Wrongplanet.net has been hacked

Post Reply New Topic

At first I thought I was either more tired than I knew, or mozilla was turning into a script kiddie, but it soon dawned on me that I was only getting the message "Th3_analyz3r - Unknown_3rr0r" in the title bar with wrong planet. Visiting 'home' confirmed that someone had compromised the site. Although it's not my job to admin the site, I'd like to say to NOBODYCODER; thanks for (I hope) not deleting anything and generally leaving things intact.

To everyone else, or NOBODYCODER if they care to tell us; how was wrongplanet hacked and how can it be secured? It's not a subject I know much about.

Maybe this should be in 'bug reports and ideas'.

looks like alex has been cleaning up as of late

I fixed it.

are you alex? Or a friend of his?

In any case, thank you!

WrongPlanet.net was compromised through a phpnuke security hole that Mashi, thankfully, patched. The attacker got in through a mysql injection that he was able to execute because of a bug in the input validation for the URL. The line that read

checks to see if the person is not an admin. If the person isn't an admin, the script won't let the person access the database. If the person is an admin, the user can access the database. The url validation was buggy, however, and didn't truly prevent nonadmins from executing an sql injection, because while someone couldn't write:




Someone could write


without the mentioned regex actually catching the input as being invalid. By changing the conditional to this:

we are able to make the regex register a url as invalid when something precedes the "admin=" portion of the url. Thats the only thing that needed to be changed to have prevented the attacker from gaining access.

Alex,
Were there any other changes to the site's code or was there any information compromised?

No, they only had access to the site through the admin control panel so they couldn't change any code.

Why are you telling people how it was hacked? Don't give them ideas..

It totally freaked me out when I saw it last night. No-one had posted anything about it so I thought it might have just been me.. or it was some kind of joke.

Well, we fixed the problem and trying to base a security plan on not giving people ideas is security through obscurity which really sucks on the internet at least.

Security through obscurity is largely why M$ has so many problems. It underestimates a hacker's intelligence and overestimates their common sense.

creepy. Glad the hacker didn't permanatly hurt anything.

Why does it say butterfly? This is a Luna Moth!

Butterfly is the level you are at based on the number of posts you have made.