Forum Issue

**Satsearching** · 13-04-2018, 04:47 PM

The forum has been attacked, this happened last month.

It appears NJ's account was hacked and something using his admin account via a French IP, made changes to the site templates.

The templates have been cleaned now, and as we cannot contact NJ, I have had to demote his account away from Admin status for protection, until we can contact him.

We also found a dodgy plugin that was also a hack, this has now been removed.

This has led us to think it is time to update the forum software to Vbulletin V5 as we don't know if anything else has been changed, so the forum may be off-line over the weekend while we take backups and get our heads around VB5.

Hopefully everything will be complete Sunday evening.

**PaphosAL** · 15-04-2018, 11:07 AM

a11 www and sql backup tarballs are all new in /tmp on our server from 0300-0400 this morning, SS.

And I have just uploaded them to gdrive as well.

AL

**PaphosAL** · 18-04-2018, 11:42 PM

Should have mentioned that the www and sql tarball backups are done daily to /tmp on our server @ silly o'clock.

a11 is twice weekly to /tmp on Wed and Sun, half an hour later. All this is auto on cronjobs. I double backup these tarballs manually every Wed and Sun to gdrive cloud, for belts 'n braces purposes. Roughly 2GB in all..

Cheers- AL

**Satsearching** · 19-04-2018, 08:55 PM

AL

I never got round to this forum upgrade work, other legit Charity work got in the way which took lots of planning which I had to attend, plus day job too.

Cleaning of the forum injections seem to work well, so no big risk now, but will hopefully look at the VB5 upgrade when I get chance soon.

SS

**PaphosAL** · 19-04-2018, 09:32 PM

No rush, SS. Why not sit back and watch carefully, for now? To see if this frog low life tries to hack in again via your, my, or Renny's admin creds?

Personally, I suspect that NJ's original creds were weak and widely distributed, hence him being the naiive vulnerable target in this case...

Cheers- AL

**Satsearching** · 20-04-2018, 10:42 AM

AL

That was the case, Renny's son put NJ's email into the below and it revealed his details were widely distributed as you suggest!

https://haveibeenpwned.com/