A Spanish hacker, called T3ES, belonging to the Alboraaq hacking team, penetrated the WordPress installation through an unknown security flaw, and uploaded a PHP shell console, enabling him to further carry out malicious hacks throughout the site. This meant it also affected my own website, which is run on the same account.

I was informed of the hack within minutes, and immediately asked our host, TMDHosting, to restore the backup they say they keep of our sites. However, it took nearly two weeks to restore this backup, because of various issues with past backups, and also the fact that the hacked content was partially backed up. It had to be manually cleansed by technicians at our ISP, hence the delay.

During the downtime I sent a polite email to the hacker (who ever so kindly(!) left his email address) on the webpage. I received no reply.

I have since sent an email to both his domain registrar and hosting companies, asking for action to be taken, whether it be account suspension/deletion, or something else, since all the evidence is blatantly displayed on the site. I have yet to receive a response, but if any news comes through I will let you know.

So, we’re practically all up and running again now, the forums should be up shortly. We are also currently setting up a separate server to be partly used for backups, as well as a development area (e.g. maybe running Redmine etc). More details will follow.

Our host, TMDHosting, probably hate me for the amount of support tickets I opened demanding updates every day, if not twice a day, and asking this and that regarding the length of the time it was taking to restore the backups. After finally having the site back online, I just want to say that I am grateful for the work that the technicians and engineers did, as it isn’t a service that they normally carry out for free.

Thanks once again to those that got in touch, we appreciate the time you took to contact us, and we’re just sorry that we couldn’t get back online sooner.

If pages/posts/files are missing/corrupted, or if you notice something odd/strange with the website, such as a PHP shell, random text that doesn’t look as though it should be there, or just generally suspicious files/text, send an email to me, james@novaboard.net and I’ll look into it ASAP.

We apologize in advance for the interruption, in the hope that it won’t last very long.

All that is happening is some background maintenance.

The forum will be placed temporarily offline from late on Saturday to preserve the data that is in the database, and to ensure that posts etc aren’t lost during the transfer.

When we receive the ‘all clear’ from our hosting company the forum will be reopened as usual.

If at any time you need urgent help regarding NovaBoard, you would usually be asked to email james@novaboard.net, but as the server could be down, for this time only, use the email address lake54@lake54.com

Thanks,

James
Project Manager

Over the last couple of weeks, we have had a period of extensive hacking attempts, and the other day, these turned into successful exploits. As some of you may have noticed, the site has experienced regular, short bursts of downtime. Some of these were caused by host server maintenance, whilst others, such as the other day when you were greeted by a blank screen upon login to the forum, were caused by hackers.

The Blank Screen incident

Hackers managed to exploit a weakness in an existing module (the Theme Editor), and insert a line of code which effectively cut off the database connection when any page on the site was accessed. We couldn’t work out what was causing the ‘whiteouts’ at first, and after an entire reinstall, we pinpointed it down to the theme, as only some users were affected.

If you use the Theme Editor on your NovaBoard installation, please, for your own security, remove it until an update has been issued.

The 500 Internal Error incident

Hackers made attempts to bypass existing security measures, and succeeded in accessing directory listings. Whether this was from an FTP connection, or whether it was from another exploit, we simply don’t know, as the logs aren’t detailed enough. However, once they had secured access, they cleaned the contents of the directory where the forum was hosted, resulting in data loss.

Now, we did realise this fairly soon, and I began a support session with a technician at the hosting company. He assured me that he could restore an at worse case 48 hours old backup to the forum directory. Unfortunately, this was not the case. He restored a backup made weeks ago onto the entire server, resulting in a total mess of the directories. Now, I must stress, the hosting company is a fantastic one, and I use them for all my hosting needs, this is the first case of something like this happening. In a way, it’s helped highlight how much crap there was on the server, so, we’ve wiped it and started again (of course, this was after making multiple backups!!!)

What’s happening now?

Over the next few days, we’re rebuilding the site in a more efficient and secure fashion. You may already notice the new theme on the homepage, and we’re utilising the WordPress platform to provide you with more insight into the development process. Please, sign up and subscribe to receive the latest updates on the project!

You may experience 404 (not found) errors and other downtime period during the course of this rebuild period – please don’t be put off by this. All the project code and downloads are hosted on Google’s servers, and even if this site was to suffer a massive loss of data, and everything was somehow nuked off, the downloads will still, always be available at the Google Code project site - http://code.google.com/p/novaboard

Thanks for reading this post, and we hope to see you back here soon. If you ever need to get in touch with someone, whatever the reason, send an email to james@novaboard.net

James Milligan
Project Manager
NovaBoard

- Community Forum Restoration
Completed!

- Addon Area
In progress!