A Spanish hacker, called T3ES, belonging to the Alboraaq hacking team, penetrated the WordPress installation through an unknown security flaw, and uploaded a PHP shell console, enabling him to further carry out malicious hacks throughout the site. This meant it also affected my own website, which is run on the same account.

I was informed of the hack within minutes, and immediately asked our host, TMDHosting, to restore the backup they say they keep of our sites. However, it took nearly two weeks to restore this backup, because of various issues with past backups, and also the fact that the hacked content was partially backed up. It had to be manually cleansed by technicians at our ISP, hence the delay.

During the downtime I sent a polite email to the hacker (who ever so kindly(!) left his email address) on the webpage. I received no reply.

I have since sent an email to both his domain registrar and hosting companies, asking for action to be taken, whether it be account suspension/deletion, or something else, since all the evidence is blatantly displayed on the site. I have yet to receive a response, but if any news comes through I will let you know.

So, we’re practically all up and running again now, the forums should be up shortly. We are also currently setting up a separate server to be partly used for backups, as well as a development area (e.g. maybe running Redmine etc). More details will follow.

Our host, TMDHosting, probably hate me for the amount of support tickets I opened demanding updates every day, if not twice a day, and asking this and that regarding the length of the time it was taking to restore the backups. After finally having the site back online, I just want to say that I am grateful for the work that the technicians and engineers did, as it isn’t a service that they normally carry out for free.

Thanks once again to those that got in touch, we appreciate the time you took to contact us, and we’re just sorry that we couldn’t get back online sooner.

If pages/posts/files are missing/corrupted, or if you notice something odd/strange with the website, such as a PHP shell, random text that doesn’t look as though it should be there, or just generally suspicious files/text, send an email to me, james@novaboard.net and I’ll look into it ASAP.

Released: June 14th 2010

NovaBoard 1.1.4 Full Installation: http://novaboard.googlecode.com/files/NovaBoard1.1.4.zip

NovaBoard 1.1.4 Upgrade Package: http://novaboard.googlecode.com/files/NovaBoard1.1.4_Update.zip

Changes since 1.1.3

Additions

Thanks for hanging in there! We know that it’s been a while since our last release, but we’re back on top of things, and are already working on NovaBoard 1.1.5!

In the release of 1.1.4, we included the popular Suspended Members module to make it easier for everyone to manage their members, as well as incorporating the Nation Flags due to popular request.

If you have these modules installed, we have included functionality in the installer so that you don’t need to touch your existing modules – you can leave them installed, and it will all be seamlessly be merged.

We’ve fixed 23 known bugs, that’s nearly all of those that have been reported – those that are left (which were reported towards the release date and are minor) have already begun to be fixed for release in 1.1.5. We also had a recent surge in the amount of security flaws that were able to be exploited through NovaBoard – we take security very seriously, and all reported flaws have been patched up – your forum will now be safer than ever!

I’d like to take the opportunity to thank you, the community, for using NovaBoard – it’s great to know that our work is being used by hundreds of websites across the globe. We want to help you make your forum the best it can be, and so after NovaBoard 1.1.5, we plan to make the software much quicker, yet even more extensible than it is right now. We also plan to bring back the remote install module and theme feature, from back in the days of 1.0.x. It’s been missing for a while, there are good reasons why it was taken offline, but we’ve worked around those issues, and after 1.1.5 it’ll be back, better than ever!

If you have any issues installing or upgrading, please ask in our community area. If you have any feedback, you can talk about it in our community area, but we’ve also recently signed up to GetSatisfaction – check us out at getsatisfaction.com/novaboard and let us know how you feel, and what you want in the software.

So, till next time!

James Milligan

Project Manager of NovaBoard

We’re going to be releasing versions 1.1.4 and 1.1.5 fairly soon, with an anticipated release of 1.2.0 some time later this year, a date is yet to be confirmed.

At the moment, we’re pretty much overwhelmed with the ideas we have from our community, and so we aren’t actively asking you for more, but once we have 1.2.0 released, we will indeed be looking for some fresh and innovative thoughts about the software – we’ll let you know when we’re at that stage.

So, in summary, development is well and truly full steam ahead, look out for NovaBoard 1.1.4 in the next couple of weeks!!!

James

We apologize in advance for the interruption, in the hope that it won’t last very long.

All that is happening is some background maintenance.

Released: March 9th 2010

NovaBoard 1.1.3 Full Installation: http://novaboard.googlecode.com/files/NovaBoard1.1.3.zip

NovaBoard 1.1.3 Upgrade Package: http://novaboard.googlecode.com/files/NovaBoard1.1.3_Update.zip

Changes since 1.1.2:

• Smilies are now shown on the quick edit screen.
• It is now possible to set up a forum to redirect to a specific URL.
• It is now possible to create a shadow topic when moving a topic.
• It is now possible to set a forum to be a ‘trashcan’ forum. This is where all deleted posts are stored.
• Post installation there is now a PM with helpful links included
• It is now possible to instantly see whetherNovaBoard is up to date by going to the Admin CP homepage – there is a new status checker.
• Moderator permissions are now properly removed when deleting a category.
• Default login template improved for usability.
• Added the ability for the rebuild_lang function to modify existing strings.
• Problem with selecting a category’s parent on the categories edit page was fixed.
• Sub-forums do not show on the board index if you don’t have permission to view them.
• Ability to allow guest upload by checking the ‘select all’ box was removed.
• Smilies, settings, word censors, groups and moderator permissions are now all cached for better performance.
• Autosuggest now sets a level of error reporting to stop the script dying if an error occurred.
• Problem where the frequency of paypal subscriptions was not recorded was fixed.
• Functionality for a more extensible plugin system was added. Some queries were modified to allow plugins to ‘extend’ them.
• Inclusion exploits in admin cp, my options and structure were fixed.
• New hook locations added to certain files.
• Bug where an email was not sent in the recipient’s language has been fixed.
• Bug where usertitle would always default to 0 was fixed.
• Step 4 was removed from the installer. Instead, the errors are now displayed in-line.
• Problem where the akismet key was not recorded has been fixed.
• Trackback url now displays properly with sef_urls on.
• Typo which caused a bug in the paypal process was fixed.
• Possibility for SQL injections in add reply, header and search were all fixed.
• Problem where the forum displayed a member as unregistered if their name was the equivalent of 0 was fixed.
• Full-stops are no longer incorrectly parsed at the end of an url.
• The base url is now correct for RSS feeds.
• BBCode has been removed from RSS feeds.
• Problem with Cyrillic alphabet characters not displaying on the post preview screen was fixed.
• It is now not possible to remove Admin CP access for the Admin group.
• Some images optimised for quality.
• The date_format language string now uses ‘%H:%M’ instead of ‘%R’ for compatibility with all servers.
• Bug in function rebuild_lang when dealing with the myoptions file was fixed.

Most of this development time however, has been used to fix bugs and some security issues that existed in the software before the changeover. With great support from you, the community, the board is now very stable and secure; all of the bugs of which we are aware of have been dealt with. Of course this has been very important – there’s no point in a forum having tons of features if its crashing every 5 minutes or allowing hackers to gain access – but this has meant that we have been unable to kick on with our planned new features as fast as we would have liked. The end result of this is that the basic functionality of the software is now up to standard. This means we are now finally able to develop new features to help NovaBoard grow and reach its true potential.

The Next Version

The release of the current version 1.1.2 actually seems to be a very long time ago, dating back to September, but development has still been very much going on behind the scenes. During this time we’ve once again fixed numerous bugs that were reported. However, we’ve also been able to add a few new small features:

• Shadow Topics – When moving a topic, you now have the option to create a ‘shadow topic’. This is where a copy of the topic is added to its original forum so users can get redirected to the new topic easily. Now it doesn’t just look like the topic disappeared!
• Redirect Forums – It is now possible to make a forum redirect to a different URL when clicked. Maybe you want to create a redirection to the subscriptions area to really make that link stand out?
• Trashcan Forum – From the admin cp you can now enable a ‘trashcan forum’. This is simply an area where deleted posts are stored just in case you ever want to restore them. It will also empty itself every so often depending on your preference. It’s basically just like the recycle bin on your desktop.

You can keep up-to-date with all the changes to the software over at our Google Code Project page.

What Can I Do?

If you use NovaBoard to power your community it makes sense that you might want to have an input on what goes into the software, or how a certain feature should work. If this sounds like you, take a look at what you can do to get involved:

• If you have a good idea for a feature or just want to discuss a certain aspect of NovaBoard head over here.
• Are you a module developer? If so, then you may find that NovaBoard is currently lacking a hook location to allow your module to work. If this is the case, you can request a new hook to be added by posting here with the relevant info.
• If you find a bug in the software then please report it here

The Future

We have big plans for NovaBoard in the future. Without giving too much away, we’re aiming to make the software much more extensible than it currently is, make themes much less of a hassle to create and allow conversions from other popular software.

Hopefully that’s enough to wet your appetite and thanks for reading.

The future of NovaBoard looks bright and we hope you’ll be with us for the journey!

The forum will be placed temporarily offline from late on Saturday to preserve the data that is in the database, and to ensure that posts etc aren’t lost during the transfer.

When we receive the ‘all clear’ from our hosting company the forum will be reopened as usual.

If at any time you need urgent help regarding NovaBoard, you would usually be asked to email james@novaboard.net, but as the server could be down, for this time only, use the email address lake54@lake54.com

Thanks,

James
Project Manager

Over the last couple of weeks, we have had a period of extensive hacking attempts, and the other day, these turned into successful exploits. As some of you may have noticed, the site has experienced regular, short bursts of downtime. Some of these were caused by host server maintenance, whilst others, such as the other day when you were greeted by a blank screen upon login to the forum, were caused by hackers.

The Blank Screen incident

Hackers managed to exploit a weakness in an existing module (the Theme Editor), and insert a line of code which effectively cut off the database connection when any page on the site was accessed. We couldn’t work out what was causing the ‘whiteouts’ at first, and after an entire reinstall, we pinpointed it down to the theme, as only some users were affected.

If you use the Theme Editor on your NovaBoard installation, please, for your own security, remove it until an update has been issued.

The 500 Internal Error incident

Hackers made attempts to bypass existing security measures, and succeeded in accessing directory listings. Whether this was from an FTP connection, or whether it was from another exploit, we simply don’t know, as the logs aren’t detailed enough. However, once they had secured access, they cleaned the contents of the directory where the forum was hosted, resulting in data loss.

Now, we did realise this fairly soon, and I began a support session with a technician at the hosting company. He assured me that he could restore an at worse case 48 hours old backup to the forum directory. Unfortunately, this was not the case. He restored a backup made weeks ago onto the entire server, resulting in a total mess of the directories. Now, I must stress, the hosting company is a fantastic one, and I use them for all my hosting needs, this is the first case of something like this happening. In a way, it’s helped highlight how much crap there was on the server, so, we’ve wiped it and started again (of course, this was after making multiple backups!!!)

What’s happening now?

Over the next few days, we’re rebuilding the site in a more efficient and secure fashion. You may already notice the new theme on the homepage, and we’re utilising the WordPress platform to provide you with more insight into the development process. Please, sign up and subscribe to receive the latest updates on the project!

You may experience 404 (not found) errors and other downtime period during the course of this rebuild period – please don’t be put off by this. All the project code and downloads are hosted on Google’s servers, and even if this site was to suffer a massive loss of data, and everything was somehow nuked off, the downloads will still, always be available at the Google Code project site - http://code.google.com/p/novaboard

Thanks for reading this post, and we hope to see you back here soon. If you ever need to get in touch with someone, whatever the reason, send an email to james@novaboard.net

James Milligan
Project Manager
NovaBoard

- Community Forum Restoration
Completed!

- Addon Area
In progress!

NovaBoard 1.1.2 Full Installation: http://novaboard.googlecode.com/files/NovaBoard1.1.2.zip

NovaBoard 1.1.2 Upgrade Package: http://novaboard.googlecode.com/files/NovaBoard1.1.2-Update.zip

Changelog: