A successful attack on SMF

CommanderKeith · January 18, 2011, 12:55am

Phew! Glad all’s well again.

Hooray for Riven and long live JGO

Riven · January 18, 2011, 1:09am

Before anybody gets freaked out, to prevent the hacker from (still) being logged in under my account, I changed the serial in the cookie so that all sessions were killed. (a few sessions survived the server transfer!)

SimonH · January 18, 2011, 1:16am

JGO is back! Riven, U R A STAR!

edit:Yay plus! I got my siggy back! Whoop!

SwampChicken · January 18, 2011, 1:18am

I send my thanks to all those who helped get my fave site back up. And I curse thee script-kiddy scum who have nothing better to do than screw with people’s sites.

Demonpants · January 18, 2011, 1:59am

Riven:

Syntax highlighting and custom activation page back in (will look better with a logo).
public class HelloServer
{
   public static void main(String[] args)
   {
       new ServerSocket(80);
   }
}

Are you expected to run that code and see what it gives you? I honestly find that too difficult otherwise - I would have no idea how to solve that in my head, especially given I have no idea what the hashCode() function will return without running it.

Won’t that keep quite a few noobs out? I guess maybe that’s not an issue?

Anyway, awesome congrats on getting it back up and thanks again.

kaffiene · January 18, 2011, 4:00am

Riven - you rock! Thanks for all the work, bro, I know this isn’t fun for you. The community really appreciates it though.

Nate · January 18, 2011, 4:08am

Sounds good to me!

Ahhhg! I lost one appreciation point! I demand a recount!

Riven · January 18, 2011, 6:37am

Eli Delventhal:

Riven:
Syntax highlighting and custom activation page back in (will look better with a logo).
public class HelloServer
{
   public static void main(String[] args)
   {
       new ServerSocket(80);
   }
}
Are you expected to run that code and see what it gives you? I honestly find that too difficult otherwise - I would have no idea how to solve that in my head, especially given I have no idea what the hashCode() function will return without running it.

As if you could have calculated the result of the loop in your head. I don’t get it. There is a question, there is an answer. Who cares how you solve it.

zammbi · January 18, 2011, 7:28am

I know you were worried about SMF 2 being a RC but its been in RC for about 2 years. From the comments I’ve read on the forum its stable. It might remove these security worries. It seems the 1.X versions are not being worked on any more.

Though are we still using “1.1.12”… which is from February 10, 2007.

Anyway glad the forums are back up.

Riven · January 18, 2011, 7:40am

SMF 1.1.12 is from Nov 2010

http://www.simplemachines.org/community/index.php?topic=407256.0

cylab · January 18, 2011, 9:13am

I ran the code and the result made me smile
Would be cool to have E=mc^2 in there…

kappa · January 18, 2011, 9:39am

Exactly, if you aren’t able to answer that question, then you aren’t yet ready to enter the java games arena and should probably read some getting started guides for java

cylab · January 18, 2011, 9:42am

But it would be cool to give some more hints, so that at least the noobs that cannot code but are able to think and comprehend are able to join.

bleb · January 18, 2011, 10:06am

As I noted just before the outage, spammers are still managing to register. It seems that there are actually three certainties in life: death, taxes and spammers.

Huge props to Riven for his efforts. It sounds like this attack was a shuddering nightmare for your server, so to have the forum back up so soon deserves more than an appreciate++. Thankyou.

Does a more secure forum package exist? From reading the #lwjgl logs it sounds like SMF is a gaping orifice of fail on the security front, and our installation in particular is thoroughly compromised. If it’s going to be a ball-ache to fix up then I wouldn’t be opposed to a fresh start: stick the current forum into a read-only archive, everyone re-registers and carries on as before.
It’s happened before IIRC, when we moved to YABB.

halfwitgoat · January 18, 2011, 10:09am

Thanks for all the good work, Riven.

If we need a private server, I’d be happy to donate.

Riven · January 18, 2011, 10:17am

ryanm:

As I noted just before the outage, spammers are still managing to register. It seems that there are actually three certainties in life: death, taxes and spammers.

Huge props to Riven for his efforts. It sounds like this attack was a shuddering nightmare for your server, so to have the forum back up so soon deserves more than an appreciate++. Thankyou.

Does a more secure forum package exist? From reading the #lwjgl logs it sounds like SMF is a gaping orifice of fail on the security front, and our installation in particular is thoroughly compromised. If it’s going to be a ball-ache to fix up then I wouldn’t be opposed to a fresh start: stick the current forum into a read-only archive, everyone re-registers and carries on as before.
It’s happened before IIRC, when we moved to YABB.

Well, the databasedump was not infected. Whatever naughty stuff is in the database, it won’t make it through to the visitor, because SMF does proper escaping of values in the database. I made a fresh install of SMF, on a fresh server. I have no reason to assume ‘our installation is thoroughly compromised’ … it was, I hope.

zammbi · January 18, 2011, 10:21am

Woops. Got confused with 1.1.12 with 1.1.2.

Matzon · January 18, 2011, 10:38am

Disable profile viewing for non-registered users - thats the primary use of signature spamming

bleb · January 18, 2011, 11:33am

Riven:

ryanm:

As I noted just before the outage, spammers are still managing to register. It seems that there are actually three certainties in life: death, taxes and spammers.

Huge props to Riven for his efforts. It sounds like this attack was a shuddering nightmare for your server, so to have the forum back up so soon deserves more than an appreciate++. Thankyou.

Does a more secure forum package exist? From reading the #lwjgl logs it sounds like SMF is a gaping orifice of fail on the security front, and our installation in particular is thoroughly compromised. If it’s going to be a ball-ache to fix up then I wouldn’t be opposed to a fresh start: stick the current forum into a read-only archive, everyone re-registers and carries on as before.
It’s happened before IIRC, when we moved to YABB.

Well, the databasedump was not infected. Whatever naughty stuff is in the database, it won’t make it through to the visitor, because SMF does proper escaping of values in the database. I made a fresh install of SMF, on a fresh server. I have no reason to assume ‘our installation is thoroughly compromised’ … it was, I hope.

Good news!

appel · January 18, 2011, 2:08pm

What about user passwords?