Lodithia Hacked AGAIN!? 12/14/07

[dc277]

Lodithia (http://lodithia.com) ~ Please read the index page. We have ran into a huge problem. Somebody has completely cleared out our database.

[emma]

Viral told me she takes at least 2 backups a day, so hopefully this will fix up.

I really dont understand why idiots like destroying sites that alot of people enjoy. Whoever the hacker was, go find a job, ride a bike, do something productive instead of making peoples lives harder. o.O

[dc277]

Well if we gained any new members since the last back-up they will have to reregister.

The hacker COULD be the person who put the cookie grabber in the News. Since I guess only the FTP password was changed, not the Mysql password.

[sinthuxgx]

that's pretty genius to have the 'hacker' who went ballistic on the site still have the password to the database

[dc277]

Well the only person to change the password to the database is Jared .Since you need to edit the PMA config file. Lodithia doesn't have access to it.

[Andrew]

Ack. I need to get back active on the site to help stop this from happening again...

[stuffradio]

That totally sucks... good luck Lodithia!

[OwlManAtt]

Or there could have been a SQL injection vector that somebody found.

[dc277]

Yea, that's what I personally think. But I"m not 100% positive.

[Viral]

Yeah I have the backups, don't worry :)
I'm also going to do some sleuthing and find out who cleared the database. Then we'll proceed from there.

[dc277]

How will we figure out who did it? Is there even a way?

[Viral]

Look at records for query executions. :) Find the IP address, IPWhois the IP address, and go from there.

DB restored, btw.

[stuffradio]

They probably did like.. what's your username?

Robert'); DROP TABLE users; --

Google that, there is a funny comic strip about sql injection :P

[cpvr]

How will we figure out who did it? Is there even a way?
Logs are your best friend.

[Leon]

Good luck Viral... ^^
I'm a complete programming-illiterate, so this may sound foolhardy - and if impossible, disregard - wouldn't it be possible to implement something so you can see their IP on the last-login? o-O; That way, you just have to match the IP to the user and wa-bam. xD
I know on my Runic's cPanel it has the last login's IP, but... :)
Well, good luck =)

[dc277]

The problem is, is that we don't have cpanel. We only have access to FTP and PMA.

[EatRamen]

The problem is, is that we don't have cpanel. We only have access to FTP and PMA.

I didn't know that you needed to have CPanel to get IP addresses or to log things.
I do both all the time without it.