Site looks to be working again, thanks for your patience

[Quarterbore]

I am still trying to investigate what hitus but we were hacked again and it looks like it was some type of automated script that simply wrote tens of thousands of files to the server. The files are encoded so I can not make out what they said and I am woried that they could well be back as I don't know how they did this in the first place.

I am continuing to look at the server logs and the files on the server for other malitious code but so far it looks like I have been able to remove everything that was added. We will likely need to do another major site upgrade soon to try to remove what ever gap in our security this hacker used.

Glad to be back up again and thanks to TUG for allowing us to borrow a thread there for updates! Frank and I really appreciate it!

Ken

[ArtsieAng]

Ken,

It's good to have the site back. Thanks for all your hard work!!!

I can't seem to get the Home Page, tho. This is what I am getting :

The page cannot be found
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.

--------------------------------------------------------------------------------

Please accept our appology but the file you were looking for seems to be gone. This error was logged and will be investigated and corrected if possible. Please return to the main entry page if the website here:

Visit timeshareforums.com

[Quarterbore]

Yea, I have been fighting with that and I can't figure it out...

Simply go to the following address and it works:

http://www.timeshareforums.com

The link you are using:

http://www.timeshareforums.com/index.php

Gives you the error....

I had to rewrite the main redirection page that allows the site to work and I assume the problem is in there but I am not going to get it fixed tonight anymore. I will be around to keep an eye on things and we will be doing a major site upgrade soon to make sure the problems are prevented from happening again.

[ArtsieAng]

OK Ken, thanks!

[Glitter Brunello]

Ken, thanks so much for your hard work to get the site back up and running!

[Steamboat Bill]

The hacker definitely deserves a smackdown, but this probably was directed from some spammer in Russia or may simply be a "bot" that somehow took advantage of your site.

The questions are:

1. Did your host experience any other attacks on any other hosted sites or is this an isolated attack on TS4MS?

2. Was the attack directed towards a shared server, VPS, or dedicated server?

3. Was this a FTP attack or a VB security attack or a MySQL attack?

My suggestion - Find the weak links and strengthen them.

For the record, I was playing golf this morning and had an early tee-time. I did see some posters on TUG imply that I may be involved and I vehemently deny that accusation.

Frank knows that I enjoy "stirring the pot"...however I would NEVER "break the pot". In other words, I like stimulating discussions and controversy and would NEVER destroy anyone's data or property.

[Rancher]

Give Jack Bauer or Cloeie a call from 24.
They will not only find your hacker but make him pay dearly for what he has done.

[catwgirl]

Ken,

Thanks for getting the site up and running again!

[happymum]

Thanks for your hard work in getting the site back up. I was starting to have DT's.

[katiemack]

Great work recovering things so quickly, and I am sure whatever can be fixed you can do it. As for discovering how and who, good luck and let us know when you do.