Great site hacked - help!

[Learning As I Go]

I belong to another forum called, "Responsible Single Fathers". When I logged on this morning, I saw the site had been hacked. It has been taken over by MorphueS and he posted a threat on the Forum. Essentially, he is going to delete the site. All contacts to the owner and moderator have been removed. My question is this: If/when the owner is able to work out the problem, is there someone/something that I can suggest to the owner to prevent this from happening again. The problem is there is such a lack of support for single fathers as it is, and I think the owner runs this forum "out of pocket". If he can't get a viable solution, I'm afraid the site will be shut down permanantly. Please help support the "supporters".

Thanks,

LAIGo

[airwolf9090]

hey whats the site address?

[Learning As I Go]

www.singlefather.org

[airwolf9090]

i cant beleave someone would do this why would someone do this who ever did this needs to go to jail how can i be of help to you all nice people?

[Farbib]

Who got hacked?

Is it some guy who hosts it himself? (which it sounds like) Or maybe the owner of this domain uses a small hosting company? If the latter, I'd call them and see if they have a backup copy of the website files.

Sounds like AirWolf is ready to go to war for ya too

[Learning As I Go]

I believe it is something he does on his own. According to the front page and the "former" Announcements thread, he changed the site through lack of funding.

Thanks Airwolf - I'm coming to your site now.

[Learning As I Go]

Okay - maybe that's not your site after all .

Farbib - I can't get in contact with the owner, all references seemed to have been removed. ::

[Farbib]

Responsible Single Fathers
Vince Regan, President
541 Knapp NE, Grand Rapids, MI 49505
Phone: (616) 447-0798
Fax: (877) 291-9130
E-mail: office@singlefather.org

[Learning As I Go]

You rock - I'm logging off and calling him now!

[Learning As I Go]

Alright, I called and left a message and I await an e-mail. In the mean time, if anyone has any suggestions as to what he can do to protect himself, I will pass them along. Also, this is a subject I feel VERY strongly about, so if anyone can suggest what I can do from my computer - I would appreciate it.

LAIGo

[airwolf9090]

i wonder if we could track his e-mail i wonder what he has in mind for it any why he said he would tell how to fix it i think he is looking for money or something and thin try and distroy the site


yea sorry thats not my site its a friends lol thats just one of many i own 2 one for knight rider and one for viper if you would like to join my site i will give you address by the way i see you live in Athens,Ga i live south of you down in middle, GA near rabins airforce base

[Learning As I Go]

I am so ignorant about computers it isn't funny. I don't know how to even begin to track his e-mail.

I agree, even if this jerk fixes what he did, he will probably leave a "backdoor" for later, or as you said delete it on a whim.

I'm not sure how to adjust my UserCP, but I think I remember seeing an option to allow members to PM me. If so, I am going to add you. We can exchange e-mail address and discuss this further without BLOging this forum.

LAIGo

[Farbib]

I would allow for some negotiation, and find out who he is that way.

Maybe a phone conversation, keep him on long enough to get a trace.

If it's about money, then I would "agree" to the terms and somehow trace where the payment occurs. Write a bad check, for example.

Or if the person lives nearby (bet this person knows the webmaster) arrange to meet him.

And then get the authorities to scout it out...Bad Boyz What Ya Gonna Do? You're under arrest...

That would be sweet for Vince I bet.

[DavidGP]

Tracking the email addy of the hacker will only get you to the servers of Mail.ru as he/she is using the Russian equivelent of Hotmail.

If he is using the Hosting company that has an Ad on this front page Bizhand.Com he could chat to them as to backups of the site and if they have one from before the hacker appeared.

Sadly phpbb being open source is liable to being hacked easier than the likes of VBulletin, also staying upto date with the phpbb software is needed to gain any updates to security etc etc ( software now at version 2.0.11 )

also as with other popular software users create hacks/tweaks for the fourms, this site has some security hacks/tweaks http://www.phpbbhacks.com/category/10 he may wish to look into, plus he may want to start searching for how to secure a phpbb site and keep regular backups himself of the forum database.

I hope this gets sorted soon and dont give the cyber-terrorist and money, sadly if you have to start afresh with a new forum so be it the same members will still come and keep on posting, just save as many of the important posts as you feel you need as you can always post them on a new forum.

[Farbib]

Originally Posted by Halo

Tracking the email addy of the hacker will only get you to the servers of Mail.ru as he/she is using the Russian equivelent of Hotmail.

Halo, 1) How did you figure the above out about the email address? 2) Hypothetically speaking, if it was a local cracker, and through social engineering Vince was able to arrange a meeting the local cracker (say to pay money), do you think the local authorities would get involved? This hypothetical is unlikely, but I am just curious if you knew the answer. Thanks.

[Learning As I Go]

Thanks Halo.

I just noticed someone posted on their forum today. She is seeking advice for a soon to be father (her boyfriend). I really want to respond, but since the hacker is in control, I'm not sure if logging in will give him additional access to me. It would be great if we could go on "business as usual", but I know nothing of the inner workings of websites.

LAIGo

[Farbib]

Maybe Halo's busy creating an account, and trying to get more information :D

[DavidGP]

Originally Posted by Farbib

Halo, 1) How did you figure the above out about the email address? 2) Hypothetically speaking, if it was a local cracker, and through social engineering Vince was able to arrange a meeting the local cracker (say to pay money), do you think the local authorities would get involved? This hypothetical is unlikely, but I am just curious if you knew the answer. Thanks.

No1. I have a @mail.ru account and one of the other options is for @bk.ru http://mail.ru/ in blue box to the top left side just click the arrow next to @mail.ru and some other mail extentions will apear and his is listed.

No2. If he/she is local or in USA and would meet to exchange what could be called a ransom or extortion then the local police most likely would get involved BUT you would need to talk to them first.
( I'm not up on US law but they are getting harder on what could be called a cyber crime )

[DavidGP]

Originally Posted by Learning As I Go

Thanks Halo.

I just noticed someone posted on their forum today. She is seeking advice for a soon to be father (her boyfriend). I really want to respond, but since the hacker is in control, I'm not sure if logging in will give him additional access to me. It would be great if we could go on "business as usual", but I know nothing of the inner workings of websites.

LAIGo

Sadly he could now he has control, look at all members accounts so he will have access to your user cp which will have your email address etc etc, so logging in shouldnt give him any more info other than your IP address if phpbb supports logging IPs.

I dont think helping her is going to give him any more information than he already has, it just looks like he's a scammer who looks for vunerable web forums to hold to ransom.

[Omegamerc]

Heres the million dollar question; wth does someone with poor English grammar, and using .ru email want with a website for ~50ppl?

: