vB Site hacked.

Discussion in 'Security' started by mk484, Dec 6, 2008.

0
  1. #1
    I got an email today with the following info:

    Database error in vBulletin :

    mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)
    /home/eyobicom/public_html/behindtheboards.com/forums/includes/class_core.php on line 311

    MySQL Error :
    Error Number :
    Request Date : Saturday, December 6th 2008 @ 05:24:40 PM
    Error Date : Saturday, December 6th 2008 @ 05:24:40 PM
    Script : http://www.behindtheboards.com/forums/calendar.php?c=1&week=1212883200&do=displayweek&month=6

    The title of my site is BehindTheBoards.com
    The only noticeable difference with the forum is that all the status icons have been changed to the locked icon. I logged in as both a user and admin, and I was able to make and edit post. What should I look out for? This is a small site with very little traffic. Why would someone want to hack this site? When I first started out designing sites someone told me if I built sites, I would get hacked eventually.....and that is was just the nature of the beast. Just be sure to do back-ups. This is my first time getting a site hacked, and I wanted to get any input from you guyz that may help me.
    What should I do first? Should I restore the entire forum?

    FYI
    I do have a back up about a week old.
     
    mk484, Dec 6, 2008 IP
  2. Brandon Sheley

    Brandon Sheley Illustrious Member

    Messages:
    9,721
    Likes Received:
    612
    Best Answers:
    2
    Trophy Points:
    420
    #2
    you should be able to check out your moderator and/or admin logs in the admincp
    you should also have a logs file in your root ftp that will have all access logs as well :)

    regards
    -Brandon
     
    Brandon Sheley, Dec 6, 2008 IP
  3. SSANZ

    SSANZ Peon

    Messages:
    861
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Why do you think its hacked?

    Any obvious message left by the hacker?

    That error that you have produced, is actually a database error - it cannot connect to the database because the database has an issue with its assigned sock. google for more information.

    tbh, i thought you would have googled the database error before assuming its a security attack.
     
    SSANZ, Dec 18, 2008 IP
  4. Devilfish

    Devilfish Active Member

    Messages:
    396
    Likes Received:
    6
    Best Answers:
    1
    Trophy Points:
    70
    #4
    Devilfish, Dec 18, 2008 IP
  5. Cr1T1c4L

    Cr1T1c4L Peon

    Messages:
    23
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    The post contained php code, if he was able to login in your administrator account look at your plugin code's it may have been changed and ther ecan be code added so he can exucute linux commands to take over your webhosting.
     
    Cr1T1c4L, Jan 26, 2009 IP
  6. mayankoneman

    mayankoneman Member

    Messages:
    133
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    30
    #6
    what version of vb you were using?
     
    mayankoneman, Jan 26, 2009 IP
  7. justdoit1

    justdoit1 Peon

    Messages:
    100
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Just upgrade to the latest vb. I don't recommend your old backup which might not be clean.
    If you host other applications as well, they might have vulnerabilities.
     
    justdoit1, Jan 26, 2009 IP