Site Links
Home
Features
Documentation
Pricing & Order
Members Area
Support Options
UBBDev.com
UBBWiki.com
Who's Online
0 registered (), 29 Guests and 32 Spiders online.
Key: Admin, Global Mod, Mod
Featured Member
<span class='adminname'>SD</span>
SD
Registered: 04/19/07
Posts: 4206
Top Posters (30 Days)
Ruben 27
Gizmo 22
Bert 18
sb 5
hema0359 4
After the Rose 4
BellaOnline 3
gladiator 3
skicomau 3
mona said 2
Latest Photos
Uhm...
Mayan End of World
Gas Station Disco Video Shoot
Test Pictures
Audrey Kate
Topic Options
#250181 - 09/10/12 02:56 AM Many ubbthreads sites seem compromised.
smallufo Offline
enthusiast
Registered: 06/05/06
Posts: 266
Loc: Taiwan
First , there are files injected into this dir :
${ubbthreads}/images/forumimages/default

Code:
-rw-r--r--  1 x x    23 2011-12-18 12:09 exploit.conf
-rw-r--r--  1 x x   993 2011-12-13 11:56 cons.php
-rw-rw-rw-  1 x x 40756 2011-11-19 16:06 admin_2011.php
-rw-r--r--  1 x x 77035 2011-09-23 00:06 gold.php
-rw-rw-rw-  1 x x    34 2011-09-15 16:28 config.php


And then , I notice a lot of 'POST action' to admin_2011.php , modifying includes/header.php and includes/footer.php
That's why there's another thread complaining unwanted Google Ads shown.
I think UBBT team should take actions ASAP !

Most important of all , find out how these PHPs are injected to the directory , are there any exploits within ? (7.5.6p2)

By the way , the attacking IPs are from China : 118.253.12.77 , 101.226.33.201

If admin needs these exploit files , just tell me.
_________________________

English is not my native language.
I try my best to express my thought precisely.
I hope you understand what I mean.
If any misunderstanding results from culture gaps , I apologize first.
Top
Express Hosting
Express Hosting "We are the official hosting company of UBB.threads. Ask us about our free migration services to migrate your UBB.threads installation."
#250186 - 09/10/12 08:53 AM Re: Many ubbthreads sites seem compromised. [Re: smallufo]
Gizmo Offline

Registered: 06/05/06
Posts: 15475
Loc: Portland, OR; USA
There is already a thread here discussing this issue; as well as a temporary measure included by me on page 2 (using HTAuth to secure the admin panel); I don't think that a formal "fix" has been issued yet though.
_________________________
Forums: UGN Security & VNC Web Design & Development
UBB.Threads: UBB.Wiki, My UBBSkins, UBB.Sitemaps
Longtime Supporter, Beta Tester & Resident Post-A-Holic.
Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Top
#250187 - 09/10/12 04:29 PM Re: Many ubbthreads sites seem compromised. [Re: smallufo]
luket Offline
member
Registered: 11/09/04
Posts: 198
I can no longer access my site, I get a
ERR_CONTENT_DECODING_FAILED

When trying to view my site..
_________________________
Member since November 2004
Gold Member since Feb 2008
Top
#250189 - 09/10/12 05:50 PM Re: Many ubbthreads sites seem compromised. [Re: luket]
Ruben Offline

Registered: 12/20/03
Posts: 4959
Loc: Lutz,FL
Originally Posted By: luket
I can no longer access my site, I get a
ERR_CONTENT_DECODING_FAILED

When trying to view my site..

I see your board is closed for Maintenance.
No error.
Also your breadcrumb navigation links to
http://www.iana.org/domains/example/
Which is not a valid home page for you.
_________________________
Blue Man Group


There is no such thing as stupid questions. Just stupid answers
Top
#250191 - 09/10/12 06:33 PM Re: Many ubbthreads sites seem compromised. [Re: smallufo]
JPFolks Offline
journeyman
Registered: 07/21/08
Posts: 52
Hey Guys,

I seem to have been hacked for the first time. The delete member button row below the member profile has been removed so I must use an old cached page to access that area and manually change the member number to access it. Perhaps this is a known or old problem for a version as old as ours. We've been hoping for the new version for years like many others but now we've been bitten.

Suggestions short of updating it? And perhaps if it's hacked, updating will be an issue? Our folks have actually been satisfied mostly with the site as is, short of wish it had functionality to react to Facebook, Twitter etc.

Thanks for any light you guys can shed!

Brian
www.justplainfolks.org
_________________________
Brian Austin Whitney
Founder
Just Plain Folks Music Organization
www.justplainfolks.org
Top
#250192 - 09/10/12 07:15 PM Re: Many ubbthreads sites seem compromised. [Re: Ruben]
luket Offline
member
Registered: 11/09/04
Posts: 198
Hi Ruben,

Yeah, my site was totally borked.
By reinstalling various directories I was able to recover my forums, but my portal page is gone as well as my layout - shoutbox etc.

What folder is that layout info in? I have backups of the various folders, but I'm nervous of overwriting stuff.

More info: I restored Styles and that didn't restore my layout. I then restored Includes from a couple days ago and that broke my site again. it it would seem that the Includes folder is indeed corrupt.


Edited by luket (09/10/12 07:22 PM)
_________________________
Member since November 2004
Gold Member since Feb 2008
Top
#250193 - 09/10/12 07:46 PM Re: Many ubbthreads sites seem compromised. [Re: smallufo]
luket Offline
member
Registered: 11/09/04
Posts: 198
Okay, it looks like the config.inc.php is borked.. not sure what's going on here. I have two copies, one allows me to see my forums but has no formatting or layout (just standard UBB), the other one shows layout but clicking on a forum gives me:

Not Found

The requested document was not found on this server.
Web Server at game-master.net
_________________________
Member since November 2004
Gold Member since Feb 2008
Top
#250293 - 09/18/12 03:07 AM Re: Many ubbthreads sites seem compromised. [Re: JPFolks]
JPFolks Offline
journeyman
Registered: 07/21/08
Posts: 52
Hi Folks,

Okay we figured out what was causing this problem. It seems Google Chrome is the issue and it is cutting off the bottom tabs for some reason. We got it to work fine with Explorer and Firefox. We have another known issue with Explorer where our users have to be in compatibility mode to use the site, so many switched to using Chrome including our moderators. So now we'll have to switch back.

We may be the only people still using our version of the software. With no updates on progress in quite some time, what should we do? We don't have the tech ability most seem to have. We bought the Gold License, have been licensed users since 1999, have unfulfilled tech support hours we paid for but I can't figure out a pathway forward but have no interest going elsewhere. It would really be helpful just to know what the plan is, or if there is no plan, about going forward with new versions and support beyond other users?

Brian
_________________________
Brian Austin Whitney
Founder
Just Plain Folks Music Organization
www.justplainfolks.org
Top
#250295 - 09/18/12 05:29 AM Re: Many ubbthreads sites seem compromised. [Re: smallufo]
Pilgrim Offline

enthusiast
Registered: 12/25/03
Posts: 211
Loc: NH, USA
We have been assured by the owner, HERE, that the update WILL be forthcoming and released in the not-too-distant future; c. 1 to 2 months. So, I wouldn't be throwing up your hands at this point as if all is lost. There are still quite a large number of customers using UBBThreads. It is a notorious mistake to judge the quality of a product or the health of a software/hardware company from what is posted on a user forum. Most often only a very small minority of people are active on such forums, many just 'lurk' and the majority don't even know they exist. grin
_________________________
Artificial Intelligence is no match for natural stupidity!
Top
#250299 - 09/18/12 08:59 AM Re: Many ubbthreads sites seem compromised. [Re: smallufo]
Gizmo Offline

Registered: 06/05/06
Posts: 15475
Loc: Portland, OR; USA
Well, if you have a gold license, and you aren't running the latest build, I'd highly advise that you get upgraded to the latest version for SECURITY.
_________________________
Forums: UGN Security & VNC Web Design & Development
UBB.Threads: UBB.Wiki, My UBBSkins, UBB.Sitemaps
Longtime Supporter, Beta Tester & Resident Post-A-Holic.
Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Top



Moderator:  AllenAyres, Harold, Ian, Ron M 
Shout Box

Today's Birthdays
No Birthdays
Recent Topics
Marking a topic as 'read' manually
by sw55
Yesterday at 04:29 PM
How to add AD island?
by Conrad
Yesterday at 01:19 PM
Need to update from 6 to latest: can't until server checked
by Digilady
06/17/13 08:17 AM
Shout Box
by Bert
06/15/13 04:15 PM
Calendar
by Bert
06/15/13 04:11 PM
Forum Stats
11000 Members
36 Forums
33988 Topics
183527 Posts

Max Online: 978 @ 06/24/07 10:19 PM
Random Image