| View previous topic :: View next topic |
| Author |
Message |
Techie-Micheal
Support Team Leader
Joined: 14 Oct 2001
Posts: 19261
|
 Posted: Sat Dec 10, 2005 10:20 pm Post subject: Readme if your phpBB has been defaced |
 |
|
There appears to be a new worm on the loose. If your phpBB has been defaced, please do the following:
1. Immediately get full backups of your entire website including phpBB
2. Immediately get full backups of your database
3. Get log files
4. Do not delete anything!
5. Do not use these backups to restore your site.
6. These backups are to be used to send to the Incident Investigation Team, and only the Incident Investigation Team. If the poster asking for logs or backups does not have a Support Team rank, do not do anything they tell you to do.
7. Please use http://www.phpbb.com/support/incidents/ to file an incident report. Do not post in support asking for help.
8. Close your website (including phpBB!) until the IIT tells you it is okay to reopen.
_________________
phpBB3 - One step ahead the Intarweb
Last edited by Techie-Micheal on Tue Jan 24, 2006 4:00 pm; edited 1 time in total |
|
| Back to top |
|
 |
Techie-Micheal
Support Team Leader
Joined: 14 Oct 2001
Posts: 19261
|
| Posted: Sat Dec 10, 2005 10:28 pm Post subject: |
|
|
Users on 2.0.18 are not affected - this is targetting those forums still on versions around 2.0.10 at present.
_________________
phpBB3 - One step ahead the Intarweb |
|
| Back to top |
|
|
Techie-Micheal
Support Team Leader
Joined: 14 Oct 2001
Posts: 19261
|
| Posted: Sun Dec 25, 2005 12:14 am Post subject: |
|
|
As an update, we are seeing a few things in the course of our investigation.
- Tried and tested Santy and its variants are still out there.
- A new worm which I commented on back on November 10 at the ISC. This would explain the recent actions Google took to block searches for phpBB.
- Kaiten, Mare, and others which have been hitting AWStats, XML-RPC, Mambo, and other vulnerabilities hard recently are now hitting old phpBB vulnerabilities.
We will continue to assist those attacked. Per the Merry Christmas and Happy New Year! announcement, some of us will be out with family and friends. To those who have not heard from us yet, I will be getting back to you very soon. I've had college exams which unexpectedly took more time that expected, so I apologize for that.
_________________
phpBB3 - One step ahead the Intarweb |
|
| Back to top |
|
|
Techie-Micheal
Support Team Leader
Joined: 14 Oct 2001
Posts: 19261
|
| Posted: Fri Jan 06, 2006 12:35 am Post subject: |
|
|
We now have a tracker!
Please use http://www.phpbb.com/support/incidents/ to file an incident report.
If you have PM'ed either myself or NeoThermic and have not yet received a reply, please use the above address instead. Thank you.
_________________
phpBB3 - One step ahead the Intarweb |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
