Open for Business Back Online, Hack Explained

On April 1, 2004, a single, carefully crafted URL was sent to OfB.biz, returning a set of encrypted strings. The same request was reissued in the midst of thousands of normal requests on April 2 and 7. The requests came from Tehran, Cairo and Sarajevo. Then there was a week of silence. Late on April 13, however, another string of requests came, this time from various ISP's in Tel Aviv.

The strings taken from the previous week were encrypted together to form the administrative access cookie for PHP-Nuke. After forming the cookie, the new requests were used to insert multiple superuser users providing complete access to all of PHP-Nuke's functionality. The accounts were systematically added from different IP addresses over a period of several hours going well into April 14. After creating these superuser accounts and moving the original superuser account to a semi-removable status, the perpetrator then entered the block administrator and placed obfuscated JavaScript code hidden near the JavaScript code for the advertising banners.

The JavaScript code reported back information concerning visitor hits using a unique ID and then forwarded users to a pornographic web site before they knew anything had happened. The attack was complete. The attacker then moved onto other sites, defacing PCLinuxOnline on the same day and Linux and Main on April 15.

Three days later, I have hand checked the nearly 300 articles on Open for Business, cleaned out the JavaScript and successfully brought OfB back online with a number of security patches. However, with this being the second time that the poor design of PHP-Nuke has allowed the site to be attacked, my days using PHP-Nuke are numbered. Assuming that SAFARI eventually is finished (I've been talking about that for how many years now?), I will be moving over to that and escaping this security mess forever.