folkinfo down

Subject: folkinfo down
From: GUEST,Jon
Date: 29 Sep 10 - 04:17 AM

Firstly, we were down approx 6pm Sun 26th Sept 2010 to 10am Mon 27th due to a problem with our broadband supplier. Sorry about that.

The problem that happened around 3pm Tue 28th and is keeping as down for the time being is not related to the above. The site was successfully hacked.

All I can say at the moment is that it wasn't a passing shot but a sustained sql injection attack lasting a few hours and using automated tools. I have not yet managed to work out which out of the many queries got through and worked for the hacker.

I could for example wind back a day using a backup, change key (admin) passwords and restart but I fear this would be pointless and we would just get hit again shortly after reopening.

For this reason, I am keeping the site off line while I go through log files and code and try to work out what else I can do to try to prevent this sort of thing happening. I'm likely to be reinstalling the server with the latest versions (I'm on a version of OpenSuse near end of life atm) of everything.

As things stand, I'd suggest we could be down for as long as a week. I'll try to keep others informed as and when.

I'm sorry for this,

Jon

Subject: RE: folkinfo down
From: GUEST,Jon
Date: 29 Sep 10 - 07:07 AM

I've worked out where I'm going now! I had a planned update of a new PC, Linux distribution and revision of my code already set for the end of this year. I'll bring all except the PC (which I can't afford [well I can but I'm going to be selfish and get some music equipment I want first] just yet) forward.

It's a bit annoying that there will now be 2 (hopefully the Dec targeted one only short) disruptions to service but for once, I intend putting myself first.

Subject: RE: folkinfo down
From: GUEST,Jon
Date: 01 Oct 10 - 05:40 PM

Just noting that while I may catch up, I'm way behind schedule at the moment. It has taken me until now to restore a database to the test server!

I have taken regular backups and restoring to the day before the hacking was supposed to be a 2 minute job... The database tables are in latin1 and I wanted to stay that way for reasons of compatibility with abc programs (otherwise I'd rather be in utf-8) but restoring my backup on this test system output utf-8.

I searched and found suggestions I should have added some parameter to mysqldump to set latin1. As I couldn't go back in time, the problem seemed to be to convert my utf-8 dump file to latin1. Loads of searches, mostly people wanting to convert the other way and eventually I find reference to unix utilities recode and iconv.

I try these and hand editing one line in the dump file that said utf-8 to latin1 and still no joy. More searching and still no joy - utf-8 comes out.

Eventually, I write my own (based on a source file for recode) converter and work on just one small database with just one small post containing some "foreign" characters. Eventually, with a hex editor I could confirm conversions were correct and that it didn't matter what the dump file encoding was - utf-8 came out.

At last it became clear that some other conversion was taking place and with that knowledge, I was able to make new searches. I then find that the mysql server does perform its own conversions to cater for the requirements of clients and these are controlled by server variables (the old web server was set up by default to use latin1 btw - there must have been a change in defaults with different releases of mysql in opensuse distributions that I'd never had need to know about before) for various parts, eg. client and connection and that the ones I needed to change could all be set for a client/connection using just one $sql statement.

The bottom line is that it took, what, 3 days of false leads from google searches, confusion and tearing my hair out on my part, etc. to find that the problem was resolved quite simply on the test server (I'll probably set the new web server just to use latin1 by default) by adding this line to my php script that handles database connections, queries, etc.

mysql_query = "set names latin1";

Easy WHEN you know how...

Subject: RE: folkinfo down
From: GUEST,migginz at work
Date: 12 Oct 10 - 06:47 AM

I can't understand why a hacker would choose to wreak a site such as this; a resource available to all. Its one of my first ports of call when looking for songs so I eagerly await its recreation. Sounds like its quite a task though. Many thanks for your efforts; they are appreciated

Subject: RE: folkinfo down
From: johnadams
Date: 12 Oct 10 - 07:16 AM

Sentiments echoed. We publicised the site at our Village Music Project workshop at Lewes last weekend, noting that it was down but hoping that it would be up again soon.

Thanks for all the hard work.

JA

Subject: Folkinfo?
From: RTim
Date: 29 Oct 10 - 04:11 PM

Is there any news about the restoration of the Folkinfo website?
It has been some time since the hacking problem, are there more problems?

Tim Radford

Subject: RE: folkinfo down
From: Joe Offer
Date: 29 Oct 10 - 04:22 PM

I noticed there are now links to folkinfo on the Roud Folk Song Index - very nice. I hope you get things up and running soon, Jon.

-Joe-

Subject: RE: folkinfo down
From: RTim
Date: 29 Oct 10 - 04:25 PM

That was really the reason for my question Joe.
I keep forgeting that Folkinfo is down, and when I enquire on both Roud and DT, I keep getting the message!

Best - Tim

Subject: RE: folkinfo down
From: Sandra in Sydney
Date: 30 Oct 10 - 02:36 AM

well, Jon has been posting a fair bit in the past month, so he'll probably be along again here soon when he notices this thread is back!

gidday, Jon

sandra

Subject: RE: folkinfo down
From: GUEST,Jon
Date: 30 Oct 10 - 02:49 AM

Sorry. Jon (me) is quite ill atm and is reluctantly unable to put things back. (first thought of touching it would involve have a drink or 10 to get through)

I really wish I could, know the converter is missed, etc. but my own head is not even keeping me going.

All I can do is give one big sorry and trust that those who do use the site accept that I personally regret letting them down .

Jon

Subject: RE: folkinfo down
From: GUEST,Jon
Date: 30 Oct 10 - 02:57 AM

And hope they believe I will get back if I can

Subject: RE: folkinfo down
From: GUEST,Jon
Date: 30 Oct 10 - 03:08 AM

Not sure it's in this thread so for the record and sorry if it is a repeat. I'd only been out of hospital for an alcohol detox a few weeks when this (and a few other things) happened.

Subject: RE: folkinfo down
From: John MacKenzie
Date: 30 Oct 10 - 05:48 AM

Look after yourself first Jon, that's more important.

Subject: RE: folkinfo down
From: migginz
Date: 30 Oct 10 - 05:55 AM

don't feel you are letting us down, you've been letting us up for a long time.

Subject: RE: folkinfo down
From: Sandra in Sydney
Date: 30 Oct 10 - 08:35 AM

seconding what John & migginz said

sandra