Recent Topics
  1. b2evolution CMS Support Forums
  2. b2evolution Support
  3. General Support
  4. [2.x] RSS feed hacked!

[2.x] RSS feed hacked!

1 Jan 21, 2010 03:29    

My b2evolution Version: 2.x

Hello all,

My RSS feed got hacked.

It seems that someone created a fake .gif file with a file name similar to a .jpg file already in my blog/media file.

Sometimes when going to my blog admin page, I get an error in the box where it usually says my version of b2evolution is up to date, and the error is similar to the error that interrupts my blog posting in the feed:

Notice: Undefined index: HTTP_A in/hermes/web03/b513/pow.rosspcom/htdocs/blog/media/MaldivesUnderwater3.gif on line 36

Then, in the RSS feed, the rest of the interrupted post has paragraphs more or less like this (with a bunch of the stuff like "play online keno" being links which I haven't clicked.)

These types play online keno of programs instead of protecting your computer will plague your computer with popup advertising urging you to purchase the full version of the program and will bombard you with fake scans warning you of viruses and spyware installed on your system. Any time online casinos usa you change a setting or configuration add or remove software/hardware the registry will get updated. Avoid using (online roulette scam) CAPITALS. Certain areas play craps online of healthcare are subject to greater risk than others. However the online slots for money scope of BPM software is not limited to planning.

I deleted the .gif file but I doubt that's going to fix the problem by itself.

If anybody else can suggest where I might have a file that's been hacked, how to fix it, and how to prevent it in the future, I'd appreciate any help!

Thanks,
Ross

Back to top

2 Jan 21, 2010 06:18

Search for odd files in the media folder. Also check
- config files in /conf/
- stub files like index.php or blog1.php etc.
- .htaccess

If GIF files get executed as PHP files there should be something like this in your .htaccess

addhandler php5-script php gif

Delete it

It's probably the best time to upgrade b2evo since you'll upload clean files ;)

Back to top

3 Jan 21, 2010 14:44

I don't see any other recently modified files except one .htaccess from a week earlier which added some sort of file type. I renamed that file.

I noticed that the offending .gif file reappeared overnight after I had deleted it so this time I just deleted the contents and left it as a blank file.

I need to figure out where the code is that's calling the bogus file...

Back to top

4 Jan 21, 2010 18:59

I hope you changed FTP and hosting passwords already.

If you don't want to upgrade you should at least upload clean files of the same b2evo version you are using.

If b2evo is not the only script on your server consider checking the other scripts for injections too

Back to top

5 Jan 21, 2010 23:49

Hey Sam,

Haven't changed passwords yet, but I guess I should.

I have a vague recollection that I was hacked some time back but not in my RSS feed.

I have the newest version right now (of b2evo) I believe, but I could reload the stuff and change passwords.

Is there some way someone could have modified that file through some sort of script without having cracked my password?

Back to top

6 Jan 22, 2010 01:16

Is there some way someone could have modified that file through some sort of script without having cracked my password?

A hacker definitely was able to edit your files through FTP or SSH or maybe from your hosting control panel. Once a bad script is added to your file/files it could be executed remotely.

Which means it would be possible to hack your files again even after you change all passwords.
That's why it's important to find and kill the malicious script, and not only the files it created.

Back to top

7 Jan 22, 2010 04:33

I hear you, Sam, and I can't find a newly modified file anywhere.

Back to top


Form is loading...