Hacked

[Lynne]

Your first post is very misleading. You claim " there were no addons at the time" and then go on to say "I am pretty sure now that he used a modification to gain access to my account even though he says he didnt so i have already removed most of them. Some of the are critical but i believe are safe."

Modifications are Add-Ons.

[Michael.A]

Originally Posted by Lynne

Your first post is very misleading. You claim " there were no addons at the time" and then go on to say "I am pretty sure now that he used a modification to gain access to my account even though he says he didnt so i have already removed most of them. Some of the are critical but i believe are safe."

Modifications are Add-Ons.

ok am sorry, so Lynne are u saying he got hacked buc of Add-Ons?

[Powlo]

Originally Posted by Lynne

Your first post is very misleading. You claim " there were no addons at the time" and then go on to say "I am pretty sure now that he used a modification to gain access to my account even though he says he didnt so i have already removed most of them. Some of the are critical but i believe are safe."

Modifications are Add-Ons.

He hacked with & without addons, i dont know what to think but the words 'vbulletin version 3.8.x' have been said more than once to me over the last 2 days.

Originally Posted by MAD--DOG

any vb higher then 3.7.5 is fun to take down sorry but yes . 3.8.x no good

Which i guess is why you stayed a 3.7.5

So whats your advise MAD--DOG? You seem to know the score, what if anything can i do to prevent this?

[Lynne]

Originally Posted by MAD--DOG

ok am sorry, so Lynne are u saying he got hacked buc of Add-Ons?

I have no idea how he was hacked. But if sounds to me like the hacker got server access somehow if he was modifying the htaccess file. I was just commenting on the fact that at first he was leading people to believe he had no add-ons/modifications on his site, but it turns out he did and it sounds like the hacker even used one of them to help do something to the site.

Also, I have not heard anything to say 3.8 is less secure than 3.7. But, I don't go reading up on this all the time either.

I hate hackers.

[Powlo]

Originally Posted by Powlo

He hacked with & without addons

Why do you hate hackers? Some of them are good and help software companies create a more secure product. I dont think these guys should be put into one basket, there are good and there are bad. Perhaps you just hate the bad ones

[Lynne]

Originally Posted by Powlo

Perhaps you just hate the bad ones

Yes, I hate the bad ones.... especially ones that try to extort you to undo what they did.

[Shadab]

If the hacker has access to your vBulletin Forum's admin account and it's a Super Administrator account and/or has the permissions to 'manage' plugins; then yes, he can alter/create files on your server. Doesn't matter if you have 3'rd party addons installed or not.

So; Stock vBulletin or not, if he gets access to your admin account, theres nothing stopping him to create his own plugins from your account to run raw PHP code on the Forum. (unless of course that particular admin account doesn't have the permission to alter plugins).

[Powlo]

Originally Posted by Shadab

If the hacker has access to your vBulletin Forum's admin account and it's a Super Administrator account and/or has the permissions to 'manage' plugins; then yes, he can alter/create files on your server. Doesn't matter if you have 3'rd party addons installed or not.

So; Stock vBulletin or not, if he gets access to your admin account, theres nothing stopping him to create his own plugins from your account to run raw PHP code on the Forum. (unless of course that particular admin account doesn't have the permission to alter plugins).

Thats what i thought and sounds like that is exactly what happened as i can see from the log that the first thing he did was something with plugins..

17838 Python 18:04, 19th Apr 2009 plugin.php productedit
17837 Python 18:03, 19th Apr 2009 plugin.php product

.. is there a way to find out which one was altered?

[Lynne]

It may show in your access_logs. Each plugin has an id and when you go to edit it, it says the id in the url. So, like I said, look in your access_logs for something like "..../plugin.php?do=edit&pluginid=xx" to get the pluginid.

[Shadab]

Originally Posted by Lynne

It may show in your access_logs. Each plugin has an id and when you go to edit it, it says the id in the url. So, like I said, look in your access_logs for something like "..../plugin.php?do=edit&pluginid=xx" to get the pluginid.

Yep, plugin edits can be tracked this way; but this entry :

17838 Python 18:04, 19th Apr 2009 plugin.php productedit

corresponds to a whole 'product' edit; whose ID we *probably* can't track. As vB doesn't log it and moreover, that ID is sent via POST not GET; so the server access log can't see it too.

To OP:
All the hacker used was just plugin edits ? Did you check with your webhost on which 'files' were altered/added to your hosting account in the past 1 week ?