[NOTICE] How to secure your site against recent attacks

[kat]

* Kat sticks this topic.

[PSNick]

Thank, but apparently it's too late for me.
I have done anything that appears here and banned the user, but what can i do to get the theme choose page back? Or whatever problem this exploit causes too?

Thanks.

[Dzonny]

Ok, but i cant belive this kind of mistake is done with this last stable version... :/
I've disable uploads for now, and i hope that patch will be released soon...

[PSNick]

Hello,

For the ones that had this code injected, appart from doing everything in this post to prevent future abuse, please take a look here for the solution. At least what you have to do to remove the code.

http://www.simplemachines.org/community/index.php?topic=309957.0

[L'AltroWeb]

Can we test to disable (with .htaccess) php-engine from this directory?
krisbarteo is already registered in more SMF forum:
http://www.google.it/search?source=ig&hl=it&rlz=&=&q=krisbarteo&btnG=Cerca+con+Google&meta=lr%3D&aq=f&oq=
in any case i've put this htaccess in my attachments folder:

Code Select Expand

# Prevent Directory Listing
Options -Indexes

# Prevent Direct Access to Program Files
<Files *>
Order Deny,Allow
Deny from all
Allow from localhost
</Files>with this it can't use full url eg: mysite.*/forum/attachments/avatar_xx.*
-
and i've prebanned krisbarteo user.

[uncajesse]

http://www.google.com/search?q=krisbarteo&lr= [nofollow]
default language for whatever your Google normally is


The exploit appears to be in the EXIF data, and executed after the JPEG is uploaded through the avatar uploading functions.  I wonder if the crap bothers to check where the actual avatars are uploaded to?  For now I changed where the avatars get uploaded to, as well as the location for the rest of the attachments.

What might stop this dead in it's tracks for now is if all avatars are forced to be converted into PNG.  Sort of like this

but gets run on all uploaded avatars.

Another thing that wouldn't hurt is to pre-create a user named krisbarteo on your forum, and then ban it.  You can then also track the IPs that try to use it.

Just kicking out some ideas here.

[JBlaze]

http://www.google.com/search?q=krisbarteo&lr=
default language for whatever your Google normally is


The exploit appears to be in the EXIF data, and executed after the JPEG is uploaded through the avatar uploading functions.  I wonder if the crap bothers to check where the actual avatars are uploaded to?  For now I changed where the avatars get uploaded to, as well as the location for the rest of the attachments.

What might stop this dead in it's tracks for now is if all avatars are forced to be converted into PNG.  Sort of like this

but gets run on all uploaded avatars.

Another thing that wouldn't hurt is to pre-create a user named krisbarteo on your forum, and then ban it.  You can then also track the IPs that try to use it.

Just kicking out some ideas here.

The best idea now is to just disable avatars and attachments.

Or set it up so that only members with say 5-10 posts or more can upload avatars/attachments.

[uncajesse]

http://www.stopforumspam.com/search?q=krisbarteo [nofollow]
http://www.stopforumspam.com/search?q=MagicOPromotion [nofollow]

[edit]
ah nevermind, it's probably just one person, or two friends.  those IPs are very similar.
[/edit]

[JBlaze]

http://www.stopforumspam.com/search?q=94.142.128

That's how big this attack has gotten.

[Kenny01]

He's a spam bot, not human.

[uncajesse]

and
http://www.stopforumspam.com/search?q=94.142.129 [nofollow]

and yeah, we know it's not someone MANUALLY doing this.

I'm blocking 94.142.128-129.* right now.

[Filipina]

OMG my forum 1.1.8 has a special avatar upload mod on registration.

[JBlaze]

OMG my forum 1.1.8 has a special avatar upload mod on registration.

Just to be safe, install the Stop Spammer mod I referenced in the OP. This will prevent this IP range from regeistering.

[Filipina]

Ok  thanks but it says

This mod will prevent spam signups as it cross-checks all registrations with the Spam Blacklist.
Any registrations that check positive will be sent to the Admin approval bin.

Since avatars upload on registration will I not have the infected file already on my server, even if the registration goes to Admin for approval?

[JBlaze]

Actually, that is a good question. I would disable the avatar on registration then until the security patch comes out.

[Filipina]

Ok thanks i just turned regiatration off.  The mod was special made and I do not know how to get it off the registration page Hope a patch comes out soon. 

[Dzonny]

http://www.stopforumspam.com/search?q=94.142.128

That's how big this attack has gotten.

This is really big list, so prebann of krisbarteo dont have case?

[dcmouser]

I've made a fairly long post about our findings, which suggest some patches that should be made, here:
http://www.simplemachines.org/community/index.php?topic=307717.msg2057480#msg2057480

[lars_n]

We got hacked as well on 1.1.8

http://www.pclinuxos.de/smf/

Same behaviour - all relevant PHP files were infected with the encrypted codelines. The forum-error-log in the backend was completely full (735 sites) with errors, caused by the base64 encrypted lines. I performed a full recovery last night.

The user "krisbarteo" was registered as well and he uploaded that .gif avatar which contained the code. Perma-banned him now and disabled upload of avatars and attachments for now.

IMHO this warning should be visible in the admin backend of the SMF.


Regards

[flid]

Over the last two weeks my site has been attacked by Phishing files. They were uploaded into various files on my server. I removed them, however my site yesterday was sending out phishing emails somehow. i looked for files that shouldnt be there, but to no avail.

I've now uploaded a complete fresh install of my site, is this to do with this attack? Or do I have a different problem?

**edit**

Looking through my site files (pre clean up) I found two files in the sources folder titled ghana .php and 1.php the 1.php was a phishing mailer.

I have no idea how they got these onto my site. However I havd disabled all attachments and avatars until the patch is released.