The war is over! Many battles have been fought.
The enemy: Possibly Popcap games rooted in the arcade.
As many of you know we were attacked at the very core of the forum at approximately Thursday 9 am PST. The battle quickly spread from the arcade into the forum, and into the main website. Every page that had code was quickly and deliberately infected. Here's a quick log from the attack:
Thu Sep 1 16:07:13 2011 1 83.133.120.46 325 /./public_html/index.html a _ o r waylandprod ftp 0 * c
The IP was traced back to Germany. Any more information is yet to be seen. Damage was being done through FTP and quickly it spread. We caught it early, but every page on the forum and the database were infected. With the help of J0be, we set about deleting everything from the server that could contain code, and then copying things back over again. We ran into a massive error when trying to remove the infected files from the server, but a quick skirmish in SSH sent those files burning away.
So, thanks to many different backups and a daily midnight database dump, we are back.
If there are remnants of battle, or things that don't work. Please let us know and we'll do what we can to clean it up. BIG Thanks to j0be for helping root through the many problems and helping the tower to re-open its doors.
LAST NOTE! If you were here when it went down, run a virus scan to be sure you're safe. Microsoft Security Essentials works great and is free. Check %appdata%/Microsoft/ - And make sure you don't see anything weird created today as a 2nd safe measure.
Bookmarks