Simiens Crew, por um mundo melhor

ok so please tell me that if they polite enough to leave a call sign, then they are at least willing to inform the devs of how they did it? :S

I SAW THAT TOO!!!

portuguese script kiddies....

for a better world????

Quick somebody call GIJOE,

PROTECTOR Needs to know!

they did leave a call sign, we are still determining the point of entry. I will follow up once I know more.

Its a permissions thing on the server, Ima guessing..... Not sure how though.

protector is installed on xoops.org. It looks like they gained access through an unpatched vulnerability in awstats. Awstats has been removed from the server, but so far it looks like the point of the attack was only graffiti.

Well, at least the hole has been found.

yep that's good to hear :)

at least that's all it was is graffiti, and it identifies 1 more vulnerability that wasn't discovered till now :) s'pose that's 1 good thing about em..

Quote:

It is never a good thing, only slightly less nasty than a full defacement. If someone spray painted my garage I'd be very upset.

Anyway, I missed the excitement but can assume that it was the same bandits that make it around to a lot of sites they scoop off this very board. I've seen attempts like this on mine in the past.

stats, if that is where the hole was then it should give pause to anyone using it (it's 3rd party, not core). I know stats are popular on a lot of sites but I've never been comfortable with them. Much safer and more efficient to keep that a function outside of xoops all together (same for database admin). Pulling aggregate info into a block is ok if done right but live stats and blingy numbers aren't worth the risk IMHO.

Oh, they are reading this thread right now... yuck.. have a good laugh jokers.

FYI - awstats is a seperate application, not a xoops module. The vulnerability they exploited was "announced" on 1-17, but for some reason was not posted to the bugtrack mailing list.

Has awstats been confirmed as the entry point for these Simiens Crew attacks? One of my xoops sites just got attacked by these guys. As I don't admin the server I cannot easily check the logs etc. The machine also has telnet and ftp ports open so I wonder if they came in via another route...

The site was xoops 2.7.3.