Site Incident - 2022-05-10

A script was injected onto a few pages on the site which caused some pages to not load correctly.

The pages affected was limited to what admins could edit; in this case the script was injected to a few sections of the homepage and a forum category name.

As a precaution, I have hardened security on the server and changed various passwords and have advised moderators with admin privileges to also change their passwords.

I will be adding directives to the site so unapproved scripts will not be able to run.

Let me know in this thread if you have any questions or concerns.

Legit question, does this pose a threat to our emails / passwords?

---

Can you elaborate more on this? If not, as in for legitimate reasons, dun worry, but I am curious about what happened (and if pages not loading correctly was the extent of it).

Sorry then...

I don't believe any credentials were compromised as the script would not have access to the database.


From what I can see in the script, it seemed to try and inject ads onto the site based on which page users visited.

???

---

is now the time to point out their extensive history of thread (necro)bumping & out-of-context posts?

---

Yesterday, there was an outage for several hours that didn't use the bespoke page regarding server load. Maybe it's just me being too antsy, but can we get assurance that this wasn't another script injection attack that may have been more effective than the last one?

And a war attack that won't happen again?

Someone let the mice into the machine again smh what did I tell you about cleaning out the crumbs

---

According to al2k4, the incident that occurred last Sunday (May 22, 2022) was caused by the same kind of injection attack, affecting various back-end admin files. This time, .htaccess was edited in a way that was invalid for Apache, leading to the 500 Internal Server Errors. He's currently unsure if there's a vulnerability in ZIv's scripts, or within Apache itself.

At the current moment, Alan said this is going to give him a push to rewrite most of the code for the website, as v5.2 is running off spaghetti dating back to 2006-09 🤢. As such, it's looking like v5.3 is now in development.

ZIv's website files are now being backed up daily, but due to the immense size, the simfile database is not. However, Alan and I brainstormed solutions on how to reduce the current size of this section (473 GB currently). Most of the size is due to duplication, as almost all simfiles are individually zipped, with categories having their own large pack zips. I brought up the idea of having a temporary zip application, which would create zip files upon request. This would only apply to individual simfiles, as temporary pack zips would bog down the website. If temp zips are applied, this would dramatically reduce the size of the simfile database, and would allow room for routine backups. Please do note that this may or may not actually take shape, as it's simply an idea for now.

Please bear with us; there's lots of cleanup in the back end to be done. 🙏

---