A Spanish hacker, called T3ES, belonging to the Alboraaq hacking team, penetrated the WordPress installation through an unknown security flaw, and uploaded a PHP shell console, enabling him to further carry out malicious hacks throughout the site. This meant it also affected my own website, which is run on the same account.

I was informed of the hack within minutes, and immediately asked our host, TMDHosting, to restore the backup they say they keep of our sites. However, it took nearly two weeks to restore this backup, because of various issues with past backups, and also the fact that the hacked content was partially backed up. It had to be manually cleansed by technicians at our ISP, hence the delay.

During the downtime I sent a polite email to the hacker (who ever so kindly(!) left his email address) on the webpage. I received no reply.

I have since sent an email to both his domain registrar and hosting companies, asking for action to be taken, whether it be account suspension/deletion, or something else, since all the evidence is blatantly displayed on the site. I have yet to receive a response, but if any news comes through I will let you know.

So, we’re practically all up and running again now, the forums should be up shortly. We are also currently setting up a separate server to be partly used for backups, as well as a development area (e.g. maybe running Redmine etc). More details will follow.

Our host, TMDHosting, probably hate me for the amount of support tickets I opened demanding updates every day, if not twice a day, and asking this and that regarding the length of the time it was taking to restore the backups. After finally having the site back online, I just want to say that I am grateful for the work that the technicians and engineers did, as it isn’t a service that they normally carry out for free.

Thanks once again to those that got in touch, we appreciate the time you took to contact us, and we’re just sorry that we couldn’t get back online sooner.

If pages/posts/files are missing/corrupted, or if you notice something odd/strange with the website, such as a PHP shell, random text that doesn’t look as though it should be there, or just generally suspicious files/text, send an email to me, james@novaboard.net and I’ll look into it ASAP.

Released: June 14th 2010

NovaBoard 1.1.4 Full Installation: http://novaboard.googlecode.com/files/NovaBoard1.1.4.zip

NovaBoard 1.1.4 Upgrade Package: http://novaboard.googlecode.com/files/NovaBoard1.1.4_Update.zip

Changes since 1.1.3

Additions

Thanks for hanging in there! We know that it’s been a while since our last release, but we’re back on top of things, and are already working on NovaBoard 1.1.5!

In the release of 1.1.4, we included the popular Suspended Members module to make it easier for everyone to manage their members, as well as incorporating the Nation Flags due to popular request.

If you have these modules installed, we have included functionality in the installer so that you don’t need to touch your existing modules – you can leave them installed, and it will all be seamlessly be merged.

We’ve fixed 23 known bugs, that’s nearly all of those that have been reported – those that are left (which were reported towards the release date and are minor) have already begun to be fixed for release in 1.1.5. We also had a recent surge in the amount of security flaws that were able to be exploited through NovaBoard – we take security very seriously, and all reported flaws have been patched up – your forum will now be safer than ever!

I’d like to take the opportunity to thank you, the community, for using NovaBoard – it’s great to know that our work is being used by hundreds of websites across the globe. We want to help you make your forum the best it can be, and so after NovaBoard 1.1.5, we plan to make the software much quicker, yet even more extensible than it is right now. We also plan to bring back the remote install module and theme feature, from back in the days of 1.0.x. It’s been missing for a while, there are good reasons why it was taken offline, but we’ve worked around those issues, and after 1.1.5 it’ll be back, better than ever!

If you have any issues installing or upgrading, please ask in our community area. If you have any feedback, you can talk about it in our community area, but we’ve also recently signed up to GetSatisfaction – check us out at getsatisfaction.com/novaboard and let us know how you feel, and what you want in the software.

So, till next time!

James Milligan

Project Manager of NovaBoard

Released: March 9th 2010

NovaBoard 1.1.3 Full Installation: http://novaboard.googlecode.com/files/NovaBoard1.1.3.zip

NovaBoard 1.1.3 Upgrade Package: http://novaboard.googlecode.com/files/NovaBoard1.1.3_Update.zip

Changes since 1.1.2:

• Smilies are now shown on the quick edit screen.
• It is now possible to set up a forum to redirect to a specific URL.
• It is now possible to create a shadow topic when moving a topic.
• It is now possible to set a forum to be a ‘trashcan’ forum. This is where all deleted posts are stored.
• Post installation there is now a PM with helpful links included
• It is now possible to instantly see whetherNovaBoard is up to date by going to the Admin CP homepage – there is a new status checker.
• Moderator permissions are now properly removed when deleting a category.
• Default login template improved for usability.
• Added the ability for the rebuild_lang function to modify existing strings.
• Problem with selecting a category’s parent on the categories edit page was fixed.
• Sub-forums do not show on the board index if you don’t have permission to view them.
• Ability to allow guest upload by checking the ‘select all’ box was removed.
• Smilies, settings, word censors, groups and moderator permissions are now all cached for better performance.
• Autosuggest now sets a level of error reporting to stop the script dying if an error occurred.
• Problem where the frequency of paypal subscriptions was not recorded was fixed.
• Functionality for a more extensible plugin system was added. Some queries were modified to allow plugins to ‘extend’ them.
• Inclusion exploits in admin cp, my options and structure were fixed.
• New hook locations added to certain files.
• Bug where an email was not sent in the recipient’s language has been fixed.
• Bug where usertitle would always default to 0 was fixed.
• Step 4 was removed from the installer. Instead, the errors are now displayed in-line.
• Problem where the akismet key was not recorded has been fixed.
• Trackback url now displays properly with sef_urls on.
• Typo which caused a bug in the paypal process was fixed.
• Possibility for SQL injections in add reply, header and search were all fixed.
• Problem where the forum displayed a member as unregistered if their name was the equivalent of 0 was fixed.
• Full-stops are no longer incorrectly parsed at the end of an url.
• The base url is now correct for RSS feeds.
• BBCode has been removed from RSS feeds.
• Problem with Cyrillic alphabet characters not displaying on the post preview screen was fixed.
• It is now not possible to remove Admin CP access for the Admin group.
• Some images optimised for quality.
• The date_format language string now uses ‘%H:%M’ instead of ‘%R’ for compatibility with all servers.
• Bug in function rebuild_lang when dealing with the myoptions file was fixed.

NovaBoard 1.1.2 Full Installation: http://novaboard.googlecode.com/files/NovaBoard1.1.2.zip

NovaBoard 1.1.2 Upgrade Package: http://novaboard.googlecode.com/files/NovaBoard1.1.2-Update.zip

Changelog: