Shamoozal Hack Job

Phil · **Posted:** February, 9, 2012 - 10:38am

Looks like the Shamoozal got hacked last night. Our PHP files for the Smorg were tampered with, and the attackers also put some sort of malware on our redirect page (shamoozal.com) but our very own Steve had taken care of all these problems before I even knew about them! So a big thank you to him.

If anyone got anything from our site last night, I'm extremely sorry.

Stillies · **Joined:** April, 7, 2007 - 12:11pm **Posts:** 8793

Bastards.

Johnny Manf · **Posted:** February, 9, 2012 - 10:46am

Yeah the Smorg didn't work for the first hour or so I was at work. I was wondering what was up.

Steve · **Joined:** September, 9, 2005 - 12:08pm **Posts:** 10353

Edit: I was on the forums around 1am and they were fine. So whatever happened was between then and 8am. Hopefully there wasnt much traffic during that time and no one got anything malicious.

Phil · **Posted:** February, 9, 2012 - 10:59am

IratePrimate · **Joined:** June, 12, 2006 - 12:32pm **Posts:** 9543

damn kids.

phantomspiker · **Posted:** February, 9, 2012 - 12:43pm

That sucks!

Good job on getting everything back up Steve.

Stillies · **Joined:** April, 7, 2007 - 12:11pm **Posts:** 8793

Norton is still telling me its blocked malicious viruses from the smorg page and wont load it.

Phil · **Posted:** February, 9, 2012 - 4:54pm

Stillies wrote:

Norton is still telling me its blocked malicious viruses from the smorg page and wont load it.

How are you writing this then? hahaha.

The Greg Man · **Posted:** February, 9, 2012 - 4:58pm

It must have happened between 1 and 3 because I checked at 3 and it was down. Why would someone try to hack this forum anyways? An old forum user coming back for revenge?

Steve · **Joined:** September, 9, 2005 - 12:08pm **Posts:** 10353

I just ran the site through a couple malicious code testers and it came back clean:

http://safeweb.norton.com/report/show?url=shamoozal.com
http://www.google.com/safebrowsing/diag ... moozal.com

The Greg Man wrote:

It must have happened between 1 and 3 because I checked at 3 and it was down. Why would someone try to hack this forum anyways? An old forum user coming back for revenge?

My theory is its the Pitiri 1977 guy coming after Phil ahahahaha

Stillies · **Joined:** April, 7, 2007 - 12:11pm **Posts:** 8793

On my Phone phil

Dante369 · **Joined:** May, 21, 2006 - 6:30pm **Posts:** 12280

I've been getting occasional download prompt for a file called count25.php.

Bowie · **Posted:** February, 9, 2012 - 5:20pm

They hacked the fucking GIBSON!

Steve · **Joined:** September, 9, 2005 - 12:08pm **Posts:** 10353

Dante369 wrote:

I've been getting occasional download prompt for a file called count25.php.

Dante I'm getting that too, its something wrong with Twitter. Phil has that box hooking into Twitter on the nerdlog, that seems to be it. I tested it in Firefox w/ the Firebug plugin and saw that its just hanging on the twitter.com callback. *shrugs*

Steve · **Joined:** September, 9, 2005 - 12:08pm **Posts:** 10353

I'm looking into the count25 thing a bit more closely just to be safe. I upgraded the site's database to MySQL 5, upgraded wordpress and all the plugins to the latest version. Now I'm scouring the code for any references to that file.

Dante369 · **Joined:** May, 21, 2006 - 6:30pm **Posts:** 12280

Steve wrote:

I'm looking into the count25 thing a bit more closely just to be safe. I upgraded the site's database to MySQL 5, upgraded wordpress and all the plugins to the latest version. Now I'm scouring the code for any references to that file.

Make the youtube embed better on here too, pleaaaaase

The Greg Man · **Posted:** February, 9, 2012 - 9:07pm

Steve wrote:

The Greg Man wrote:

It must have happened between 1 and 3 because I checked at 3 and it was down. Why would someone try to hack this forum anyways? An old forum user coming back for revenge?

My theory is its the Pitiri 1977 guy coming after Phil ahahahaha

Hahahahaha my money was on waffle or Ryan but you might be onto something there. Your voices have a weight to them, with great power comes great responsibility.

The Greg Man · **Posted:** February, 9, 2012 - 9:08pm

Dante369 wrote:

Steve wrote:

I'm looking into the count25 thing a bit more closely just to be safe. I upgraded the site's database to MySQL 5, upgraded wordpress and all the plugins to the latest version. Now I'm scouring the code for any references to that file.

Make the youtube embed better on here too, pleaaaaase

And second that! I'm lost when it comes to embedding and Phil and Tu even walked me through it, it just didn't stick I guess. I can't find the thread where they explained it either. Oops double post.

Phil · **Posted:** February, 9, 2012 - 10:29pm

I don't know why anyone would target us. I assume it's probably some sort of bot thing really. Something that sweeps a bunch of sites, that's just my guess. I don't think we were singled out by any means.

Bowie · **Posted:** February, 10, 2012 - 12:09am

Occupy shamoozal: attack of the smorg.

Dante369 · **Joined:** May, 21, 2006 - 6:30pm **Posts:** 12280

I just got a javascript threat warning on this site by my anti-virus :O

Russell Casse · **Posted:** February, 10, 2012 - 3:03am

Is the forum infected or the main site? Or both?

Dante369 · **Joined:** May, 21, 2006 - 6:30pm **Posts:** 12280

Russell Casse wrote:

Is the forum infected or the main site? Or both?

Main site.

Phil · **Posted:** February, 10, 2012 - 9:14am

Dante369 wrote:

I just got a javascript threat warning on this site by my anti-virus :O

FUUUUUUUUUUUUUUUUUUUUUCK. Yeah me too. What the fuck man.

Shamoozal.com - Smorgas Board

Shamoozal Hack Job

Who is online