TonyV

It's not dead; I'm working on getting it restored to how it was. I will be honest, though, in saying that I don't plan on any significant updates or features to be added. We're working on a revamp, though, that will make a lot of this functionality kind of obsolete.

In the meantime, I'm trying to knock out the other things on my To Do list so that we don't unnecessarily delay getting other functionality up and running. It's going to be at least next week before it even might be up. This is also why I haven't posted any updates in the last couple of days or so. The things I've been working on have been back-end stuff like getting log rotation working, getting our development repositories set up, and fixing minor bugs like the OuroPortal image database, the CIT XML feed, etc.

This week, I'm going to try to get our stat tracking working again, and then this coming weekend, I'm going to the pummit. If you have comments, be they glowing compliments or scathing cuss-outs, you can meet me in person in Mountain View and have at it.

This is a known issue due to the recent UI change. GuyPerfect is working on an update. Because the UI changed and not just the data contained with it, it's going to require an application upgrade to fix it, not just an automagic manifest download. It will be fixed soon. (Not Soon™, which is the status of Faces. )

Tap the End key or use the scroll wheel to zoom out a hair.

You're the Guy.

This will probably be a not-too-hard thing to do, so I'll try to get it up and running mid-evening tonight. Faces is by far the hardest one to get moved over, that one will probably be at least another day or two out.

You bet. It is:
fd8f4946e53ef9a466674f4f160b0eb7 MXDSetup1-952.exe

I've run both the latest version that was posted on our site and the version that is mirrored above through a checksum, and compared it to a known good version that I had from Diellan's and DeProgrammer's updates to the repository, and they all match up.

For anyone who wants to verify the integrity of their file, they can snag a copy of a file checksummer utility from Microsoft from their web site.

If you want to verify that your installed copy of Mids is okay, here's the checksum of executable files within the distribution:
47f54527bc44c4dc98845da86e7387b0 Hero Designer.exe
0b3b4e8d1de31f844e466d61cf7937b5 ICSharpCode.SharpZipLib.dll
e1ee2d27c6f6f105a7ba21387e1cbf07 midsControls.dll
80e41408f6d641dc1c0f5353a0cc8125 zlib1.dll
d993e1da5d1c5cda8d8daa096eecced4 Uninstall.exe

Just to stress the point: The Mids download was not compromised on the site. Barring infection in some other manner, downloading Mids, installing it, and running it would not have affected your computer.

Now now, don't go guilting people into donating. Especially since...

If I were getting paid for this, I'd like to hope that I would have done a better job of making sure all of our software was up-to-date, possibly preventing this whole mess to begin with. Truth be known, I'm feeling a bit guilty over it, since keeping current is normally a big emphasis of mine to maintain security of the system.

Still, things have been pretty crazy on all fronts at the Titan Network lately, what with changes to the game coming fast and furious. Everyone loves the pace at which new stuff is coming out these days--including us!--but I won't lie, sometimes it's like, "Aw, come on guys! Give us some time to breathe!"

So I admit it, I let something slip that really shouldn't have slipped, and we got bitten for it. For anyone else running a web site out there, whether it's a hobby like this one or a more professional endeavor, I can't pound this into your skull enough. Make sure you stay on top of patches and updates! Not just the big stuff like the OS, web server, database, and scripting language (though those are certainly important), but also every library, packaged software, and coding framework you use, too.

Incidentally, that's also one thing we'll be working on, is making sure that only our live, up-to-date sites are hosted on the server. No more development stuff, and no more deprecated sites. Keeping the dozens of things in the live environment current is hard enough without having to worry about a development site being hacked; it doesn't make sense to needlessly expose ourselves because that old forgotten copy of the PC Free Press that no one looks at is still hanging out there using an ancient version of Mambo. We'll still have dev and test sites, probably hosted on VMs at my house, and I'll try to host those old deprecated sites somewhere (possibly on a dirt cheap shared web host or something), but not where it could compromise our active sites.

We sincerely hope it gets corrected quickly.

I'm almost certain this is what bit us. I'm not 100% sure, and I'm still looking for the "smoking gun" on the server to definitively say, "Yup, that's it!" (Which will really have to wait at least another day or two until I get everything moved over, configured, and up and running.) But of what research I've been able to do, this is by far the most likely candidate vector of attack. It's also why I put such heavy emphasis on getting the old forums upgraded first, even at the expense of losing some of the customization.

Memento: The MMORPG.

It's DNS propagation. We changed the IP address of the server, so until your DNS server updates with the new address, you'll still be hitting against the old server that's not servicing requests. The TTL is a day, but really, it shouldn't take that long. I noticed around 15 minutes ago that it had just hit Google's public DNS servers, so it is getting out there.

Absolutely. Anyone with NoScript installed is literally at zero risk of being affected by this. (Unless you've whitelisted the malware domain, which I really hope you haven't. ) Whitelisting the cohtitan.com sites is fine, also, the payload was delivered by a remote server, not the Titan server.

/e noooo

Muchas gracias. I read it, and I'll process it as soon as I can. Sounds reasonable to me. I did check the cron jobs earlier and I don't see anything, but I still haven't finished a deep dive to find out what did make the changes. That's way up the priority chain on my list, after getting at least a maintenance page deployed.

The nuts and bolts of it is that something has rewritten a whole bunch of index.php files, including most that run the core functionality of all of our sites, to include the following line at the top:
echo (base64_decode('ZXJy[bunches more gibberish]0KfQ=='));

When you decode that, you get a Php function that:

- Turns off error reporting,
- Fetches the IP address of who's accessing the page,
- Fetches the user agent (UA) of who's accessing the page and compares it against a list of known security sites and webcrawlers,
- If it's not in the list of UAs, it does a cURL fetch of a javascript payload from a remote distribution site. The URL is defined as:
'http://[scum domain omitted]/index.php?go=1&ip='.$ip

So it's sending the user who is accessing the page's IP address. Depending on that IP address, they payload may or may not be delivered. When I put my own address in, it's not. When I poked around a little bit, I was able to find an IP that did deliver the payload, which I copied for further analysis as soon as I get a chance.

There are a couple of interesting things that I'm trying to figure out. For one thing, the modification datestamps of the index.php files are unchanged. That means that whatever script made the modifications either 1) is running at a very low-level filesystem level, or 2) took some pains to save the modification date and change it back to what it was originally.

Right now, my efforts are being split in three directions. First, I'm on shift for my day job and, as my luck is going today, got sucked into a teleconference as soon as I logged on two hours ago, which means that my other efforts are currently being severely hampered. Second, I'm setting up a second server that will likely replace our existing Titan Network server that has been completely staged from scratch and onto which sanitized copies of our sites will be moved. Third, I'm trying to get to the bottom of how this happened so that I can prevent it from happening again and, if possible, report the incident to law enforcement.

With that profile, I wouldn't think so. The full scan certainly won't hurt though, and I would recommend that anyone who has visited the sites in the past 18 hours or so (since around 17:00 ET/21:00 UTC) to run a scan just in case.