What’s Going On!!!
Ok… a client of mine just got hacked.
Then the Jodo Host Forum was no longer reachable.
Then after replacing the initial index file in the client site his site was EXTREMELY slow.
Now his site seems back to speed for the moment.
Jodo Support Forum just came back up.
Now I gotta fixed what this BlackWolf muslim hacker did. I’ll examine the other hacked post first for answers.
Re: What’s Going On!!!
We are working on this issue. Tanmaya will update shortly.
Re: What’s Going On!!!
For the hacker, we need to view the logs for you. As stated in the other forums, this is mostly becasue of outdated software.
On Forums, Yogesh has been working on it for some time as there is some abuse taking the unix2 server to a very slow state. It is possibly resolved now but I have not had contact in a while with the other technical staff.
Re: What’s Going On!!!
Looks like it was server-wide. My clients also got hacked, all index files replaced.
cracker mentioning some setuid thingie, so it might not be old software flaw but privilege escalation?
Re: What’s Going On!!!
This hack is affecting all my Linux sites. 8o
Please provide us with details about what, if anything, we should be doing to fix this for our customers.
My customers sites have been showing as hacked all morning now and there is nothing posted about this at the network page or here.
I have replaced index files on my own sites, as I have the back ups. But going through all my customers websites will be a nightmare. Is there not a way, to restore index.@ files with previous versions using a script on jodo’s end of things?
Also, how did they get in?
QuietCalm
Re: What’s Going On!!!
My sites on web5 also got hacked.
I need an explanation on how this happened, seems that all web5 is hacked.
What new measures will be done to prevent this.
This is terrible!!!
Re: What’s Going On!!!
Web5 has been exploited. We are looking at a potential exploit
All hacked files will be restored, please be patient and I’ll make an announcement shortly
Re: What’s Going On!!!
It is a customer(who has posted here) forum software package that was hacked. It was able to overwrite files owned by httpd user.
how was able to hack the whole server??
not hacked, only was able to overwrite and create files owned by httpd (apache) user.
Tanmaya has sent me the logs, but it contains the users name
it afected apache all sites where hacked because of this.
what forum software was it?
this is disturbing..
From what I’m told, it was an exploit that only defaced index pages.
So we are going to run an index restore.
We are going through the logs extensively.
simpleboard was the software.
As for restore, we have all the index files to restore back again. We are going through that process now.
Dear all,
As i know now, i or my scripts was reason for todays hackers attack. I would like to apologize for all troubles i made to everyone. I would also like to thank Jodo for helping me and all users who have problems because of me.
Please accept my apologies and sorry for my bad english.
Thank You
Tom
Just to let you guys know here. We have Deepak, Yogesh, myself, Stephen working on this.
Tanmaya is travelling and he has been continually logging in remotely via his cell phone or at internet cafes to monitor the situation.
Tom,
We were not planning to ever say anything bad about you or blame this upon you, we would never do that to customers 
We will work with you to get this fixed permenently while at the same time preventing what has happened today from being able to happen again.
Tommyzzzy…
Look here man, in the hosting biz, this stuff happens. Don’t sweat it too much.. live and learn.
I been reseller hosting since 1996 and I can tell you that this is not the first time this has happened to me in this biz. 
The anger is solely put towards the idiot who went out and created this friggin hack in the first place.
Thanks for the apology… some would not even post what you did. 8)
And thanks to jodohost for beng on top of this and getting us back in biz.
QuietCalm
Re: What’s Going On!!!
[QUOTE=QuietCalm]
This hack is affecting all my Linux sites. 8o
QuietCalm
[/QUOTE]
This client is on web5… what servers are those of you that got hacked on?
Steve… I don’t see any server called unix2 in my aliases… would that be web2?
[EDIT]
I let my post sit a while before hitting post… you can ignore this since I didn’t see the other posts yet… But I do have another questions…
Re: What’s Going On!!!
I am moving this to the Outages forum so everyone can see it.
STEPHEN… it lokks like the hack also deleted any graphioc image that starts with “logo*.*”
4 sites of mine have that issue as well.
Looks like I was stupid using such common names for graphioc files on my websites.. I am learning that mistake. :rolleyes:
QuietCalm