Hacks - Status Updates!

[Guest Rabbit]

If you make it in here, the site has been hacked and there will be a complete wipe. The site will be down for a few days.

[Tree 0]

...

[comander starlin 6]

no.... yea i was online when this happened i emailed C&CKing about it not cool aye. talk about ruining our little conner of the universe. :x

[Guest Rabbit]

can you guys see the ****ed up page?

[comander starlin 6]

yea it is messed, the bast*d's why did they have to do that it is not like we wanted to bomb Iraqi

[Guest Rabbit]

dude, stfu, it doesn't have to do with iraq.

[comander starlin 6]

well it involves some Arab group, sorry i just read an article on Iraqi. :oops:

[Guest Rabbit]

yeah, but it's just a couple of punk arabs trying to do something.

[comander starlin 6]

yea true they need a life, they are like collage jock's, not cool

[Tree 0]

What page?

[comander starlin 6]

what do you mean? the CNCNZ.com main page, CNCNZ.com forums index page, and every page liked to the CNCNZ.com main page eg. http://cncnz.com/games/cnc3/ just the forums such as open discussion etc are not affected.

 

quoted from an Email fro C&CKing

We've had a security issue with the Revora network. At 16:38 GMT the

network was accessed by an unauthorised person. As a result all index

pages on all hosted sites across the network were changed and displayed

the screenshots you have given us. PPM and Freedom studios have also

been affected As a result all sites have been temporarily disabled and

will be up again as soon as possible once the hole in the security has

been identified and patched up.

[Sonic 296]

Ok well this is bit of shock :shock:

I've been through something similar before a few years ago.

 

I have restored access to CNCNZ.com and of course the forums here, there is problem still some problems floating around. So let me know if you spot anything.

 

The only damage (site related) was that all index.* files, and anything related to logging in were either changed or deleted.

 

I've already spoken with Mastermind (he owns the Icetex that we call home) and he has told me that the server's OS will be wiped and restored. We won't loose any data related to the forums though. I'm not sure when this will happen but I'll do best to keep you all informed of any planned downtime.

[Tree 0]

They must have somehow gotten root access to the server. Server-wide effects can't be done with just a hole in a CMS or something.

[BWare 0]

Interesting... I did notice that earlier today. I wonder if it has anything to do with the Islamic hackers who have been hitting other western sites lately? Ugh.

[Tree 0]

Everything on the Icetex server was hit. They probably did nothing other than brute force the password.

[Sonic 296]

On the surface the damage is minimal at best, just uploade the affected files in question and everything is back to normal. However the parts of server's operating system have been damaged as I was told by Mastermind.

 

We are sort of running a quick fixed patch set up right now.

[Tree 0]

Ouch, backups of OS files usually aren't made. Mastermind may be looking at a complete OS rebuild. Don't want to put words in his mouth though.

[Luk3us 63]

Well its nice to see CNCNZ back online again.

[comander starlin 6]

just it goes a bit slow every so often but all G.

[Tree 0]

If you need me to do anything, just ask.

[Guest Rabbit]

Haha, I've been saying the same thing, as with others. Shows how much we really care about this place

[Tree 0]

MySQL is being way slow. Apache's responding great, but MySQL is taking a while...

[comander starlin 6]

the first decade files are going really slow 3min for DOS Mode, that normally takes me 30-1min

[Banshee 28]

Mastermind will do a heavy backup, copying everything into a USB HD before reinstalling the whole stuff, so the data losses might be minimal or none... although I always recommend to have a backup of everything.

 

Regarding the way the server was hacked, it's unknown because all logs were deleted. I believe a hostee was hacked and then, they used an script on it to take advantage of some apache/O.S. exploit to take root access.

 

Anyway, We'll also verify every hostee to make sure we wipe any remaining vulnerabilities... it's gonna be a pain in the ass to check 200 sites or more... but I guess someone will have to do it :S

[Guest Rabbit]

I have to admit that I find it ironic how we were complaining about bots the whole time leading up to this. What a small problem compared to this.