I've been hacked

WoodierMutley · Post by **WoodierMutley** » Tue Nov 28, 2006 4:33 pm

My phpbb has been hacked, I have no idea how it has been done. I was hoping someone here might be able to help me prevent this from happening again. To fix it I have upgraded from version 2.20 to 2.21 and also had to delete a script line out of my alt template in the overall_header.tpl. All htm files on my site also contained this script.

<script type="text/javascript" language="JavaScript" src="http://jsp.systemdoctor.com/functions.j ... "></script>

I am hosting on a Windows server 2003 using mysql.

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Tue Nov 28, 2006 4:53 pm

do you have anything to do with either of those websites?

if not, then I suggest you contact them both to find out why someone is hacking your board and using the scripts from http://systemdoctor.com/ to redirect to that clan site.

you also might inform the people at http://systemdoctor.com/ that their software is being used this way.

I am not sure that phpbb was hacked, it looks like they came in through thte rest of your server, once in your server files, then any program on the server is open to hackers. thre is nothing phpbb can do about that.

robert

WoodierMutley · Post by **WoodierMutley** » Tue Nov 28, 2006 5:01 pm

My site is www.ClanFromUncle.com and the systemdoctor part is nothing to do with me. It seems that my site is mentioned in the script for some sort of tracking purposes.

I am not really trying to say the hack was the fault of phpbb, more saying has anyone got any ideas how it happened. I have spoken to my web host and kind of got a poor response.

I quote their reply "I am sorry to hear that your forum has been compromised.

We recomend that you run a security audit on your forum, and contact the developers to check for any security patches or updates.

In our experience, these type of compromises are usually as a result of exploitable scripting issues, or permission issues."

Dave Bean · Post by **Dave Bean** » Tue Nov 28, 2006 5:10 pm

You might check with your host and see if other forums on the server have had the same issue. Perhaps the hack was at the server level, not the phpBB level?

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Tue Nov 28, 2006 10:45 pm

never heard of this type of hack at all.

but that script seems to just be redirecting people to your clan site. why would a hacker do something like that.

It looks like someone with access to your board did this for some reason.

robert

advertisements