Hacked Again!

[Parsad]

What a fine coincidence that we've been hacked twice in a week!  We've never had such a problem in a year and a half, and now suddenly twice in a week.  What are the odds of that?  ;D  Being a Fairfax shareholder, I'm not one who bows down to coincidence in such cases.  Anyway, I've finally got it up and running today.  I apologize for the site being down, but hey it's just a coincidence!  Cheers!

[StubbleJumper]

Sanj,

 

Sorry to see that you've been hacked.  I wish I were more technologically advance, so I'd be able to offer help....but alas, I know more about baseball than web hosting.

 

SJ

[goldfinger]

Please do not apologize. Thanks again for this board.

[Sea Island]

Thank You for getting the board up and running, is there something that we can do to assist you?

[RickMayhew]

Very sorry to hear about this as it creates a lot of extra work for you on top of all that you are doing already.  I have noticed my Norton Security has given me several warnings when I've logged onto this site in the last month.  This is not a complaint but just information in case it is of any benefit.  Rick

[Guest longinvestor]

Very sorry to hear about this as it creates a lot of extra work for you on top of all that you are doing already.  I have noticed my Norton Security has given me several warnings when I've logged onto this site in the last month.  This is not a complaint but just information in case it is of any benefit.  Rick

My Norton Security did the same, although I thought it was because I was in Asia at that time. Thought maybe it was the IP address there...

[EricSchleien]

Thanks for clearing up the issue and getting the board up and running again.

[Dynamic]

I use AVG Free security and it too advised of what I think was a redirect to a "potential attack site" which it blocked, IIRC, in the hours before the site went down for the second time. I suspect Firefox browser would also have warned me if AVG hadn't got there first. I don't think I actually clicked any links or banner ads before it reported the blocked redirect.

 

It's possible that it's an attempt to get your readers to inadvertently vist another site, to install malware from that site, or to visit a phishing site that looks like yours where it asks them to enter their passwords, either with the aim of hacking their accounts or editing their posts here or hoping their passwords they use for other purposes are the same and gaining access to other resources they use.

 

Hope you can avoid the hassle of this happening continually.

 

My only advice is to change the passwords for the server that is running apache (as I think I noticed while the boards were down) and ensure you use a different password for administering the forums, and ensure there are no passwords or accounts left in a default state (e.g. a guest account that might be used for privilege-escalation attacks or a default admin account in the forum software) and if you have to log into the server remotely (rather than having direct access to the machine), try to ensure you only enter your password over an encrypted link (e.g. SSH as opposed to TelNet which sends passwords as plaintext) in case there's a packet sniffer installed between your machine and the server. Also, your personal computer or laptop from which you type the password might have been infected with a key-logger or packet sniffer that reports your passwords to an outside party in some way, so a virus scan or malware scan may help give you peace of mind. I'm not an expert on apache but I've learned just enough to keep safe and to know where to search in the event of thinking my PC is infected.

[Parsad]

Thank You for getting the board up and running, is there something that we can do to assist you?

 

Thanks very much SeaIsland!  No, there isn't a whole lot that can be done other than making sure software is up to date, passwords are secure and I make daily backups.  I used to make weekly backups, but now I make daily ones...we lost alot of good posts during that week after the Berkshire AGM.  I also completely cleaned out all files before reinstalling the database, so there was nothing...no hidden files or anything.  So far, so good!  Cheers!