+- Like Ra's Naughty Forum (https://www.likera.com/forum/mybb)
+-- Forum: Technical section (https://www.likera.com/forum/mybb/Forum-Technical-section)
+--- Forum: Site (https://www.likera.com/forum/mybb/Forum-Site)
+--- Thread: Site performance, Server errors, outages and tunings (/Thread-Site-performance-Server-errors-outages-and-tunings)
Pages:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
RE: Site performance, Server errors, outages and tunings - Like Ra - 20 Dec 2014
OK, it's very weird, but some attachments indeed disappeared. I compared the files on the server and in my backup, and the difference is huge. I haven't checked the database yet - currently I'm backing up the latest changes and uploading what is missing.
I hate when such things happen... Who does not...
RE: Site performance, Server errors, outages and tunings - Like Ra - 20 Dec 2014
Sooooo... It happened between Dec 16 and Dec 20. More than 3000 images were deleted from both the database and the disk. I do not know how to do this without knowing the admin password. So, it's either me (e.g. by installing a wrongly written plugin) or a hack.
All files and database entries are being restored from the backup at the moment.
RE: Site performance, Server errors, outages and tunings - Like Ra - 21 Dec 2014
It was a hack via a remote xmlhttp.php vulnerability. I'm not sure if this bug is fixed yet. At least 5000 files were removed.
I'm reporting the security vulnerability to MyBB admins and installing patches with some related security fixes.
RE: Site performance, Server errors, outages and tunings - Like Ra - 21 Dec 2014
BTW, the user from whose computer the site was "hacked" is well-known dan2010. I'm not saying that it was him directly, possibly it was a virus.
RE: Site performance, Server errors, outages and tunings - Like Ra - 21 Dec 2014
Latest update - it was a plugin that was uploading multiple files. Deleted for the time being ...
RE: Site performance, Server errors, outages and tunings - Like Ra - 21 Dec 2014
More than 10,000 images have been reuploaded. Please let me know if some links to the images are still broken.
RE: Site performance, Server errors, outages and tunings - B1u3 - 21 Dec 2014
I'm always asking myself for the motivation for such a "hack"...I mean, I know the theory how to do an sql injection and so on, but why on earth does someone hack a forum like this and simply deletes some pics? Really strange.
Good, you have a backup! 😊
RE: Site performance, Server errors, outages and tunings - herrpee - 21 Dec 2014
Looks like you had some fun...
Good job finding it out, keeping you backups in good shape, restoring all the shizzle.
Thanks.
RE: Site performance, Server errors, outages and tunings - Like Ra - 21 Dec 2014
I think it was not a hack, but more a coincidence. The plugin may contain a bug but shouldn't the forum access control prevent deleting attachments uploaded by other users?
This is what I send to the MyBB developers:
I think this is what happened - the user was ripping the site with a software that supports javascript and "clicks" on all buttons in all possible combinations. We had this issue before when a user with admin rights was backing up all attachments uploaded to the production inventory database. And wget "clicked" on the "delete" button as well.
But in this case the user does not have elevated rights and that shouldn't have happened.
RE: Site performance, Server errors, outages and tunings - Like Ra - 21 Dec 2014
Yes, backup rules! 😁
BTW, about the amount of affected files. Every uploaded image "consists of" two files and one database record. Hence 10,000+ uploaded files (5,000 real images). Some attachments were removed by the users during all the years, so they are not in the database backup, but still in the attachment backup. The difference between two DB backups was more than 3,000 lines, what means the amount of the live files is between 3,000 and 5,000.
Just for the record, this is the current statistics:
No. Uploaded Attachments 12,880
Attachment Space Used 2.87 GB
Estimated Bandwidth Usage 634.63 GB
Average Attachment Size 233.35 KB