Prosper202 Security Hole, DL new version

[Jon]

I doubt he has much money but would be worth it gain or not

Well when this stuff first started I would have said, no he doesn't have much cash probably.. But after finding hundreds of domains across what seems like hundreds of seperate dedicated servers all over the fucking place, I would imagine he's got a lot of cash just to sustain this kind of operation. Plus figure advertising costs of at least 200 simultaneous affiliate campaigns (the ones we've found) at any given time. Yeah, I think its fair to say this guy has a lot more money than we originally gave him credit for.

 

[RBseatown]

^^ Wow that sounds ridiculous.

Kind of funny how quickly he got caught, but in the big scheme im sure he made a lot of money. From the sounds of it maybe he had multiple people helping him accomplish that. Sounds like an awful lot of work for one person for half of a month. But then again if it's automated it might be pretty quick to get a website up and a campaign running.

Cant wait to see him get whats coming.

 

[analytics]

after hearing about this in the chat room, i still wonder how he spotted so many tracker domains, did he gather the list one by one? so lame.
i mean i tried to read the code as much as i can and thre's no callback fucntion or anything.

also why dont u guys have some basic htaccess protection to your servers?
:nopenope:
get a static ip from your isp (or use your dedicated box as proxy with a dedicated ip) and restrict access into login folder only from that one, ofcourse i dont need to tell ya to use that ip only for business purposes.
call me paranoid android, i have a spare old notebook i'm using solely for banking and account management , no wf even google surfing.
zero tolerance.
i hope not so much damage has been involved .

 

[ricdes]

after hearing about this in the chat room, i still wonder how he spotted so many tracker domains, did he gather the list one by one? so lame.
i mean i tried to read the code as much as i can and thre's no callback fucntion or anything.

also why dont u guys have some basic htaccess protection to your servers?
:nopenope:
get a static ip from your isp (or use your dedicated box as proxy with a dedicated ip) and restrict access into login folder only from that one, ofcourse i dont need to tell ya to use that ip only for business purposes.
call me paranoid android, i have a spare old notebook i'm using solely for banking and account management , no wf even google surfing.
zero tolerance.
i hope not so much damage has been involved .

ive been trying to avoid this since i like to check out my stats on the mobile phone while on travel. Altho i will have to stop doing this due to restrictions that I'm going to install on my p202 domain.

 

[WesMahler]

Hey everyone, thanks for all the help from everybody pitching in and solving this issue together. We were working late last night trying to figure out what the vulnerability was. We finally figured out what it was. Thanks to Val at Paradigm Vision for first notifying us, everyone then on the #cakes channel, of course mike, jon and everyone else who've helped us figure out what happened.

It's my fault that this vulnerability happened and I apologize for any harm that it has caused. I'm not quite sure how it slipped my mind to escape one of the queries that was coming in which lead to a mysql injection vulnerability. I know how to prevent theses issues when coding, but some how my system to check whether I had prevented the injection failed, and my error in judgement shows. I've tried hard to make the application secure and it is extremely unfortunate to constantly see people trying to break into the application, not only comprising our work but everyone else who uses the application.

Although in the midst of all of the mess, there is a little bit of good that was shown. Some of the peoples' installations were unable to be hacked into. It appears that without being able to access the 202-login.php file, which essential is the only file that can login a user, was not present, or the hackers couldn't get in with, they were not able to login to the application. This means people who put extra effort to secure their 202-login.php file were not suspectible to getting comprised. And that not everyone was comprised.

A simple quick fix for everyone is you can simply move your 202-login.php file somewhere else, or name it completely random, so that no one will find it. This is the only file that can log you in, so if it is not accessible, people won't be able to login. So you can move the file into another folder, or rename the file completly. It doesn't need to be in the root directory, it can be placed elsewhere, where-ever you want to move the login file, you can do that. And the only way to login will be accessing this file.

Sorry about that everyone, thanks for notifying us, and we'll keep you guys on what happens next.

 

[WesMahler]

after hearing about this in the chat room, i still wonder how he spotted so many tracker domains, did he gather the list one by one?

Although I probably should not say exactly how for security reasons, it is possible using some search engines like google to help do this.

Mar 16, 09 at 6:49am viarga 189.56.150.110 :: ARIN / RIPE Failed
Mar 16, 09 at 6:49am viarga 203.160.1.71 :: ARIN / RIPE Failed
Mar 15, 09 at 2:23pm viagra 203.160.1.71 :: ARIN / RIPE Failed
Mar 15, 09 at 2:23pm cial1s 203.160.1.71 :: ARIN / RIPE Failed

Theses appear to be fake attacks, to probably cover up the actual attack is what we are thinking. As theses attacks were pointless and he knew they would not work.

Should we change DB Username and Password?
Should we change prosper Password?
Did he run any suspicious software on our servers?

If you want to go all out,

You could change the ftp user/pass, mysql user/pass, prosper202 user/pass (by editing the phpmyadmin to change the user_username, in the 202_users TABLE), and of course the password in the profile area of t202.

And then Wiping out the domain and installing a fresh set of clean files if you wanted to go crazy with it, probably not all completly necessary but it couldn't hurt. The biggest thing is really getting raid of that 202-login.php file and moving it somewhere else

 

[AlexJames]

I'm guessing the Cialis and Viagra failed attempts are just random spam bots - the same kind of bots that spam un-captcha'd message boards and email forms; not our hacker buddy.

 

[amateursurgeon]

Congrats on such a speedy response to this, Wes.

Although you're likely to keep getting SQL injection problems etc in the code from time to time as it stands, unless some of the user community want to volunteer for code review duties

Just a thought... in terms of security architecture, would it not make sense to have the tracking part of P202 using separate database credentials/directory structure to the login/admin part? (can't remember if it already does the latter)

You could then lock down all admin pages so that they are only accessible via a certain IP, and make sure that the tracker database user only had enough permissions to update the stats table or whatever.

That way, if anyone finds another hole in the tracker, the worst they can do is fill the database with crap clicks.

 

[AdHustler]

Threads like this are why I love wickedfire.

 

[whatyaknow]

It's inevitable it was only a matter of time before there was a bug found in the script. It has however encouraged me to use better security practices when handling the login page. Thanks Wes for your contribution to the community.

 

[profitaddiction]

So changing 202-login.php to "imtoosexy.php" would be the first and easiest step to prevent (potentially) this?

Then to login it would be www.prosperhosted.com/imtoosexy.php ?

Thx

 

[heavyt]

Can someone please contact me I think I'm on that list and want to confirm.

 

[Metcalfe]

I'm guessing the Cialis and Viagra failed attempts are just random spam bots - the same kind of bots that spam un-captcha'd message boards and email forms; not our hacker buddy.

Hmmm think about that for a second. If you had a bot checking for the login page as described then you could see which pages returned a 404 and which pages returned login failed. And thus determine which domains have a prosper202 install.


On a side note my coding practice is to have all sql calls in my php projects run through a central method, which does it's own sql injection attack protection. It has the benefit of protecting your site and it makes your code more resuable, I would suggest that for something as important as prosper202 that it would be a good idea to implement.

You can then begin to customise it aswell, sending you an email with the IP address of the attacker and the details of the attempted attack.

 

[ricdes]

I'm guessing the Cialis and Viagra failed attempts are just random spam bots - the same kind of bots that spam un-captcha'd message boards and email forms; not our hacker buddy.

Hmmm think about that for a second. If you had a bot checking for the login page as described then you could see which pages returned a 404 and which pages returned login failed. And thus determine which domains have a prosper202 install.

yep, I've noticed those cialis and viagra logins as well. Probably like metcalfe said just his own way to check if you really have your prosper 202 installed.

 

[ricdes]

on a side note: I'd suggest that in about a week we create a list of affiliate networks that haven't banned that mofo yet.

 

[andyt]

Hmmm think about that for a second. If you had a bot checking for the login page as described then you could see which pages returned a 404 and which pages returned login failed. And thus determine which domains have a prosper202 install.


On a side note my coding practice is to have all sql calls in my php projects run through a central method, which does it's own sql injection attack protection. It has the benefit of protecting your site and it makes your code more resuable, I would suggest that for something as important as prosper202 that it would be a good idea to implement.

You can then begin to customise it aswell, sending you an email with the IP address of the attacker and the details of the attempted attack.

I think if you're using adodb it does the same thing as long as you don't use variables directly in the sql calls and use parameters instead. I'm actually not sure if I should be doing something else in my own projects, if anyone is familar with adodb and this sql attack is that enough?

 

[Unarmed Gunman]

on a side note: I'd suggest that in about a week we create a list of affiliate networks that haven't banned that mofo yet.

Seconded. Put them on the WickedFire blacklist.

 

[kimboslice]

Well when this stuff first started I would have said, no he doesn't have much cash probably.. But after finding hundreds of domains across what seems like hundreds of seperate dedicated servers all over the fucking place, I would imagine he's got a lot of cash just to sustain this kind of operation. Plus figure advertising costs of at least 200 simultaneous affiliate campaigns (the ones we've found) at any given time. Yeah, I think its fair to say this guy has a lot more money than we originally gave him credit for.

Wow. This cat has balls.

 

[WTF]

Here are some more of his domains....


0ii0.com
33rpm.com
40oz.com
4truck.com
abort2k.com
acura-trader.com
acuratrader.com
adult-dating-sites.org
adult-dating-uk.com
anonymous-web-proxy.com
anonymous-web-surfing.org
applogic.com
auto-wheels.org
backpros.com
backround-checks.com
bad-credit-car-loan.net
bad-credit-personal-loan.net
bad-credit-refinance.org
badceditcarloans.com
badcreditanswer.com
badcreidtcarloan.com
bakersfield-apartments.com
bankruptcy-help.org
blood-pressure-monitor.org
bmw-trader.com
bmw-trader.net
bmwtrader.net
bodyfatcalc.com
bridal-shower-invitations.org
business-line-of-credit.org
buy-ringtones.org
buydiscountproducts.com
buyingbusinesses.com
calculator-online.org
calculators.me
calorie-shifting-diet.com
carloans.net
chargecreditcard.com
cheap-airline-flights.org
checkmyip.us
chiapartments.com
chicagorenter.com
chirenter.com
chirenter.net
chrisbrownlyrics.org
color-wheel.org
compare-mortgage-lenders.org
connectdot.com
consolidate-payday-loans.com
consolidatemoney.com
coool-ringtones.com
copydefense.com
copyrightmonitor.net
country-ringtones.org
couponcodefinder.com
credit-card-debt.us
creditbarn.com
creditbb.com
creditbbs.com
creditcardapplications.us
creditcardcenter.us
creditcardcentral.net
creditcardcentral.us
creditcardslive.com
creditdebt.biz
creditfixedquick.com
creditmodeling.com
creditprovide.com
creditzen.com
custom-auto-wheels.com
custom-car-wheels.com
d2forum.com
dateflipper.com
dating-matchmaking.com
debt-consolidation-program.org
debtmanagement.me
dentalinsurance.me
diet-survival.com
djtraxx.com
dog-food-comparison.com
dotcredit.com
driveloan.com
dubnoir.com
easy-financing.org
ecommerce-hosting.org
enuze.com
expertcoder.com
f15.com
fast-weight-loss-diet.org
fastcashloans.info
fastpadayloan.com
fastpadayloans.com
federal-debt-relief.com
federal-inmate-search.com
federal-jobs.net
find-personal-loans.com
fortworth-apartments.com
forumdir.biz
forumdir.com
forumdir.info
forumdir.net
forumdir.org
free-adult-games.org
free-backround-checks.com
free-inmate-search.com
free-virus-protection.net
free-virus-scan.org
freepublicityforum.com
freetenantleaseform.org
freewebmatch.com
get-paid-to-shop.org
getringtones.me
golferwear.com
government-grant-programs.org
government-student-loans.com
guidancerecordings.com
guidancerecords.com
hard-money-loans.org
hifidelitylounge.com
home-eq-mortgage.com
home-lenders.org
home-refi.org
honda-trader.com
honda-trader.net
hookedonchronics.com
hostd.com
hostingradar.com
iloancalculator.com
imageark.net
imonitor.com
infiniti-trader.com
infiniti-trader.net
invesio.com
invesio.org
investorbasics.com
iprotect.org
irenter.net
irenter.org
jeep-trader.com
jeep-trader.net
larenter.com
las-vegas-coupons.org
level88.com
lexus-trader.com
lexus-trader.net
linkroll.com
loanexpertusa.com
loanplaces.com
loantopayday.com
longbeach-apartments.com
lovetobias.com
low-income-loans.com
lynucs.com
lyricsonline.info
mac-tutorials.com
madjoker.com
maidentrip.com
math-calculator.org
matrixmania.com
mattbinns.com
maxrefunds.com
mercedes-trader.com
mercedes-trader.net
miamirenter.com
mobilefun.me
mobileringtones.me
modelexpose.com
modelvue.com
momdepot.com
money-grants.org
mortage-calculator.org
mortgage-broker-directory.com
mortgage-refi.org
mortgagecalculators.me
mortgageratespro.com
motorcycle-financing.org
motorcycle-tires.org
motorcycleforum.com
mystery-shopper-jobs.com
mysteryshopper.me
nissan-trader.com
nissan-trader.net
no-credit-loans.org
nuspirithelsinki.com
nycrenter.com
oio.me
online-auto-auctions.org
online-auto-insurance.com
onlinecardoffers.com
onlineloans.me
palmbeachdentist.net
payday-loan-illinois.com
personaleloans.com
pets-for-adoption.com
photera.com
photera.net
photera.org
photera.us
police-car-auctions.org
poor-credit-financing.com
poor-credit-student-loans.com
porsche-trader.com
porsche-trader.net
prepaid-visa-travel-card.net
private-air-travel.com
projectionsmusic.com
pyro.me
refi-rates.org
refinanceloans.us
renovationfinancing.org
rentalvaninsurance.com
renter-credit-check.com
santaana-apartments.com
satellite-internet-providers.org
satellite-radio-services.com
satellite.info
seattle-dentist.org
secretshopperjobs.org
serverdir.com
serverlocator.com
serverlocator.net
sexiestweb.com
solar-energy-systems.org
st-john-villa-rentals.com
stary.me
state-grants.org
stpaul-apartments.com
structuredsettlement.biz
student-grants.org
tenant-credit-checks.com
tenant-verification.com
thematrixmania.com
thepaydayloan.com
thetroublemakers.net
tire-reviews.org
top-business-schools.org
tylove.com
used-car-auctions.org
wheelsworld.com
wholesalecenter.us
windows-tutorials.com
xcom.com
zeeg.com

 

[WTF]

*Edit - Some of the above domains have now expired. But he did own them at some point in time.