Can't Stop the Hacking

[twonky]

Go here to see the results of the hacking:
http://www.debatenation.com/forums/showthread.php?t=196

Does anyone have any clue how to troubleshoot this stuff?

I've followed everything recommended to secure my site but it's still getting hacked regularly.

[twonky]

Go here to see the results of the hacking:
http://www.debatenation.com/forums/showthread.php?t=196

Does anyone have any clue how to troubleshoot this stuff?

I've followed everything recommended to secure my site but it's still getting hacked regularly.

They aren't doing anything destructive to the database. All I do is upload a saved template and everything is back to normal.

But how are they getting in? Does anyone have a clue?

[twonky]

Apparently I've made it on some list at this site.

http://www.v99x.com

[Steve Machol]

I take strong exception to your remarks on your home page about us not caring.

I've paid for both vBulletin and for the hosting for this account, but for some reason, neither of these companies care to do what it take to find out how these hackers are getting in and compromising their service.

I regularly worked with you on this in your support ticket - the first response exactly 2 minutes after we received the ticket and at least a total of 8 more responses throughout the day. In fact you never even responded to my last message on the 19th which stated:

I'm not sure what you are asking. Did you ever revert your templates as I instructed? If not, why not?

What happens if you create a new style again? Does the same thing happen with the new style immediately? Does it happen later as you said it did before?

If the latter then the issue is exactly as I said it was before. Someone has direct access to the database and that the Changing the database after the hacker has changed it over and over again is not going to solve this problem.

All indications are that this person has direct access to your server and database. And blaming us for not caring after all the work I did is simply wrong.

[twonky]

I take strong exception to your remarks on your home page about us not caring.

I apologize that you take strong exception to it, but when I have you guys telling me the host is responsible and the host telling me something in the application is responsible and I have no way of knowing who is telling me the truth, perhaps you could give me a little latitude in where I direct my frustration.

However, I've changed the wording so not to offend you.

All indications are that this person has direct access to your server and database.

Then according to you it's the host.

So, does anyone here have anything hosted with HostRocket.com? Are you having hacking issues?

[Zachery]

Actually there's been some talks about people being hacked via host rocket lately.

[Mighty Mouse]

I have host rocket and am beign repeatedly attacked. The staff here has worked with me, but finally are giving me the "contact your host" response as well. I don't mean to be a turd about it, but it is frustrating to say the least. The host is pointing at vb and vb at the host. So we are stuck. I am hoping this recent upgrade will fix, but I am reluctant.

Does the vb staff have any suggestions we can tell hostrocket? I simply don't know enough to argue with them, and I even forwarded your (vb's) ticket response to them, but still they point the finger at you.

*frustrated*

[Steve Machol]

That depends on exactly what is being done. If files are being changed or the database manually altered, then this is something that can only happen at the server level.

Also you are as ssecure from the vB end of things that you can be if you are running the latest version of vB and have followed all the suggestions here:

http://www.vbulletin.com/forum/showthread.php?t=172234

It would seem that if there were such an obvious exploit in the latest unmodified version of vB with all the recomnmended security measures in affect, then it would be happening to a lot more people than those on Hostrocket.

There are absolutely no known or confirmed exploits in the latest version of vB. When these are known we fix them and provide patches within 24 hours.

I and the Team work VERY hard on every reported hacking to (a) restore their forums and (b) ensure they are as secure as they can be. And I can tell you that in every instance I have dealt with, the hacking has been through either an older version of vB with known exploits, an unsecure add-on or change made to the code, or someone with direct access to that server and account.

So if someone doesn't want to believe us and they don't believe we take security seriously then there is really nothing I can say that will change their minds.

As for HR, I left them several years ago for a very good reason. Of course that was many years ago and things can change. That is all I will say about that.

[Steve Machol]

P.S. I looked at your ticket. The only way you could have been hacked the way you were is by someone manually changing the master templates directly in the database.

I'm sorry you don't believe that, but I also worked very hard helping you and investigating the cause of this problem for you. I have absolutely nothing to gain by lying and if I thought this was through a possible hole in vB I would have immediately brought it to the attention of the developers.

[mikesz]

This looks like a system hack rather than a site hack...

If you look at the page source, the hacker has included a <head> block inside the normal one that is generated by vB. It does not look like the hacker actually accessed the vb code but rather has figured out a way to insert a head block at run time which seems to make it a hosting problem. Other than the insertion of the head block, the vb codes appears to be intact.

Correct me if I am wrong.

regards, mikesz

[Mighty Mouse]

Steve, I am really not trying to be an ass, but that was a very defensive post. Did my post come accross as offensive? I was simply stating my frustration and that hostrocket people are bieng dicks about it. Which is why I came back here to ask what exactly we can tell them.

I'm sorry if you think I (we) are attacking you. You don't need to attempt to defend yourself everytime I post or send a ticket, I am simply seeking advice. Obviously the common denominator here is hostrocket. and I just may leave them, but for now I just want it to stop.

If you are not interested in helping/advising...then just say so, I would respect that answer and leave you and VB alone on this matter. I am simply looking for advice, I am not here posting to bash you or the software.

[Steve Machol]

If you are not interested in helping/advising...then just say so,

I did help and advise. That was the point. *sigh*

[Zachery]

He very clearly did help and advise solutions.

[Mighty Mouse]

ummm.....I know.

You know what, nevermind. I thought that post was saying that you were helping, amidst the frustration and that I was not in anyway attacking him or VB. Nevermind. I guess every post I make looks offensive.

[Mighty Mouse]

I did help and advise. That was the point. *sigh*

maybe I should have added the words "any further" to the end of that statement. You were very helpful in the begining....and I don't think anywhere I ever posted or any ticket I have ever submitted said that you were not helpful.