who the hell cares where it is -________-; blog is the same shit as a forum post anyways, it's the exact same format, it's just in a different subsection of the site

Skew

United States1019 Posts

June 05 2008 05:23 GMT

#28

Sorry Xer.

I don't *think* you can track an XSS/SQL injection wipe on the DB as the content that caused it would also be wiped... someone correct me if I'm wrong, but good luck anyways. Daily DB backups next time around.

Xeris

Iran17695 Posts

June 05 2008 05:55 GMT

#29

ya , we're going to start doing daily backups

Xeln4g4

Italy1209 Posts

June 05 2008 08:15 GMT

#30

retarded idiots are everywhere ...

yenta

Poland1142 Posts

June 05 2008 09:08 GMT

#31

You should be taking daily dumps of your database. I don't see it as being so big that it would matter. Just add it as a shell command to your crontab, one line to save the days dump as some date-valued file, another to delete backups older than say a week.

yenta

Poland1142 Posts

June 05 2008 09:16 GMT

#32

On June 05 2008 14:23 Skew wrote:
Sorry Xer.

I don't *think* you can track an XSS/SQL injection wipe on the DB as the content that caused it would also be wiped... someone correct me if I'm wrong, but good luck anyways. Daily DB backups next time around.

Logs?

Check your db logs - if they are set up right they should have a record of the statement that caused the wipe.

Also. you should be logging any input that is not standard, or since its a small site, just log all input and clean your logs once they are older than a week.

Jank

United States308 Posts

June 05 2008 10:24 GMT

#33

Probably the result of sql injection. Make sure you patch the hole and not just restore everything and pretend it never happened. Go through all your code making sure all the input is properly sanitized.

QuanticHawk

United States32083 Posts

June 05 2008 12:26 GMT

#34

If I remember, steve said it was an sql, cuz the smi site got hacked yesterday too.

MasterOfChaos

Germany2896 Posts

June 05 2008 14:16 GMT

#35

If the attacker was not entirely supid(which is well possible, 1337 scriptkiddies often are) then your IP will be a random TOR exitnode, or an open wlan.
Did you already find out how he killed your db?

Flaccid

8848 Posts

June 05 2008 17:45 GMT

#36

Not much detail is given in this blog post, so here is a link to what happened:

Description of hack

To quote this guy's post:

This is a Windows vulnerability. What the hacker did was attempt to run around the code and gain access to the asp.net Windows Media Player library via our /images/ folder. They found an image they liked, They ran a some kind of script, and gained access to run a sql instertion script that the application itself did not allow.

Sneaky fucker.

Apparently, this a vulnerability that Microsoft put out a patch to, and our hosting provider didn’t run it against our VPS yet.

So to protect your server against this hack, have your hosting provider run the latest updates for the vulnerability.

So it's really not a matter of basic SQL-injection. That stuff is protected against in the code in several different ways. It's a server-side vulnerability that is exploited and something most people have no control over. The only sites at risk are those running on a Windows server. Just do a google search and you'll see the hundreds of thousands of sites that have been hit in this way.

Point being we have to go a roundabout way to prevent this from happening again, and again, and again... and again.....

That's the internet for you.

Jonoman92

United States9104 Posts

June 05 2008 18:29 GMT

#37

I wondered what was going on. I was looking for the thread with the info about my challenge and I realized the most recent threads were from a while ago.

Goosey

United States695 Posts

June 05 2008 18:36 GMT

#38

That sucks. :| I am surprised your host doesn't do regular backups

edit: oh and they run Windows Server? Unless you are reliant on that software stack I would recommend switching hosts for sure. Daily backup is pretty much standard.

nofAcedAgent

United States952 Posts

June 05 2008 19:27 GMT

#39

On June 05 2008 12:56 Xeris wrote:
who the hell cares where it is -________-; blog is the same shit as a forum post anyways, it's the exact same format, it's just in a different subsection of the site

Chill yo~ I think he just meant it would get noticed by more people in the brood war section, hes not the one that hacked you, control your rage (;p) (not that I know the benefit of having more viewers)

Anyway, hope the bastard gets caught man, sorry to hear it