View Full Version : SECURITY HOLE problem, need help.
analog
12-02-2005, 05:55 AM
Well. Today I sat down at my computer and opened Safari. Usually, my photoblog comes up as my homepage, but today, I got an error message.
My host, Eleven2 had shut down my mySQL because it was overflowing their servers, and my blog was down for that. They suggested I update to the newest version of Pixelpost. I did that, and still got issues. Me and my host went round and round, getting nowhere, and finally decided that neither of us could fix the problem.
The mySQL problem is something called "SQL injection" (according to Eleven2), and the data trying to get into my database totally messes with their servers.
Until I can get some help from someone over here, telling me what my next best action is, my blog is down. Anyone out there have any suggestions?
I'd really appreciate the help, as this blog is a sort of pre-portfolio for college, and it's seriously bad that it has decided to stop working.
Thanks in advance,
-analog
http://www.analogphotography.net
dkapp
12-02-2005, 06:14 AM
You may want to post this in the Pixelpost Hosting forum too. I know Eleven2 employess and pixelpost developers work together in there.
http://forum.pixelpost.org/forumdisplay.php?f=29
Dave
tinyblob
12-02-2005, 08:15 AM
analog, this is bad news.
if you've been dealing with someone specific at Eleven2, please ask if they could forward any relevant logs (or MySQL dumps) to one of us. either by posting in the forum, or emailing us directly.
that way we can find the hole fast!
raminia
12-02-2005, 07:49 PM
Well. Today I sat down at my computer and opened Safari. Usually, my photoblog comes up as my homepage, but today, I got an error message.
My host, Eleven2 had shut down my mySQL because it was overflowing their servers, and my blog was down for that. They suggested I update to the newest version of Pixelpost. I did that, and still got issues. Me and my host went round and round, getting nowhere, and finally decided that neither of us could fix the problem.
The mySQL problem is something called "SQL injection" (according to Eleven2), and the data trying to get into my database totally messes with their servers.
Until I can get some help from someone over here, telling me what my next best action is, my blog is down. Anyone out there have any suggestions?
I'd really appreciate the help, as this blog is a sort of pre-portfolio for college, and it's seriously bad that it has decided to stop working.
Thanks in advance,
-analog
http://www.analogphotography.net
which version of Pixepost you were using?
1.3?
tinyblob
12-02-2005, 08:00 PM
email from Eleven2 on the issue:
Ya man..his site was getting hammered with tons of sql injections, like 600qps. When his site was running the loads would be around 30-40 on a dual xeon. As soon as I would disable his database the loads would go back to their normal 0.5 or so. We tried this multiple times with the client and also upgraded to the new pixelpost version and it did still not stop.
I don't have any of the logs of the issues.
ideally we need a full list of logs / mods installed. i may not be the pixelpost codebase that is to blame.
blinking8s
12-02-2005, 08:32 PM
i think he was running 1.4.1
analog
12-03-2005, 04:15 AM
My blog was running 1.4.1, and I tried the upgrade to 1.4.3.
I don't think I had any running mods installed, but I might have had the files in place. I wasn't using any features past the regular pixelpost set. I don't know if there is a way to check the mods without killing Eleven2's servers again. This might be a key bit to fixing the problem.
If there aren't logs to work off, or mods aren't the problem, then what would be the next possible fix? Is there any way to protect the domain so that it doesn't get hit by so many requests? How about updating my version of pixelpost in a different manner?
Any soloution would be good...
blinking8s
12-03-2005, 05:12 AM
you need to upgrade...thats really it. New versions are more secure. 1.4.2 was released to stop ref spam, which seems the be what you are encountering.
I'll talk with e2 more soon I am sure...
how dod you try to upgrade? did it not work?
did you lose your database?
analog
12-03-2005, 05:36 AM
I upgraded with these instructions:
(quoted from readme_upgrade.txt file within pixelpost software)
-------------------------------------------------------------------------
4- UPGRADE from Version 1.4.1 to PixelPost 1.4.2
This is the same Routine if you want to upgrade to PixelPost 1.4.3
-------------------------------------------------------------------------
No install-script and no database-backup are necessary for this Upgrade.
But for sure we recommend to make a backup of all your files and the database
as well!
1) If you modified something in the scripts please make a backup of your modifications.
(including modified language files or templates)
2) save your /includes/pixelpost.php
3) Open the file /includes/pixelpost.php from the UPGRADE-files and edit it:
enter your database-data into the following lines:
$pixelpost_db_host = "localhost"; // database host, often "localhost"
$pixelpost_db_user = "replace_me"; // database user
$pixelpost_db_pass = "replace_me"; // database user password
$pixelpost_db_pixelpost = "replace_me"; // database
take care that the tablename-prefix is correct, if your tablename-prefix differs
from "pixelpost_", you must enter your prefix here:
$pixelpost_db_prefix = "pixelpost_"; // table prefix, leave as is unless you want to
install multiple blogs on the same database
3) PixelPost 1.4.3 comes as a complete install-package.
If Pixelpost 1.4.1 is installed already at your website,
!! update at least the following files:
to the "root.directory" of PixelPost: index.php
to the addon-folder: /addons/anti_spam.php
/addons/advanced_stat.php
to the admin-folder: /admin/index.php
to the includes-folder: /includes/pixelpost.php
/includes/no-refer-spam.php
/includes/phpinfo.php
no need to run any install-script, everything should work fine after that.
the new table {$pixelpost_db_prefix}stats will be created automatically when
you first log into ADMIN-section by "/addons/advanced_stat.php"
4) edit your templates in /templates:
open your image_template.html and take off the tag:
!! <SITE_REFLINK> !!
as this link will not work anymore to stop referer-robots
as the link to the referer-page will not work anymore, take off your
referer_template.html from your template-directory
replace the tag <SITE_VISITORNUMBER> in your image_template.html by this new tag:
<ADVNCD_SITE_VISITORNUMBER>
to show the number of all visitors from the new table "stats"
This package comes with the PixelPost-'standard'-templates (pixelpost-light
and pixelpost-dark), which are updated already
4) Additional goodies of PixelPost 1.4.3:
you will find one new template-folder: simple
use it if you whish!
some small bugs or corrections or additions are part of this package as well,
this are documented in the changelog.txt in the doc-folder as well.
5) We strongly recommend to run the Referer-Clean-Job and the Comment-Clean-Job
from your Admin/AddOn-Page after updating to clean your Pixelpost-tables.
6) That's it! Your PixelPost Version is upgraded to version 1.4.3
now your PixelPost-Installation is armed against referer-spam
in the admin panel
(END QUOTE)
Basically, I followed these instructoins... I backed up my includes folder, replaced all the files it said to replace in the "replace at least these files section" and updated the mySQL data in the proper file within the includes folder. Things seemed to run just fine, but Eleven2 didn't like the server load, hah tho I don't blame them...
This, again, was 1.4.1 to 1.4.3, skipping 1.4.2. I thought that the instructions said (in the header) that it would be fine to skip 1.4.2, so I did. Hopefully the problem isn't as small a detail as this.
When I did the upgrade, I didn't loose anything, the blog seemed to work exactly as it had. I'd be fine doing a total clean reinstall, but I'd really like to be able to keep the pictures in the order they had been posted, etc. I've got copies of all of the data saved locally, so deleting anything from the domain is NO problem at all. I'd really like to just put everything back the way it was, but if that's not a possibility then I'd at least like to get things running again. I thought it was time to redesign the site and weed out some of the lesser photos, anyways... At least I don't have to rescan anything.
Sorry for the insane long post, those instructions really took up a chunk of room... hope this info helps, and thanks for the help I've gotten so far!
Oh, and if any of you have AIM, hit me up, my screenname is
ana10g
and I think it'd be nicer to talk with immediate feedback.
blinking8s
12-03-2005, 05:43 AM
upload everything in the 1.4.3 package...not just a few files, just go ahead and upload it all
analog
12-03-2005, 05:46 AM
Aright, I'll try it, but to really give it a go I'm gonna have to reconnect the mySQL database... and this causes the server problem.
The guys at Eleven2 didn't want me to turn the software on again, and I need to ask them before I do. I'd rather not have my account suspended, you know?
So maybe I could make another mySQL database, and install a full version of 1.4.3... would this be a possible way to test the problem? It would be different from the original in a lot of ways...
blinking8s
12-03-2005, 06:37 AM
*edit*
issue resolved
vBulletin® v3.7.3, Copyright ©2000-2013, Jelsoft Enterprises Ltd.