Ancica
11-12-2005, 16:44
Prenosim sa: http://www.phpbb.com/phpBB/viewtopic.php?t=348139
Techie-Micheal
There appears to be a new worm on the loose. If your phpBB has been defaced, please do the following:
1. Immediately get full backups of your entire website including phpBB
2. Immediately get full backups of your database
3. Get log files
4. Do not delete anything!
5. Do not use these backups to restore your site.
6. These backups are to be used to send to the Incident Investigation Team, and only the Incident Investigation Team. If the poster asking for logs or backups does not have a Support Team rank, do not do anything they tell you to do.
7. PM NeoThermic or myself to tell us you need assistance. Do not post in support asking for help.
8. Close your website (including phpBB!) until the IIT tells you it is okay to reopen.
Users on 2.0.18 are not affected - this is targetting those forums still on versions around 2.0.10 at present.
If something has been modified or deleted after an attack, we will not be able to assist you. The reason for this is that evidence has been tampered with and information we needed is now missing. It is very important you do not modify or delete until we say it is okay. The more information we have about this worm, the quicker we can help others.
We know this worm has filesystem access and potentially drops files which may be backdoors or rootkits. It is very important that you do not delete or modify these files or anything else. As noted above, the more information we have about this worm, the quicker we can help others.
Kako se koji novi post pojavi na originalnoj temi, tako ga dodajem u ovaj.
Techie-Micheal
There appears to be a new worm on the loose. If your phpBB has been defaced, please do the following:
1. Immediately get full backups of your entire website including phpBB
2. Immediately get full backups of your database
3. Get log files
4. Do not delete anything!
5. Do not use these backups to restore your site.
6. These backups are to be used to send to the Incident Investigation Team, and only the Incident Investigation Team. If the poster asking for logs or backups does not have a Support Team rank, do not do anything they tell you to do.
7. PM NeoThermic or myself to tell us you need assistance. Do not post in support asking for help.
8. Close your website (including phpBB!) until the IIT tells you it is okay to reopen.
Users on 2.0.18 are not affected - this is targetting those forums still on versions around 2.0.10 at present.
If something has been modified or deleted after an attack, we will not be able to assist you. The reason for this is that evidence has been tampered with and information we needed is now missing. It is very important you do not modify or delete until we say it is okay. The more information we have about this worm, the quicker we can help others.
We know this worm has filesystem access and potentially drops files which may be backdoors or rootkits. It is very important that you do not delete or modify these files or anything else. As noted above, the more information we have about this worm, the quicker we can help others.
Kako se koji novi post pojavi na originalnoj temi, tako ga dodajem u ovaj.