United3dArtists Archive

Finis · Post by **Finis** » 25 Aug 2016, 22:34

We are having trouble with PHP. The front page is down. Hostgator tech support is working on it.

Edit: Tech support says we are pointed to the wrong name servers at Godaddy. Only Prodigy can change that. After he does the forum may be unavailable for up to 48 hours.

clintonman · Post by **clintonman** » 26 Aug 2016, 01:27

How come the forums are still working? Doesn't it use the same server?

That is weird, I went to http://192.185.35.43" which is supposedly the united3dartists address and it does show as hostgator.

Finis · Post by **Finis** » 26 Aug 2016, 02:08

It's all on the same server on the same account but there can be many websites on one account. The forum and the front page/site their own entities made with different software. The server is not down. (Huh. Reading that it feels negative. Not meant that way. It's just info.)

clintonman · Post by **clintonman** » 26 Aug 2016, 14:59

It's looking really interesting now. Now we sell telephone equipment.

Finis · Post by **Finis** » 26 Aug 2016, 16:03

Yeah, I'm thinking something might be wrong, maybe, could be.

Looks like bad advice from tech support about the name servers. It did seem strange that we could get to the front page if the name server info was wrong or that such would be related to trouble updating PHP. Too bad since that means the problem isn't solved. At least it doesn't effect the forum, yet.

I spent all day yesterday with tech support. I'll have a helper today to catch up on lawn work so I can't stay with tech support much today. I'll get the correct name server info., probably the same as it was, and Prodigy can change it back and be annoyed. (If he would share the godaddy login with someone here he wouldn't have to do this stuff.) Tomorrow for support on the PHP problem again. I don't think they can figure out what it is.

If I have time this morning I'll post more info. about the problem and you all can help by searching the web for solutions.

Edit: Cpanel shows that the name server ID's they gave me yesterday are right and whois shows that they are different at godaddy (how do we get here at all?). Good since correcting them may still fix the problem. Prodigy probably changed them and there is chaos while that filters through the web. (up to 48 hours of offline or apparently chaos) Will ask tech support why seeing another site.

Edit: Tech support says Chinese page doesn't look like a hack. The name servers have not been changed as of now (11:30 mountain time) (http://leafdns.com/index.cgi?testid=CF63B4C9). Support says wait until that is changed and propagates through the web. See what happens.

Finis · Post by **Finis** » 26 Aug 2016, 23:56

It looks to me like the front page has been hacked. Obviously, now it shows some Chinese site. Some legit files have been modified today. I found suspicious files. Some are php that generates other files full of random words in a suspicious directory. Those files' names if used as website names lead to similar Chinese pages. One file contains what appears to be types of essays. Maybe they are selling essays to cheating students. Tech Support ...

Edit: Hacked, sliced, chopped, and diced. The front page. No evidence of trouble with the forum. Tech support lead to a salesman for Sitelock, a partner of Hostgator, who could do nothing but try to sell Sitelock. They can de-hack it and protect it but even their cheap service is very expensive.

Edit: Hostgator has a "Root Cause Analysis" service (here) for $37.50. That should find how they got in. No charge if they don't find it. I have a backup of everything (front page and forum) from August 6. Restoring that would reset the forum and front page back to then. I propose that we get the root cause analysis, fix the vulnerability it finds, and either restore the backup (and re-upgrade Joomla if needed) or attempt to manually clean up the mess.

Forum members, what do you want to do?

The name servers look like a separate issue but the correction should be done.

clintonman · Post by **clintonman** » 27 Aug 2016, 05:07

Can you examine any log files to determine the user of the new/altered files? An ftp log would say the last user to transfer files in, assuming it came in via ftp.
In any case I think you are in the best position to determine what needs to be done. No one else can see or fix the problem.

Finis · Post by **Finis** » 27 Aug 2016, 15:53

Here's my recommendation:
- We pay Hostgator the $37.50 plus tax for a Root Cause Analysis then we fix the vulnerabilities found.
- We erase the front page and build a new one from scratch. Delete all its files. Uninstall Joomla and reinstall. Everything there starts fresh.
-- The forum should be unaffected by this action since it is a separate entity from the front page/site. Backups before action of course.
- We sign up for Cloudflare's free service to help protect us. link
- We make our own backups every month or two weeks.

Permission? Do the forum members grant permission to do the above including permission to spend some of the hosting donation money for a Root Cause Analysis by Hostgator?

In the future we should consider moving to a better host. That wouldn't make everything perfect forever but customer service and security would be better. If you want to do that let's do it before renewing hosting with Hostgator.

RAYMAN · Post by **RAYMAN** » 27 Aug 2016, 19:15

Finis wrote:Log files and more is what Hostgator does in a Root Cause Analysis for $37.50 plus tax no doubt (if they find something).

Here's my recommendation:
- We pay Hostgator the fee for a Root Cause Analysis then we fix the vulnerabilities found.
- We erase the front page and build a new one from scratch. Delete all its files. Uninstall Joomla and reinstall. Everything there starts fresh.
-- The forum should be unaffected by this action since it is a separate entity from the front page/site. Backups before action of course.
- We sign up for Cloudflare's free service to help protect us. link
- We make our own backups every month or two weeks.

Permission? Do the forum members grant permission to do the above including permission to spend some of the hosting donation money for a Root Cause
Analysis by Hostgator?
Im afraid itd not that easy! Looks like there is someting funny in the
forum pages too at least I bumped into a lot of code on too of some of the pages when
using my Android cell phone!!!:( And this was yesterday!!

In the future we should consider moving to a better host. That wouldn't make everything perfect forever but customer service and security would be better. If you want to do that let's do it before renewing hosting with Hostgator.

RAYMAN · Post by **RAYMAN** » 27 Aug 2016, 19:19

Im afraid itd not that easy! Looks like there is someting funny in the
forum pages too at least I bumped into a lot of code on some of the pages when
using my Android cell phone!!!:( And this was yesterday!!

Finis · Post by **Finis** » 27 Aug 2016, 19:26

Where did you see the code? Did it appear briefly at the top of the screen as the forum page appeared? That occurred occasionally from attempts to upgrade PHP.

Has anyone noticed anything strange about the forum since yesterday?

EDIT: No luck getting feedback on whether forum members want the actions previously noted to be done. So there is now a poll on that.

Draise · Post by **Draise** » 27 Aug 2016, 22:07

I personally have not seen any issues though I use it every day just to casually see what's up on multiple devices.

Draise · Post by **Draise** » 27 Aug 2016, 22:08

Though the "Your host needs to use PHP 5.3.10 or higher to run this version of Joomla!" on a blank page on the homepage is showing...

clintonman · Post by **clintonman** » 27 Aug 2016, 23:47

Draise wrote:Though the "Your host needs to use PHP 5.3.10 or higher to run this version of Joomla!" on a blank page on the homepage is showing...

That's what I used to get before the chinese page. The message makes no sense since the system information from Joomla, when it was working, said php was version 5.3.29

clintonman · Post by **clintonman** » 28 Aug 2016, 00:04

Finis wrote:Here's my recommendation:
- We pay Hostgator the $37.50 plus tax for a Root Cause Analysis then we fix the vulnerabilities found.
- We erase the front page and build a new one from scratch. Delete all its files. Uninstall Joomla and reinstall. Everything there starts fresh.
-- The forum should be unaffected by this action since it is a separate entity from the front page/site. Backups before action of course.
- We sign up for Cloudflare's free service to help protect us. link
- We make our own backups every month or two weeks.

Permission? Do the forum members grant permission to do the above including permission to spend some of the hosting donation money for a Root Cause Analysis by Hostgator?

In the future we should consider moving to a better host. That wouldn't make everything perfect forever but customer service and security would be better. If you want to do that let's do it before renewing hosting with Hostgator.

All sounds good to me. I just don't know about that Cloudflare stuff, I hear good and bad things about it.

Finis · Post by **Finis** » 28 Aug 2016, 01:36

Yeah, should look into cloudflare more before signing up. I think some kind of protection like that is needed but it is usually very expensive. If cloudflare and their free version is ok then it is hard to beat free. But why is it free? Research to be done. Reviews and reputations of things on the web are hard to gauge. They are often influenced by the provider giving good reviews or the competition giving bad ones or other dishonest reviews.

That's a place where forum members can help. You all research cloudflare and others like them or sucuri to find some decent services that protect vs. hacks and maybe have clean up services when hacked and are cheap.

I think the PHP problem is a result of the hack. Worry about that later.

Finis · Post by **Finis** » 28 Aug 2016, 15:25

I'll look into cloudflare more and maybe try their free thing on my site.

I'll make a backup of the forum today. Not doing anything about the hack since Hostgator needs the it active to investigate it if we choose to have them do it. They don't clean up they just try to sell Sitelock.

When we had the malware not long ago I saw a directory called malware test. I thought Prodigy made that to work on the problem. Now I see that the current hack creates files in there. So the hacking has been happening for a while.

Let's think of various ways to deal with this. Then if the poll (here) says to consider other options we will already have considered some.

Here's some options. What others can you think of?
- Do some or all of the actions in the poll.
- Pay big dollars to someone like Sucuri to clean up and protect.
- Find cheaper services that does clean ups.
- Try to secure our site and clean up "manually".
- Combine moving the forum to a better host, which I recommend doing, with clean up. We could migrate only the forum to the new host and build a new front page there.

Finis · Post by **Finis** » 12 Sep 2016, 02:05

Something is happening. I'm not sure if Prodigy is doing something or what. He really should communicate about these things (no reply to email so far).

I had Hostgator restore a backup so some recent posts are gone. There was nothing in "view active topics" afterward. Why the restore ...

Earlier today I saw some errors similar the the PHP upgrade attempt ones flash at the top of the screen when I tried to log in. Then I was listed as logged in but could not post. http://united3dartists.com" was being redirected to http://united3dartists.com/forum" . The redirection seemed strange for hackers to do. They would want visits to the hacked front page.

Examination of the account shows that the front page files are gone which is part of what I was going to do. There is a script that just redirects visits to the front page to the forum and measures have been taken to block China and a couple of other countries from here. That looks more like Prodigy is fighting the hack than something hackers would do. So, I'm waiting to find out if he is active before doing anything so we don't get in each other's way.

I appreciate anything Prodigy may be doing, and all he has done, but the unavailability and lack of communication, if that is happening, is not good. We need to be able to maintain u3da, which the members pay the bills for, when he is unavailable. He should "hand over the keys", top access to all of u3da's resources, so the site can be maintained in his absence.

Edit: Prodigy is working on it. I will stand down and only offer suggestions or do assigned tasks so we don't get in each others way.

stan · Post by **stan** » 12 Sep 2016, 12:28

yes Augusto was here trying to fix front page. I guess he didn't read any of the posts relating to the hack first. He emailed me saying he couldn't post after removing the front page. I told him neither could I log in or post. I don't have an email for you Finis so couldn't relay what Augusto was up to. At least it's back up and the chinese page junk is gone.

I see posts are gone after august.

edit: I noticed on posting this there is code on top during post loading that was on forum main yesterday. I wasn't fast enough to read it but I think it's the same lines of code which were on main which should be removed.

Finis · Post by **Finis** » 12 Sep 2016, 16:31

I got email from Prodigy and we are coordinated now.

The forum login problem is temporarily fixed. Log in works for now. Maybe a permanent fix will happen soon. It is caused by incompatibility between the old version of phpBB forum software and new versions of PHP. The code at the top is part of that problem.

I thought Prodigy's activity was more hacking and had a recent backup restored. That removed the recent posts.

Stan see PM for my contact info.

clintonman · Post by **clintonman** » 13 Sep 2016, 01:29

Thanks for the update, glad to hear you guys are on it.

Draise · Post by **Draise** » 13 Sep 2016, 05:36

Thank goodness the forums are back. It was freaky...

Finis · Post by **Finis** » 13 Sep 2016, 23:05

STATUS: Safe to visit forum and login (no threats known to me).

clintonman wrote:Thanks for the update, glad to hear you guys are on it.

Prodigy is on it. I mostly just made suggestions. Otherwise staying out of the way. I made a backup today so we have an unhacked one if needed.

Edit: I see that I may have unintentionally interfered with Prodigy's actions. I set the version of PHP to one compatible with the forum so he (and we) could login. That may, or may not, have caused a file he used to block access from China etc. to be overwritten. I did not know that would affect any files.

Finis · Post by **Finis** » 15 Sep 2016, 22:54

STATUS: Safe to visit forum and login (no threats known to me).

Incommunicado since the 12th. I see no more activity since then. Staying out of the way since I don't know if Prodigy is done or not. There are things I'd like to do like restore Prodigy's anti-China file, update everything, more of the security plan I had and more fortification. It would be great if more admins were created for our software too. Another anti-China file protects part of u3da. An email indicated that Prodigy could not do the forum's lost password thing. That is probably working now.

Finis · Post by **Finis** » 20 Sep 2016, 18:03

STATUS: Safe to visit forum and login (no threats known to me).

No communication or action for a while. I copied Prodigy's anti China file to the other place for it. "Defense in depth."

The last I heard Prodigy could not login to the forum (when no one could) and the recover password feature didn't work. I emailed about the cause of that problem (when he nuked the front page php seems to have reverted to its default version which is not compatible with our older version of phpBB) ... then I set php to a compatible version and emailed about that ... MIA. So the only person with admin power for the forum is seldom available and may think he can't log in. Prodigy is a great guy. It is that he is busy with real life so not around to do this stuff much and has not "handed over the keys".

Currently we are running an older version of php and phpBB to avoid the compatibility problem. Old software is a security risk. We must update phpBB before we can use modern php. Forum admin is needed to update phpBB.

When I have time I will back up the site and register a new user to experiment with. I will try to make a user with full admin power and then give that login to two volunteers who can do forum admin things when needed. None of this is "hacking" that would open vulnerabilities for another infection. It is normal access to normal tools used for an unusual purpose. That way I will not have fooled with any existing accounts and have the backup in case it goes wrong.

Hostgator says that we can only have one host admin account (cpanel). To have more host admins Prodigy must share the cpanel login credentials. Billing account has access to cpanel but we need another, preferably two, available host admins so the treasurer does not need tech skills too.

The domain name "united3dartists.com" belongs to Prodigy. Only he, and some guy he has on that account at GoDaddy, can renew the domain or change the DNS servers. The DNS servers listed there are incorrect and should be changed. He can see the correct ones listed in cpanel. If they are changed the site may be offline for up to 48 hours.

Finis · Post by **Finis** » 28 Sep 2016, 04:32

STATUS: Safe to visit forum and login (no threats known to me).

Don't panic! I will temporarily set PHP to a newer version which will probably block logins and show some techno-babble at the top of the screen as seen earlier in this thread. The test will last less than 15 minutes before restoring the current setup and things will be normal again. It seems the forum is not sending emails for registration activation or private messages. I think this is related to PHP.

Update: Test finished. That didn't solve the problem. Still no emails.

Has anyone received an email from the forum recently?

pugman 1 · Post by **pugman 1** » 28 Sep 2016, 05:32

i sent a private message but i received no email when it was answered. and i should of got one

stan · Post by **stan** » 28 Sep 2016, 12:13

I think it's only when you receive one
must have: Board preferences

» Edit global settings
Notify me on new private messages: checked yes

Finis · Post by **Finis** » 28 Sep 2016, 14:29

STATUS: Safe to visit forum and login (no threats known to me).

Thanks Pugman1 and Stan.

Stan I sent you a PM just now. Did you get the notification email?

I have that checked and I always have received an email when I receive a PM ... until recently. When I registered MrExperiment the activation email was never received. Additional attempts at registration, PM, and different email addresses also failed to produce any emails. So I think something was broken by the hacking or by fixing the hacking. I think the forum is not sending any emails. No new users have registered since D3crypt3d on Aug. 20 before the front page trouble. I think they can't due to no activation email.

That's why I want to know if anyone has received a PM notice etc. from the forum recently.

The forum emails are sent with a PHP function. Also, the DNS entries at godaddy are wrong. It is a mystery how we reach u3da with wrong DNS info. Those could be trouble points.

-----------

Otherwise. I succeeded in making another full power admin for the forum. I gained the needed info. to update phpBB and read about how to do it at their site. I will proceed slowly with great caution on that.

On making another forum admin: My plan was to make a new user to be another omnipotent admin and share the login with one or two volunteers preferably approved by forum members. That way their own accounts remain unchanged but admin things can be done when Prodigy is not available. I see now that one, maybe three, people other than Prodigy have some access to the admin panel.
Which is a better plan:
a) as above
b) promote existing accounts of volunteers to full admin

stan · Post by **stan** » 29 Sep 2016, 00:48

you could do the "a" and in emergencies if Prodigy can't get here someone can help out... I think he is only able to on weekends and only for a short time. Busy with family and work.

Hopefully we won't have a need to very often.

Finis · Post by **Finis** » 29 Sep 2016, 18:33

An initialization file is missing. The oldest backup does not contain it. This may be the cause of the email problem. If updating software does not fix that then I'll do research and create one. The forum's email for PM notification and registration activation will be broken at least until then.

I found this here.

FAIL: MX Record IPs Have rDNS Records
None of your MX record IP addresses have corresponding reverse DNS entries (PTR records). If these MX records are used to send outgoing mail this will cause them to trip anti spam filters. Many SMTP servers will not accept mail from an IP with no reverse DNS.

Some things like the styles or themes the forum uses (aeroblue, prosilver) will disappear when with the phpBB update and may be incompatible with the latest version. There are plenty of similar styles to use.

Finis · Post by **Finis** » 01 Oct 2016, 16:24

STATUS: Safe to visit forum and login (no threats known to me).

I temporarily used a default file for the missing file. Forum emails were still not sent. Hostgator tech support was no help. (Hostgator was bought by Endurance International Group. It would be a good idea to move U3DA to another hosting company not associated with them and not likely to sell to them.) However, there could be settings in the file that need to be changed. It is also possible that this file was never present and isn't related to the problem.

My main suspect now for the email problem is the wrong DNS server info. at godaddy. I think that causes this MX problem (link). Only Prodigy can change the info. at godaddy.

Cloudbric's free security service does not look like a good option for us since U3DA's traffic has occasionally been over 4GB per month.

Finis · Post by **Finis** » 16 Oct 2016, 16:13

STATUS: Safe to visit forum and login (no threats known to me).

I emailed Prodigy asking him to enter the correct name server information at Godaddy. Only Prodigy has access to the Godaddy account to change that. If that is changed then the forum will be offline for up to 48 hours. I also informed him about the forum emails (PM notices, registration activation) not working.

I made a backup of everything today. There is some mess left over from from hack fighting that I will remove. Large temporary restore files etc.

These backups are downloaded to my machine. Hostgator's do-it-yourself backup tool only allows downloads. There should be another copy of these backups but it would take 5 or 6 hours to upload the main part from my machine so someone else could download it.

UPDATE: October 18, Prodigy has changed the name servers.

Prodigy · Post by **Prodigy** » 20 Oct 2016, 11:51

HOHOHO!! i'm Back! ..

Finis · Post by **Finis** » 23 Nov 2016, 02:21

Hi Prodigy!

STATUS: Safe to visit forum and login (no threats known to me).

Forum email is working. Now notifications of PM's will work and new members can receive confirmation emails.

Site backup made today. There are now backups from 9-27-16, 10-16-16, and 11-22-16.

I have not had time or energy to upgrade the forum software. I will when I can. Maybe Prodigy will do it.

Prodigy wants the forum members to pay for the domain name ("united3dartists.com"). He has generously been paying for that all this time. So donations for site costs must now cover the hosting and the domain name. See (link) for current donation status.

United3dArtists Archive

Site Tech Issues or Security

Site Tech Issues or Security

Re: Trouble with PHP - Front Page Down

Re: Trouble with PHP - Front Page Down

Re: Trouble with PHP - Front Page Down

Re: Trouble with PHP - Front Page Down

Re: Trouble with PHP - Front Page Down

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Trouble with PHP - Front Page Hacked - Forum OK

Re: Forum De-Hacked, Safe to Log In

Re: De-Hacked, Safe to Log In

Re: De-Hacked, Safe to Log In

Re: De-Hacked, Safe to Log In

Re: De-Hacked, Safe to Log In

Re: De-Hacked, Safe to Log In

Re: De-Hacked, Safe to Log In

Re: De-Hacked, Safe to Log In

Re: Site Tech Issues or Security

Re: Site Tech Issues or Security

Re: Site Tech Issues or Security

Re: Site Tech Issues or Security