Supergrobi
Honorary Member
Finally - cleaning up after the hack is done, time for a more detailed report to the interested user base. If you're not into this nerd sh*t you can stop reading here.
Prequel
Someone started a thread, asking for a dark theme for Drummerworld forums. Since I'm mostly working at night and because of how my screen looks like most of the time, I absolutely supported this request.
So I talked to Bernhard, offering my help and after having a very fruitful call with him, he gave me administrative credentials for the forums, the webhoster panel and the server. He also asked me if I maybe could take care of some updates pending so I started digging into the setup at that time. I was confronted with quite outdated software - which in fact no one could be blamed for: Bernhard as a drummer is maintaining and providing a stunningly informative and comprehensive website, offering an unparalleled amount of information around maybe all the worlds drummers, but he is no IT guy - how should one know about modsec, EOL, Heartbleed or SSL certificates then. And the webhosters support - even though those guys are highly skilled people - doesn't do anything if not being directly asked for. So it came that the forums software, the webserver, the database and even the OS the server was running on was a single, gigantic security issue.
Some of you might have encountered several shut-downs of the forum before the hack - this was me, slowly digging through all those software updates, one-by-one, always followed by intense testing that everything is still up and running fine. This is an unsurprisingly boring process which takes its time.
The Hack
At the time of the hack the forums software was updated only partially (since one cannot jump over multiple versions offhandedly but has to follow a time consuming update path), the server was running an outdated OS which ran out of support November 2020, the database was on a version from end of 2008, only the PHP compiler was on the latest stable version in order to allow for updating the forums software. So attacking this forum was kind of a comparably low hanging fruit.
This is my report I gave to the administration staff after we had the server and the forums back on the network that day:
Aftermath
Since then I'm constantly working together with the noticeably awesome support to set up a completely new server with the latest OS running the latest server software, migrating databases, converting content to modern charsets, hardening the server by installing and configuring various security layers and testing everything over and over again - everything with the least amount of outage possible. And today we finally managed to bring the new machine to life, hook it up to the internet and switch over the IP from the old server - all while still being under constant fire from someone trying to get access to the admin panel of the forum. This means that currently we are as secure as can be, although everything is hack-able to some extend.
Issues
Although I already spent hours on testing through all functionality the forum offers it's most likely that there's still some issues left. They normally show up as a pop-up saying something like "Oops we ran into some errors". Please don't hesitate to start a conversation with me in order to report those issues, at best with a timestamp when it happened and some information about what you were doing or trying to achieve.
One already known issue is that we weren't able to convert parts of the database to UTF-8 in time which (saved two full days of work, but also) comes with some minor issues. The most obvious is that signatures containing special chars within the UTF-8 range (which is e.g. emoticons or chars like 𝄆 𝄞 ) are represented as two question marks like so: ?? If your signature contains some of these chars please just edit it to your liking and it will work again afterwards.
Prequel
Someone started a thread, asking for a dark theme for Drummerworld forums. Since I'm mostly working at night and because of how my screen looks like most of the time, I absolutely supported this request.
So I talked to Bernhard, offering my help and after having a very fruitful call with him, he gave me administrative credentials for the forums, the webhoster panel and the server. He also asked me if I maybe could take care of some updates pending so I started digging into the setup at that time. I was confronted with quite outdated software - which in fact no one could be blamed for: Bernhard as a drummer is maintaining and providing a stunningly informative and comprehensive website, offering an unparalleled amount of information around maybe all the worlds drummers, but he is no IT guy - how should one know about modsec, EOL, Heartbleed or SSL certificates then. And the webhosters support - even though those guys are highly skilled people - doesn't do anything if not being directly asked for. So it came that the forums software, the webserver, the database and even the OS the server was running on was a single, gigantic security issue.
Some of you might have encountered several shut-downs of the forum before the hack - this was me, slowly digging through all those software updates, one-by-one, always followed by intense testing that everything is still up and running fine. This is an unsurprisingly boring process which takes its time.
The Hack
At the time of the hack the forums software was updated only partially (since one cannot jump over multiple versions offhandedly but has to follow a time consuming update path), the server was running an outdated OS which ran out of support November 2020, the database was on a version from end of 2008, only the PHP compiler was on the latest stable version in order to allow for updating the forums software. So attacking this forum was kind of a comparably low hanging fruit.
This is my report I gave to the administration staff after we had the server and the forums back on the network that day:
We got hacked today.
Maybe you have seen an announcement set up by one of the administrators, asking if someone could help him out by sending 300 bucks via PayPal. Same was posted on a new thread under the same account. The thread had only one view at that time so seems I spotted it just in time. I started a conversation with the administrator offering my help by sending money but asking for a video chat to confirm it's really the person owning the account and not just a random hacker. He said that he can't chat right now because he's on mobile and that the money is needed for the forums. I got curious, asking for what exactly he needs the money. He answered "for the software" and that he doesn't want me to ask any questions but to send the money, he is already very angry and it's very urgent. At that point it was 100% clear that it's a hack so I immediately picked up the phone and gave Bernhard a call, telling him that we're getting hacked right now and that he should inform the administrator about his account being compromised. At the same time I pulled up the hosters admin panel, adding a high priority ticket asking for immediate shut-down of the server and starting a live chat with the support, while I opened the forums admin panel trying do lock out the compromised account. At the same time the hacker started deleting all the forums, seconds later everything was completely wiped out. At the same time the hoster shut down the server. This was around 14:20 UTC. Bernhard then received a mail telling him that he has to pay 1500 bucks for the forum to come back online within 10 minutes. I mean - LOL?
Since then I had a support session with three guys all in all (they changed shifts along the way), recovering from a back-up from two days ago, cloning the compromised harddrive image for further investigations, updating various software, fiddling with exclusive access from my IP to the server to do various tasks on the SSH console and in the admin panel and finally bring the forum back to the network. Now for me it's a quarter to three in the morning (1:45 UTC) and I just sent the final report to Bernhard.
Let's see how things develop, maybe the attack isn't over yet as the hacker might have got highly pissed. Please keep heads up, the server is under constant monitoring by the hoster, too.
Aftermath
Since then I'm constantly working together with the noticeably awesome support to set up a completely new server with the latest OS running the latest server software, migrating databases, converting content to modern charsets, hardening the server by installing and configuring various security layers and testing everything over and over again - everything with the least amount of outage possible. And today we finally managed to bring the new machine to life, hook it up to the internet and switch over the IP from the old server - all while still being under constant fire from someone trying to get access to the admin panel of the forum. This means that currently we are as secure as can be, although everything is hack-able to some extend.
Issues
Although I already spent hours on testing through all functionality the forum offers it's most likely that there's still some issues left. They normally show up as a pop-up saying something like "Oops we ran into some errors". Please don't hesitate to start a conversation with me in order to report those issues, at best with a timestamp when it happened and some information about what you were doing or trying to achieve.
One already known issue is that we weren't able to convert parts of the database to UTF-8 in time which (saved two full days of work, but also) comes with some minor issues. The most obvious is that signatures containing special chars within the UTF-8 range (which is e.g. emoticons or chars like 𝄆 𝄞 ) are represented as two question marks like so: ?? If your signature contains some of these chars please just edit it to your liking and it will work again afterwards.
Last edited: