12 replies to this topic

[FUS News Robot]

Some users weren't able to log in because their account was set to use the Warrior skin, which is currently unavailable. I've worked around this by disabling the Warrior skin for now. Don't worry, it'll be back soon! Hopefully you should be able to log in now, at least.

Read the full story here

[Shadow]

Is the warrior skin the black background? That was the one I used.

[chief]

Yeah,....So right now the main FUS skin and the Black Warrior one are disabled.   Hpefully we can fix those soon.  If Not I'll have to drag out Neon and beat him to make IPB pretty again.   Thats if Kef can't tweak it...We are running completely different software then before so...Things are weird. 

[furrykef]

Well, to be precise, we're running the same software, but a fresh installation of it. I reinstalled everything from scratch; I did not reupload anything from the old server without being 100% sure that it either contained no .php files or that all .php files were clean. This way it should be impossible for there to be any back doors left over.

[Uncle Ben]

Well, to be precise, we're running the same software, but a fresh installation of it. I reinstalled everything from scratch; I did not reupload anything from the old server without being 100% sure that it either contained no .php files or that all .php files were clean. This way it should be impossible for there to be any back doors left over.

 

Should, you never know.

 

 

When will Warrior (black) theme be back?

[Uncle Ben]

Also, autocorrect doesnt work. Underlines doesnt show up when a word is wrong. It shows up everywhere else except here

[furrykef]

When will Warrior (black) theme be back?

Hopefully within 24-48 hours. I still gotta get Arekkisu's site (which is hosted on FUS's server) transitioned to the new server first. That should be a piece of cake, though.

[randomizer]

What is your backup schedule for files and DB? considering the frequency of breaches it seems like you'd need it to be pretty frequent so that you can recover from breaches without losing too much.

[furrykef]

I think we were doing a daily backup and a weekly one. For this, though, I didn't use a backup from before the hack. Instead, I reinstalled Wordpress for the main site and for Sea3on, and I reinstalled Invision (which took rather longer than I hoped). For everything else I just transferred the files as-is to the new server, but I either deleted all .php files or I made sure all the .php files were clean. There were very few .php files I needed to upload this way, so checking them was no big deal and I am 100% confident I didn't upload any compromised ones.

[randomizer]

Do you have any idea what the initial attack vector may have been?

[furrykef]

Well, the first time we got hacked, it was probably through an out-of-date, vulnerable Wordpress installation. The second time, it was probably through a backdoor I failed to clean up after the first time. I did a poor job of it and got what I deserved; it's too bad all the other FUSers had to suffer along with me. It's also possible they figured out one of the Wordpress passwords after the first hacking and got in that way, so this time around I also forced a change of all Wordpress passwords.

[randomizer]

One of the biggest downsides of using WP is that you constantly need to make sure that it and all of its plugins are up to date. The other is that it's awful to develop for. If only it wasn't so nice to use it would be so much simpler to make a case against it.

[furrykef]

I'm not the biggest fan of WP myself. Switching to something else would be so painful, though...