|
|
|||||||
|
Welcome to the Navigator Internet Solutions, Inc | Community forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact us. |
| Support & Questions Do you want to make public your Support Question? Feel free to post and you will receive a reply You don't need to be registered to post/reply here. |
 |
|
|
LinkBack | Thread Tools | Display Modes |
08-11-2006, 08:23 AM
|
|||
|
|||
My sites were hacked ... can't log in to cpanel
Both of my sites were hacked since last night. They are
www.ontherock.ca and www.freedomdesign.ca All index.htm and index.php files were replaced with a page with the title "_|_Owned!! By nEt^DeViL_|_ For Lebanon !", and it contains pictures with captions like "What CNN never shows you" and "Israeli girls write messages on a shell at a heavy artillery position firing into civilians inside Lebanon" and a pop up "For Lebanon ! ... T4ck3 7h3 M4x1MuM 53CUR17Y N3X7 71M3 ... Okay !!" (Click the maximum security next time .... okay). I can still access the files through ftp and it seems that only the index.* files have been replaced ... So I fixed those, but when I try to load any other page or subdirectory (including cpanel) I get an Internal Server Error: Internal Server Error The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, webmaster@baby.ontherock.ca and inform them of the time the error occurred, and anything you might have done that may have caused the error. More information about this error may be available in the server error log. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request. Help!?!?! 
|
|
08-11-2006, 09:51 AM
|
||||
|
||||
Mine also they have been hacked, Cpanel too.
Quote:
Last edited by Angel : 08-11-2006 at 09:55 AM.
|
|
08-11-2006, 10:24 AM
|
||||
|
||||
We're getting this checked by our security team as we speak. We will update you guys.
Francisco
|
|
08-11-2006, 10:39 AM
|
||||
|
||||
|
Our Security team has logged into the affected server, and are investigating the binary file or executable affected, that allowed the hacker to get access to the Administrator access.
Hacker has remplaced all the index.php, no mySQL e-mails or anything else appears to have been affected. We will update you shortly, thank you for your patience. Francisco
|
|
08-11-2006, 11:03 AM
|
||||
|
||||
|
Update from Security Team
Quote:
|
|
08-11-2006, 11:36 AM
|
||||
|
||||
|
Mail
Quote:
|
|
08-11-2006, 11:49 AM
|
||||
|
||||
|
Two Exploits have been found.
We're contacting the website owners to let them know, that Joomla! board and PM_addons have been the cause of this incident. Due to our privacy policy, we cannot disclose the websites URL's that were hacked. Unless the website owner posts it. We are still working on this issue, you're not in the dark.
|
|
08-11-2006, 12:12 PM
|
||||
|
||||
|
We are proceeding to upgrade the systems kernel - and secure the system.
The Permissions of the folders of the hacked websites have been changed, so the hacker will not be able to RE-RUN the application or hack us back again. As I said - We contacted the owners of the websites (our customers). To inmediattely Fix this problem, the change in permissions will prevent them from running the PHP scripts that caused this problem since the beginning. (Today) All the compromises by this guy are listed on Zone-H.org - a quick link: http://old.zone-h.org/en/defacements...today/page=28/ This is to provide you with a link of the Hacker's activity of TODAY - We were not the only web-host / server / provider that was hacker, or has been hacked. My personal opinion is that as long as it's fixed quickly, determined what caused the problem and resolve everything promply and in a timely manner is Priority #1 for us. I have received a personal e-mail from a customer (to my email @navigatoris.us) - that they are moving to a more "professional" web-host. I am not here to debate the decision, but I want to let you guys know, that we are an INTERNET web-host, notthing is 100% Secure in this industry. It's not like real life, that you can put hundreds and hundreds of armed guards in front of your house to feel secure. Hackers nowadays are smarter, and they mostly use FREE Software, that is commondly used - in this case - JOOMLA was used, along with a plugin called PM Addons. Since the Source code of the Free Software is always "Open Source" they can "read" the code and see if it's viable to run any hacking attempts. With that said - I would like to add that if any customer feels like we haven't corrected this issue in a timely manner or that we are not worthy of this month's payment from them - to contact me personally or send a ticket to me - I will get them credit for this issue. Thank you for your business, Francisco
|
|
08-11-2006, 12:56 PM
|
||||
|
||||
|
Server is currently power cycling - booting new kernel.
|
|
08-11-2006, 12:58 PM
|
||||
|
||||
Dear Mr. Francisco:
I at least, am very happy with this hosting service. Maybe can that exists other greater and important servants or solutions, but you have demonstrated to your professionalism and knowledge to me to do in many occasions offering customized excelent support until even in software that I use, thing to which is not forced. We are with you!
|
Linear Mode
