The top x stats fix hasnt worked

[TeaTree]

Even though the top x stats was updated yesterday with the aparent fix, users are still managing to re-direct via them-

Why please?

Thanks,

Sam

[The Finman]

It looks like they have been modifying their scripts.

We had one script kiddie try 3 variations of the meta refresh script. I assume the variations are designed to get by patches for the original.

I added my own fix in addition to cyb-advanced stats (basically the same as TopX Stats).

I simply went to vBulletin Options --> Censorship Options --> Censored Words and add these to your list of censored words.

content=0 content="0 LANGUAGE= JavaScript {meta} >> >>> >>>> >>>>> >>>>>> {http-equiv} "Refresh" """"

Even though they varied their scripts in order to get by the cyb-advanced stats and TopXStats patches the above fix still stripped out their varibles and they they have all left in a great big script kiddie huff. :laugh:

You know?...actually calling these lamers "script kiddies" is overrating their pathetic abilities.

Anyone using FlashChat needs to upgrade to version 4.6.2 and delete everything in your cmses (chat/inc/cmses/) directory EXCEPT the version of vBulletin you are using (if you are using 3.6 then you want to LEAVE vbulletin36CMS.php Etc). Especially delete anything that says aedating in it's title as it has a serious security flaw in that file.

Also, if you running Apache then you can use an .htaccess file and addi it to the cmses directory.

The .htaccess file should contain the following inside of it

Order Deny,Allow
Deny from all

Read more about using .htaccess here http://httpd.apache.org/docs/1.3/mod/mod_access.html

Also, something to think about is that a lot of people have "test" forums on their servers to try out new hacks and upgrades before installing them on their "live" board. Please remember that if you installed Cyb-Advanced Stats, TopXStats or FlashChat on your test board and they are still on there or unpatched then you are still at risk, especialy with FlashChat as they are gaining directory access through holes before 4.6.2.

So to recap...if you have Cyb - Advanced Forumhome Statistics3.6.0 or 3.5.4 please update your version.

If you have Top "X" Stats 3.5.4 or 3.0.0 please update your version

If you have FlashChat please update it to 4.6.2

I also recommend adding this quick but highly effective fix.

Go to vBulletin Options --> Censorship Options --> Censored Words and add these to your list of censored words.

content=0 content="0 LANGUAGE= JavaScript {meta} >> >>> >>>> >>>>> >>>>>> {http-equiv} "Refresh" """"

There are other "fixes" available such as vB 3.6.0 Disallow HTML code in Thread Titles, but the above doesn't require any template edits, and like I said has stopped all variations cold.

If you have been hit with these exploits (and you are able to log into your AdminCP)...go to vBulletin Options ---> Plugin/Hook System--->Enable Plugin/Hook System=NO and use the guides I have listed above.

Hope this helps.

[TeaTree]

Thanks,

It has helped a lot

Originally Posted by The Finman

It looks like they have been modifying their scripts.

We had one script kiddie try 3 variations of the meta refresh script. I assume the variations are designed to get by patches for the original.

I added my own fix in addition to cyb-advanced stats (basically the same as TopX Stats).

I simply went to vBulletin Options --> Censorship Options --> Censored Words and add these to your list of censored words.

content=0 content="0 LANGUAGE= JavaScript {meta} >> >>> >>>> >>>>> >>>>>> {http-equiv} "Refresh" """"

Even though they varied their scripts in order to get by the cyb-advanced stats and TopXStats patches the above fix still stripped out their varibles and they they have all left in a great big script kiddie huff. :laugh:

You know?...actually calling these lamers "script kiddies" is overrating their pathetic abilities.

Anyone using FlashChat needs to upgrade to version 4.6.2 and delete everything in your cmses (chat/inc/cmses/) directory EXCEPT the version of vBulletin you are using (if you are using 3.6 then you want to LEAVE vbulletin36CMS.php Etc). Especially delete anything that says aedating in it's title as it has a serious security flaw in that file.

Also, if you running Apache then you can use an .htaccess file and addi it to the cmses directory.

The .htaccess file should contain the following inside of it

Order Deny,Allow
Deny from all

Read more about using .htaccess here http://httpd.apache.org/docs/1.3/mod/mod_access.html

Also, something to think about is that a lot of people have "test" forums on their servers to try out new hacks and upgrades before installing them on their "live" board. Please remember that if you installed Cyb-Advanced Stats, TopXStats or FlashChat on your test board and they are still on there or unpatched then you are still at risk, especialy with FlashChat as they are gaining directory access through holes before 4.6.2.

So to recap...if you have Cyb - Advanced Forumhome Statistics3.6.0 or 3.5.4 please update your version.

If you have Top "X" Stats 3.5.4 or 3.0.0 please update your version

If you have FlashChat please update it to 4.6.2

I also recommend adding this quick but highly effective fix.



There are other "fixes" available such as vB 3.6.0 Disallow HTML code in Thread Titles, but the above doesn't require any template edits, and like I said has stopped all variations cold.

If you have been hit with these exploits (and you are able to log into your AdminCP)...go to vBulletin Options ---> Plugin/Hook System--->Enable Plugin/Hook System=NO and use the guides I have listed above.

Hope this helps.

[optrex]

It does seem a bit of a weak fix just relying on censored words. Easy to get round, if they happen to read the vb.org forum !!!

....might be kiddies this time, what happens if you get someone that knows what they are doing next time?

[The Finman]

Originally Posted by optrex

It does seem a bit of a weak fix just relying on censored words. Easy to get round, if they happen to read the vb.org forum !!!

....might be kiddies this time, what happens if you get someone that knows what they are doing next time?

All variations of that script require one or more of the words and/or characters I have listed. Those listed should not have any reasonable place on a discussion board unless it is a computer related site that deals with code. I didn't say it was a perfect fix, I said it was an effective fix. If you know of a variation of the meta refresh script that can get past it I would be more than happy to know about it.

[optrex]

Not taking anything away from your fix for that particular script or variant, or indeed your own skills.

But my point is the loophole is still open for others to exploit.

[Paul M]

Also, if you can, set "register_globals = Off" in your servers php.ini file - that will stop the Flashchat exploit dead in its tracks (and close an often used/abused security issue in php).

[The Finman]

Originally Posted by Paul M

Also, if you can, set "register_globals = Off" in your servers php.ini file - that will stop the Flashchat exploit dead in its tracks (and close an often used/abused security issue in php).

True dat!

Thanks Paul!