Meluaworld has been hacked.

I regret that Meluaworld has been Hacked. I have been trying, for some time, to get in contact with
Dejavu to see what can been done. In the meantime welcome to the Spaceship our emergency
meeting place for Katie fans.

That's very sad what happened... I don't understand why someone wanted to hacked MeluaWorld???!!!???
Anyway... does anybody know what can be done in this situation? Is there any institution we could appeal?
Does anyone could help us??

It seems that only the main page "Forum Overview" isn't working. When you go on google to "Meluaworld Viewtopic" and enter the forum by an other topic than the main page everything is ok.You can log in and post. But you can't go outside "Melua Mania" because you can't go over the hacked main page.

Dont know if it's possible for you to contact the host and inform them. Maybe they could restore the backup and after that immediately update to the latest phpbb version.
But you need full access to the webserver so I suppose only Dejavu is be able to that.
Otherwise those phpbb script kiddies will hack it again.

Links:

Melua Mania

Mischief

Menagement

That is bad news, on the other hand I do like this setup with integrated chat. I guess we will get this place better the next few days.

Thanks Hans for the links to MW. With this links we have full access to Meluaworld! When you log in in MW you get to the hackerside but when you enter MW a second time after that you are loged in!

hi folks,

seems the hackgroup attacked several sites with the same forum software yesterday.

the hackers usually only replace the main index.php with a simple html-code to prevent people from accessing the site. as soon a session cookie is created by logging in via a login.php page it should be accessible again. But be careful. sometimes they have added a program code that fetches your password etc.

The easiest way would be to simply replace the malfunctioning index.php from the main directory by a clean one from the forum software. and check the permissions on the files. sometimes it even helps to put the full forum software into a subfolder

I hope this helps.

cheers

Really upset at what happened here so I hope it gets solved sooner rather than later.
Out of curiosity though, I would like to know what the black page says so I am curious if anyone knows arabic here.
(Weird suggestion I know but I am intrigued to understand ther eason behind the hacking)

Stintfang wrote:hi folks,

seems the hackgroup attacked several sites with the same forum software yesterday.

But be careful. sometimes they have added a program code that fetches your password etc

Do you mean that they can fetch the login passwords of the members?

JosCR66 wrote:.... I would like to know what the black page says so I am curious if anyone knows arabic here.

I don't know arabic but google does....

--------
Peace, mercy and blessings of God
In the name of God the Merciful:
---
Web site focusing on the functions of foreign
You are looking for jobs - and the Arabs in Syria to kill and violate their sanctities
Is not this injustice.
-
HazEeN-HacKer
8o@Hotmail.sg

Martin wrote:

Stintfang wrote:hi folks,

seems the hackgroup attacked several sites with the same forum software yesterday.

But be careful. sometimes they have added a program code that fetches your password etc

Do you mean that they can fetch the login passwords of the members?

Who knows? According to the source code there is some javascript with a timeout, but I didn`t analyse it.
I can only warn to be careful entering any username/passwords until the site is repaired.

This all seems so wired.

Stintfang wrote:
I can only warn to be careful entering any username/passwords until the site is repaired.

OK. that would mean that we shouldn't log in in MW, isn't it? But there would be basically a problem when you need the same username and password at another place with more critical contents. When they just post a spam under the name of a member in MW I think everybody would recognize it.

If they have the dbase then they already have the login details but lets hope only 1 file has been infected.

It may be time to pull the plug on MW if nobody is getting in control, especially since it has been hacked. It would not surprise if the whole thing needs to be rebuilt and new people involved, especially if it turns out that upgrades and patches has been ignored lately.

I wonder if there are any people left, who are interested in Katie and the fandom.

I am disappointed. Not so much because MW is hacked, but only few people know the Spacehip as a supporting forum. I feel very sorry for Barbara, who has invested so much time in MW.

I can't imagine why MW members should have lost there interest in Katie and MW bacause the forum was hacked. I don't remember from where I know MW spaceship. I think it was because somewhere the sunday evening chats were mentioned but you don't find out in MW that it exists so easily.
An other way is by Meluaworld facebook page. But not everybody knows that it exists.
And I think many members didn't realize that you still can go in MW topics entering by "view topic".
I hope that the forum frontpage can be restored. Domker has posted an idea how it could be managed in MW.

Not to forget yourelf Robert, always so loyal and joining the chats, which I Really enjoy. I think all active mods and Barbara is doing a great job. If there is anything I can contribute with to get MW rebuilt, please let me know.

Ok finally some good news. Last night I gain access to the phpbb admin panel with Barbara's account. Lucky she did also had super admin rights so
I was be able to make a backup of the SQL database with the internal backup system. I myself are using IPB and always do make backups this
way. Lucky phpbbb works the same.
I've installed the latest version of phpbb on my own server atm and did connect it with the database. Not everything is working because I cant
access the ftp server but as far as I can see all posts are working. Except files which are stored on the server are not working such as Avatars
and attachments. Avatar issue is no big problem because you can upload them again.
Because Barbara is not the owner of the domain meluaworld.com she has to choose another name for the forum.
Also when the index.php should be fixed we still have the problem that we cant update the forum to the latest version so it's better to move the
whole forum to a new location so Barbara has full control of the whole server. But it still would be great if someone can fix the index.php so the hack message will be gone.

Anyway as soon as Barbara knows what domain she wants to use and we checked the forum well it could be very soon online again.
I think the easiest way to inform everyone is that Barbara sends a mass email to all members so they know about the new forum and where to find it.

Edit:

Great news! Thanks Ronald and Barbara

Good job Ronald and Barbara

Mr.Lunatic wrote:
But it still would be great if someone can fix the index.php so the hack message will be gone.

Can`t you just upload the index.php from your working copy of the forum to the server? that should solve the problem. Additionally the hacker might have uploaded an additional index.html which doesn`t belong there, but catches the browser before it can trigger the .php . in that case the .html or .htm could simply be erased to make the site working again.

I wasnt be able to upload files but with Anro's solution I was. But still the forum is vulnerable for attacks.
I would suggest to close the forum till Dejavu returns and refer to the new domain. When they try again the forum will be hacked again.
It's better to have a forum which we have full control of and can easily update.

Mr.Lunatic wrote:I wasnt be able to upload files but with Anro's solution I was. But still the forum is vulnerable for attacks.
I would suggest to close the forum till Dejavu returns and refer to the new domain. When they try again the forum will be hacked again.
It's better to have a forum which we have full control of and can easily update.

that`s right. thanks for your efforts.