ibProArcade 2.7.2Hacked

[XGC Viper XI]

Recently ibProArcade 2.7.2+ was hacked where the hacker was able to insert the root file into the arcade/tar folder. This was confirmed with the webmaster once this was identified based on the file that was inserted. The only file that should be in that folder is the index.html.

As it has been a while since ibProArcade was updated, has there been any updates or fixes that addresses this issue?

[ozzy47]

Then you need to report the modification from the modifications thread, so it will be handled correctly.

[blind-eddie]

What was done to your site from being hacked and how was it confirmed the hacker entered through ibProArcade?

[Dave]

As far as I can see, the only place where the tar module is being used which uses the arcade/tar/ folder, is in the adminCP.

Either someone accessed your ACP through an other vulnerability or the hacker just uploaded a malicious file to that folder because it has public read/write access on it. (0777 chmodded)

[ozzy47]

That's what I kinda figured Dave, and I know you would be able to spot a vulnerability pretty quick. :)

[XGC Viper XI]

No, the arcade/tar folder is in the root based on the installation files and the folder has 755 permission to include the arcade folder. This was pin pointed by the webmaster who had been troubleshooting this issue before I made him aware of it where a file was inserted that began the root of the problem. The only part of our site that uses that folder structure is the ibProArcade.

After the site was hit with the root file, it pathed to change all the main files of vBulletin and almost all index.html page to insert code in to the files.

[ozzy47]

But that still does not prove it was the arcade mod that allowed them to do this.

[TheLastSuperman]

I was working on someones site last night, who had DB Tech's arcade installed... I only mention that mod because of what I'm about to tell you to check.

- Check the game folders, anywhere it stores the game itself, either the specific folder OR any /temp folders.

Why? Sometimes the games you install/import can have malware and malicious files.

How do I know? This is one of the few games I've ran into where the files would not transfer to my pc when running a backup so I knew something was up.

Is the game Bobsled GC installed?
I found this in a sub-folder:

/forums/dbtech/vbarcade/import/temp/bobsledGC/gamedata/

Now in any arcade if a game has a folder /gamedata/ it can be legit. However these are the files I noticed that seemed odd in that gamedata folder:

loader.swf
game.swf
game_7.swf
game_66.swf
comm.swf
shell.xml

Now normally a game.swf would be ok but as I noticed my pc did not even allow that one to come through - couple that with the fact there's variants and one that stood out more than others was shell and comm files. Needless to say these had to be removed using the root user as nothing we did from normal accounts allowed us to delete the files basically permission denied every time.

So like I said above, I only mention DB Tech arcade because of what I recently ran into last night with those iffy game files. The owner of the site logged in as root, delete those files and uninstalled the game from the arcade. What I'm trying to convey is that, the arcade COULD have an unknown exploit OR one of your games does - Be Careful where you download games from.

[TheLastSuperman]

After the site was hit with the root file, it pathed to change all the main files of vBulletin and almost all index.html page to insert code in to the files.

I imagine this was base64_decode? If you found out anything else regarding this since time of the above post please let us know.

[XGC Viper XI]

Sorry it took so long to answer. The file name was hb2ymtdn.php and it had the base64_decode inside it.

What does that mean?

[Dave]

When there's base64 encoded stuff in it, it's usually like that to hide a backdoor. Most PHP backdoors have scripts to execute system commands on the server.

[ChiNa]

Its a late reply, but since I have been using IBPro Arcade for almost 4 years wanted to give my feedback.

We have been using IBProArcade for 3-4 years. And yes till this day today we are still using IBProArcade + 2.7.2. And since we started there has been more than 25 hacking attempts weekly on our forum for the past 3-4 years. But they never succeed.

Just because the files were discovered within its folder it doesnt mean IBProArcade was the cause of why the forum was hacked. Like Ozzy47 Replied. That doesnt prove it was the IBProArcade. I just want others to know that this is definitely not an IBProArcade issue.

[MrZeropage]

Thanks for this final statement.

ibProArcade v2.7.3+ (10 years anniversary release) in on the track, but there were still no security-issues to be fixed, just internal improvements ect.