Preventative - How to avoid being Hacked by TeamPS i.e. p0wersurge

[Black Snow]

Originally Posted by meissenation

Your link to LeetHost is offline... ironic? lol

I'm going through the same issue right now - one of my vbulletin sites was defaced - as far as I can tell they only changed the index.php and forum.php files in the forum directory, but it appears they also deleted the adminlog. I found a backdoor/shell PHP file, a mysql backup so they have a full backup of our forum's database, etc. I do not see new users in the administrator section so they didn't create themselves a user on the site. It was a 5 minute fix to get the forum working again but it's really troubling that they were able to add the shell file with such ease...

Yes, they are upgrading some server components at the moment. That will be the same file I found. After I secured my site, well I thought I had, I opened my forum again. Because they had a copy of my database, they had cracked the moderators passwords and logged in with them and started leaving weird posts and threads. I had to edit the usergroups to make all my members change their passwords as soon as they logged in next.

I even had to manually change moderators passwords to ensure the hackers could not harm my forum until the original mods came back online. I would encourage you to do the same. Email all your members and explain what happened and make a compulsory password change immediately.

Originally Posted by Inspector G

was it a VB 4.2 p 3

Yes is was. Since I moved to LeetHost, I have had no issues with any kind of hacking. No DDoS, hacking, spam or anything. They are really secure.

If you need any more info on this, let me know.

[AK47-]

Originally Posted by Black Snow

Yes, they are upgrading some server components at the moment. That will be the same file I found. After I secured my site, well I thought I had, I opened my forum again. Because they had a copy of my database, they had cracked the moderators passwords and logged in with them and started leaving weird posts and threads. I had to edit the usergroups to make all my members change their passwords as soon as they logged in next.

I even had to manually change moderators passwords to ensure the hackers could not harm my forum until the original mods came back online. I would encourage you to do the same. Email all your members and explain what happened and make a compulsory password change immediately.


Yes is was. Since I moved to LeetHost, I have had no issues with any kind of hacking. No DDoS, hacking, spam or anything. They are really secure.

If you need any more info on this, let me know.

Shadow008 suuuuuuuuuuuuuuuuuuuuuuuuuup xD Advertising your hosting hey? xD

[y2ksw]

Another important issue against hacking is the basic server configuration. One of the encountered problems are the Apache mpm_worker module together with fast-cgi, which eventually run a bit faster, but will not allow to sandbox virtual hosts.

In order to allow sandboxing virtual hosts, and thus avoid that other infected sites on a single server will spread over other domains, you should use mpm_prefork and then, in each virtual host configuration:

<Directory /vhosts/domain.tld/httpdocs>
php_admin_value open_basedir /vhosts/domain.tld
php_admin_value upload_tmp_dir /vhosts/domain.tld/tmp
# ... other settings
</Directory>

Eventually you could use the systems (default) tmp folder, by adding its path to the sandbox:

<Directory /vhosts/domain.tld/httpdocs>
php_admin_value open_basedir /vhosts/domain.tld:/tmp
# ... other settings
</Directory>

This is particularily important when you already have had a defacement and can't determine which domain got hacked.