoor technical details (http://www.symantec.com/security_response/writeup.jsp?docid=2005-071322-4217-99&tabid=2) from Symantec) Probably how they got back in a second time.

/tmp/bdpl
/tmp/back
/tmp/bd
/tmp/bd.c
/tmp/dp
/tmp/dpc
/tmp/dpc.c

Also - make sure you reinstalled your flashchat with completely clean files. I thought replacing the index page would fix it - it didn't - when I downloaded the entire chat directory down to my drive for scanning it also found another trojan within those files called hacktool.flooder (Symantec related page (http://www.symantec.com/security_response/writeup.jsp?docid=2002-101107-2237-99))

And of course, after uploading all clean files - remove the cmses files that are not related to your current installation as Paul stated.

[lmongello]

Was hacked last Friday (thank you, FlachChat). Program removed and will never be reinstalled again. Still trying to do serious damage control after what the hackers put on my home page on emailed to my members. :(

[steven s]

Flashchat updated to 4.70
http://forum.tufat.com/showthread.php?t=24971

[yesfans]

I was running flash chat and was not as lucky as most people when I was hit yesterday. The message board was the only thing left, the index file for that had been replaced with something to the effect HACKEYD BY STOUNE!!! and a link to http://stounee.ifrance.com/

I went to replace the index file and found every single other directory and file was gone! for some reason they left the board though.
The web host did have a recent backup for me thankfuly, but at a price of course. :(
I ended up dumping my whole vB directory and upgrading to 3.6 and changed passwords on everything.


I am with asmallorange.com and can say nothing but FINE thing for this host. They have great tech help 24/7 via email and don't charge for help. They have bailed me out of many problems. I have a dedicated server with them!

[DudeSicko]

{meta} >>>> {http-equiv} "Refresh" """"

That will put an end this nonsense.Thats all you have to do to stop the hacking?

[steven s]

Thats all you have to do to stop the hacking?That has nothing to do with Flashchat.

[Guest210212002]

Hit with this as well about a month ago, my host recommended installing mod_security in php as another means of preventing it.

[Marco van Herwaarden]

Problem with mod_security is that you can also break a lot of things (including vBulletin) if you don't know what you are doing.

[Guest210212002]

Agreed. I did a decent amount of RTFM'ing before dropping it on, and so far no issues.

[AyeCapn]

I'm about to install FC 4.7.5. IS this still an issue?

[Paul M]

This issue is long dead, it was fixed in Flashchat 4.6.2

[wobbly]

No it isn't bud. I got hacked last weekend using latest vb 3.62 and latest flashchat.

found that they had uploaded loads of ftp cgi scripts etc and were well on their way to trashing my site. My host found the activity going on and shut down my site.

[Paul M]

I am well aware how this exploit worked and it's long gone.

Either they used a new Flashchat exploit, which seems unlikely as no one else has reported anything, or they didn't use Flashchat.

If you have actual evidence then I suggest you post it on Tufats forum.

[Joey805]

Hey guys,

Been reading this thread about being hacked via flashchat. I too had this happened to me. Every day, the server is hammered from mysql and my ISP is complaining about my site killing the server. They said there are a ton of mysql connections but I only have like 10 users on VB at any one given time.

How did you locate the trojan and get rid of it? I really need to get this off their server now. I am on a shared solution so I have limited access to what I can do on the server.

Is there any tools I can scan my database or php files with to locate this crap?

Thanks in advance for any help you guys can provide.

~ Joey

[RichieBoy67]

I was hacked a few months ago through flashchat too. They got into my server and messed up a few sites of mine and also clients sites too. I fixed everything but it made for hours of extra work..

I contacted the flashchat site and the guy got back to me and told me that was the nature of this type of script..

After that I uninstalled it and never looked back..... If it wasn't for the security holes it would have been a decent chat. My members liked it...

Is the newest version safer or is it still full of holes???