dick miles website hijacked - now safe

Subject: dick miles website hijacked
From: The Sandman
Date: 07 Aug 09 - 05:14 AM

do not visit my website,it has been hijacked.
I am sorting it out.Dick Miles

Subject: RE: dick miles website hijacked
From: Ptarmigan
Date: 07 Aug 09 - 06:00 AM

Yuck! that's very unpleasant.

Good Luck

..... Oh, & if you catch the Pirate, Captain Birdseye, make him WALK THE PLANK! :-)

Subject: RE: dick miles website hijacked
From: Captain Pugwash
Date: 07 Aug 09 - 02:32 PM

" ..... Oh, & if you catch the Pirate, Captain Birdseye, make him WALK THE PLANK! :-)"

It wasn't me! :-(

Subject: RE: dick miles website hijacked
From: open mike
Date: 07 Aug 09 - 03:01 PM

could there be any connection here
with the facebook hi-jinx that have
been plaguing some mudcatters?

Subject: RE: dick miles website hijacked
From: The Sandman
Date: 07 Aug 09 - 03:44 PM

I am 99 percent sure it is not connected.
there have been several unsuccessful attempts over the last two years to hack into my website.
I would say it is a coincidence.

Subject: RE: dick miles website hijacked
From: The Sandman
Date: 09 Aug 09 - 04:26 AM

www.ballydehob.ie,was attacked and hackedin to on the same day.
this suggests that the attack was not personally aimed at me.

Subject: RE: dick miles website hijacked
From: SPB-Cooperator
Date: 09 Aug 09 - 03:49 PM

Hi Dick, are you sorted? Maybe the non-cognisenti are after free fishfingers.

Steve

Subject: RE: dick miles website hijacked
From: SPB-Cooperator
Date: 09 Aug 09 - 03:51 PM

or even cognosenti

Subject: RE: dick miles website hijacked
From: Paul Burke
Date: 09 Aug 09 - 04:24 PM

Try "cognoscenti" or a spellchecker...


Condolences, Dick. Who could hate Ballydehob?

Subject: RE: dick miles website hijacked
From: treewind
Date: 10 Aug 09 - 03:23 AM

How did they get in?
(as guardian of a number of web sites, I am naturally concerned...)

Anahata

Subject: RE: dick miles website hijacked
From: Richard Bridge
Date: 10 Aug 09 - 03:24 AM

And I suggest, Capting, that you don't put the answer to that up here, but PM it to Treewind.

Subject: RE: dick miles website hijacked
From: treewind
Date: 10 Aug 09 - 03:48 AM

I was hoping for a fairly generic type of answer along the lines of keylogging/guessing the password/sniffing an unencrypted upload connection/SQL injection, rather than details of a specific vulnerability on Dick's web hosts!

Anahata

Subject: Dick Miles website now safe
From: The Sandman
Date: 14 Aug 09 - 06:31 AM

my website is now back up and running

Subject: RE: dick miles website hijacked
From: The Sandman
Date: 14 Aug 09 - 06:44 AM

the site has now been cleared,and has extra defences against hackers.http://www.dickmiles.com

Subject: RE: dick miles website hijacked
From: Leadfingers
Date: 14 Aug 09 - 08:00 AM

Good to see you have the site back Dick

Subject: RE: Dick Miles website now safe
From: The Sandman
Date: 21 Aug 09 - 02:12 PM

Over the past few months, lots of legitimate websites are being
attacked and hijacked by a relatively new kit being used in "drive-by"
downloads to infect visitors (victims) with malware. The kit is known
as LuckySploit.

LuckySploit (and similar ones) enables "attackers" to construct
malicious websites from a totally legitimate website, in order to hit
victims with exploits. Resulting in malicious software being
downloaded and installed without user consent.

Thankfully, such compromised web sites are been often and early
detected, reported and blocked by the "Safe Browsing" initiative
(Google, Yahoo & Microsoft) and that is exactly what happened to my
site.

How attackers got access to my sites internals is not quit clear. Two
main scenarios are possible. 1. Malicious software (Spyware, Viruses
etc.) could have been on the site administrators computer, spying on
access details (login names and passwords) or 2. the server it self
could have been compromised. My site administrator scanned all
computers in questions with 8 different malware detection tools
(Sysinternals RootKit Revealer, Sophos Anti-Rootkit, AVAST Boot-Time
Scan, BitDefender, F-Rescue, Malwarebytes, Spybots Search & Destroy
and Kaspersy Anti Virus), lasting over 18 hours in total, with no
conclusive result. After that and deleting all content, on the server,
and uploading the site from a clean backup, the attack quickly
reactivated, what let him to change and upgrade web space and server
software. What finally seems to have done the trick and my site is
reviewed, cleared and accessible again."

Subject: RE: dick miles website hijacked - now safe
From: The Sandman
Date: 24 Aug 09 - 06:07 AM

refrsh