Site keep getting hacked

[BlitzSports]

My site keeps getting hacked. This bozo keeps replacing ALL of my index.php files with his hacked files.

I am running 3.6.8 and have about 60 mods installed. MY host said its vbulletin that is allowing my site to be compromised due to security issues with 3.6.8.

What files do I need to update that will allow me NOT to overwrite any templates. Also, how do i do it? Please do not tell me that I need to start from scratch because I do not know how as I paid somebody to create my site and I do not want to pay them again as it was costly.

I do have some knowledge to computers and know a lot about HTML. That's my extent.

[SEOvB]

You need to update 3.6.8 to at least 3.6.12 or whatever the latest version for 3.6 is.

There should only be minimal style changes between the two, and the upgrade won't automatically overwrite your styles.

60 mods is a lot, hopefully you need all of them, as thats 60 additional chances of a modification being the source of the hacking as well. I'd remove any not used along with their files.

[BlitzSports]

I just spent a long time at the vbulletin.com site looking for the update to the latest 3.6 version and all I can find is 3.8.

Where do I do to get the latest 3.6.x update patch?

And thanks for your help

[SEOvB]

Click the "More Download Options" while going thru the download process at vbulletin.com/members

[Alfa1]

Your image gallery is getting hacked. He was able to upload files to your server. What software do you use for your image gallery?

I see your hacker asks you to remove safe_mode and mentions your permission settings.

You need someone who knows what he/she is doing to review your server security. Ranging from permissions to the services that are allowed on your server. Your logs need to be reviewed, so that you can see what happened and what security issues you need to resolve. As I see it you have two options: get someone in charge of your server security or you will have to learn it yourself(either by free will or by force, as hacks will likely keep on coming)

Although I do not know the situation, my bet is that the hosting co has no clue.

[Brandon Sheley]

talk to your host, check the logs
google this, it's been asked 100's of times

[BiZiMDiYaR]

Hi,

Ok, let'say this has been asked 100's or even 1000's times.. and I think will be asked more also :-). Can anybody explain where to look for in the logs ? How to analyse what has been done and how to see what is happening on the server.. ? Where to see these logs for hacking, for DDOS's or any other things what happens.. ?

Just the basic info on where to look woulf be great.. or maybe some google links which you think has got some good informations... as there are like you mentioned a lot of links, but how do we know which one is good ? :-)

Best regards.

[BlitzSports]

Originally Posted by Alfa1

Your image gallery is getting hacked. He was able to upload files to your server. What software do you use for your image gallery?

I see your hacker asks you to remove safe_mode and mentions your permission settings.

You need someone who knows what he/she is doing to review your server security. Ranging from permissions to the services that are allowed on your server. Your logs need to be reviewed, so that you can see what happened and what security issues you need to resolve. As I see it you have two options: get someone in charge of your server security or you will have to learn it yourself(either by free will or by force, as hacks will likely keep on coming)

Although I do not know the situation, my bet is that the hosting co has no clue.

I am running photoplog, or something like that. If I uninstall it will this stop the attacks?

[Alfa1]

Originally Posted by BiZiMDiYaR

Can anybody explain where to look for in the logs ? How to analyse what has been done and how to see what is happening on the server.. ? Where to see these logs for hacking, for DDOS's or any other things what happens.. ?

You need to review the logs line for line. See if anything odd happens. Keep an eye on strange requests, especially by the same IP(s), especially in the photoplog directory. If you find a suspect IP run it trough vbulletin and see what comes up. You need to find out what services where exploited and if you can block these services, or at least make them more secure.

You should be able to access your logs trough your servers admin panel. Where in the admin panel depends upon which admin panel you have.

Originally Posted by BlitzSports

I am running photoplog, or something like that. If I uninstall it will this stop the attacks?

This is hard to answer without knowing what exactly has happened. It is likely that the hacker gained access by finding an vulnerability in your photoplog directory. But this is far from certain. One thing you almost surely need to address is CMOD permissions of your directories. You will need to find out what is on your server that does not belong there. After you have found out what happened you could consider using a back up of your database and files and using that as your basis. It is possible that you have files and scripts on your forum, that will allow the hacker regain control.

[Jon Tolzien]

I have read alot of these forums, so i am not sure I can help you right now, but i can recommend you to read this post. https://vborg.vbsupport.ru/showthread.php?t=197510 Regardless it is a good read.