We were hacked by a Russian Injection BOTNET, Forums Upgrading Thurs-Fri

NO NO NO!!

I can put my Inspector Clouseau glasses away.  I have found out what killed our system today..

We were hit by a RUSSIAN Injection Botnet.  It attacked both our front end as well as our forums.

I knew something was amiss when I was notified by 8404 this AM that the forums were down.  When I tried to log on I couldn’t.

When I tried to log onto the front end of corpsman.com, I couldn’t with IE9, or Google Chrome.  Firefox 4.0 worked ok, but had some load issues.

After talking with Crazycajun (He’s back onboard!! Thanks god!) He saw some stuff happening in our server that was eating up lots of space and was draining the system resources.

We decided that we would update the forum software tomorrow (Thurs) and into Friday.  I’m aquiring all the files now to do the upgrade.

After that though, I spoke to DanM (Forums) who told me the error he was getting from his security software (AVG, which I trust and have used before).  We were getting hit with an injection software program.  Probably from our forums, but it also reached into WordPress as well as it is a CMS driven program.  The thing they both have in common is SQL.  I think the injection went in through there.. and havoc ensued.

I have since re-installed WordPress, and the front end is running fine and smooth again.

The forums on the other hand will be a work in progress for a bit.  Please bear with us, but also, we did not lose anything.  All accounts are still up and ready to rock and roll once in.

The one thing we probably will lose though are the templates for our design.  This can all be re-created though.

If you have any questions.. please email me @ admin1@Corpsman.com, or tweet me on twitter: http://twitter.com/da_chief .

Thanks everyone!

Drink a shot for me..

Da-Chief
Corpsman.com