Greenguy's Board - OpenX was hacked on my server yesterday but all is well now.

Greenguy's Board (http://www.greenguysboard.com/board/index.php)

- General Business Knowledge (http://www.greenguysboard.com/board/forumdisplay.php?f=10)

- - OpenX was hacked on my server yesterday but all is well now. (http://www.greenguysboard.com/board/showthread.php?t=58917)

Cleo	2010-09-12 07:28 AM

OpenX was hacked on my server yesterday but all is well now.

Woke up yesterday to find Google malware notices on my TGP.

Big thanks to my host Colo-Cation and cd34 aka Sparky for quickly helping in finding and removing the malware from my banners.

OpenX was hacked and malware code as appended to my banners.

OpenX has been upgraded to the latest version so hopefully this won't happen again.

Naturally all this had to happened on one of the few days that I was away from the computer spending the day on an island.

Thanks for everyone that sent me a heads up on this.

All should be well now.

LeRoy

2010-09-12 10:59 AM

Seems like Open X is a big target for hackers.

We've had a few issues with Open X also. Too scared to use it again.

Glad to see everything is ok

Cleo	2010-09-12 01:35 PM

It's a fucking mess. :(

Google now has this in my Webmaster's Tools admin.
"A review for this site has finished. The site was found clean. The badware warnings from web search are being removed. Please note that it can take some time for this change to propagate."

The database that browsers use to check if a site has malware needs to propagate and it may take a few days to propagate. Unfortunately the database that says I do have malware is still propagating out and then right behind that one will be the database that says I don't have malware. All this may take a few days. :(

I'm having to use Firefox with "Block reported attack sites" unchecked in order to surf my own stuff. :(

bDok	2010-09-12 01:45 PM

That sucks. I need to go and check my OpenX and upgrade I guess ASAP. It's only being used on my newest of blog networks. :/

pc	2010-09-12 02:14 PM

Monitor your domains to see if they have been put on Google's SafeBrowser Blacklist or Malware list

|thumb|thumb

cd34	2010-09-12 03:12 PM

While safewatch was/is a good concept, due to a few limiting factors of the way google publishes data, the root domain in cleo's case was not tagged, only the /tgp/ directory.

It is still a good indicator since 99% of the malware will be present on all pages.

Cleo	2010-09-12 05:54 PM

1 Attachment(s)

For Safari users I figured out how to turn off the warning so that I can at least surf my own stuff until my domain is removed from the malware database.

http://www.greenguysboard.com/board/...1&d=1284328396

RedCherry

2010-09-12 09:03 PM

Just told Cleo in a PM, I just spent hours updating my OpenX. I was on version 2.0.11 and the latest is 2.8. OMG, I had stats for 5 years of banner data, I finally had to dump the log files, the script kept giving me this oh so helpful error:

#! UPGRADE FAILED: tables_core_544
#! omg it all went PEAR shaped! _doQuery: [Error message: Could not execute statement]
[Native message: MySQL server has gone away]

well sorry to hear it gained weight. before that, it had this one file it wanted you to have, but half way through the install, it tried to write to that, it was there, and bombed out. |banghead|

I'm just glad I got it updated, I went through a hack about a month ago from a banner downloading a trojan, last thing I want is someone hacking OpenX.

Cleo	2010-09-12 11:20 PM

Looks like my site has been cleared in Safari, Firefox and Crome.

Maybe I can actually get some sleep now.

Cleo	2010-09-13 12:18 AM

Sparky gave a good tip.

I chmod 700 OpenX's admin directory so that no one can access it. If I need to add a banner or something it no big deal to temporally change while I need to access it and then change it back after.

At this point I don't really trust OpenX anymore.

terry

2010-09-13 08:50 AM

UGH! I havent cheked my OpenX in a very long time. I guess its time. Thanks for sharing.

RedCherry

2010-09-13 09:55 AM

Quote:

Originally Posted by Cleo (Post 490372)

Thanks for the tip, I just did that. |thumb

My old version has been hack free for years, knock wood. I don't know if I'd of upgraded it after seeing all the people with recent versions getting hacked in the community forums.

LD	2010-09-13 10:51 AM

I can't chmod my admin directory...it keeps changing back to 755. Anyone know why? I'm working with the one in the www folder.

MeatPounder

2010-09-13 03:43 PM

A lot of mainstream sites that are using openx have been hacked lately

Cleo	2010-09-13 03:59 PM

Quote:

Originally Posted by LD (Post 490398)

I can't chmod my admin directory...it keeps changing back to 755. Anyone know why? I'm working with the one in the www folder.

Actually I was thinking that we could htaccess the admin directory and make it require a password.

bDok	2010-09-14 04:05 AM

ok i see i'm at 2.8.3 and 2.8.6 is out. This will be happening tomorrow.

Cleo	2010-09-14 07:06 AM

Last night I password protected my admin directory using htaccess.

LD	2010-09-14 09:25 AM

Quote:

Originally Posted by Cleo (Post 490441)

Last night I password protected my admin directory using htaccess.

Do have the code for that?

My OpenX is not working at all right now. I have an trouble ticket in to see what's going on.

Cleo	2010-09-14 09:36 AM

Quote:

Originally Posted by LD (Post 490456)

Do have the code for that?

To password protect a directory.

First go here and encrypt a userID/password.
http://www.e2.u-net.com/htaccess/make.htm

In a directory someplace on your server create a file named.

Code:

.htpasswd

Copy and paste your encrypted userID/password into this file

Now in the directory that you want to protect create a file named

Code:

.htaccess

Place this text in the file changing the path to your actually path.

Code:

AuthUserFile /path/to/your/password/file/.htpasswd



AuthGroupFile /dev/null

AuthName "Whatever You Want The Password Dialog To Be Called"

AuthType Basic



order allow,deny

allow from all

require valid-user

Enjoy your much safer admin.

LD	2010-09-14 10:30 AM

Excellent, thanks Cleo!

cd34	2010-09-14 08:59 PM

Appears if you are using anything but the javascript delivery, the admin directory cannot be protected.

LD, in the control panel, you can automatically generate .htaccess/.htpasswd files.

Cleo	2010-09-14 09:12 PM

Quote:

Originally Posted by cd34 (Post 490485)

Appears if you are using anything but the javascript delivery, the admin directory cannot be protected.

LD, in the control panel, you can automatically generate .htaccess/.htpasswd files.

I only use JavaScript delivery so I haven't noticed any issues. What happens with other deliveries? I'm guessing the ads don't show?

Does it work if you chmod 700 the admin directory?

Never noticed the htaccess thing in our control panel but I also never looked for it.

cd34	2010-09-14 09:24 PM

I believe the iframe and php includes try to include a file from the admin directory for some display function. It does indeed break when the admin directory is set to chmod 700.

Javascript delivery appears to have been written after the fact and doesn't use those includes and works when the admin directory is chmod 700.

LD	2010-09-14 09:44 PM

I'm all protected now, thanks guys.

Cleo	2010-09-14 10:49 PM

I liked this program a whole lot more back when it was PhpAdsNew. The admin was way less confusing and it did everything that I needed it to do and was simple to use.

It seems like it has turned into bloatware with all kinds of features that are only needed by a few.

dunc	2010-09-14 11:24 PM

What alternatives are there?

I've looked around and haven't found much at all

Mr Spock

2010-09-15 12:49 AM

What version option were you using the hosted or self hosted application?
What would be the safer option ?

LD	2010-09-15 07:04 AM

Quote:

Originally Posted by dunc (Post 490491)

What alternatives are there?

I've looked around and haven't found much at all

AdPeeps is pretty good.

Cleo	2010-09-15 07:59 AM

Quote:

Originally Posted by Mr Spock (Post 490493)

What version option were you using the hosted or self hosted application?

Self hosted and I think the version that got hacked was 2.8.4 .

dunc	2010-09-15 08:01 AM

Quote:

Originally Posted by LD (Post 490501)

AdPeeps is pretty good.

That's really interesting, because a good friend told me about this about 3 years ago, and then another recommended it a couple of weeks ago - and now you :)

Sending them questions now :)

Thanks LD

bDok	2010-09-15 12:57 PM

Quote:

Originally Posted by Cleo (Post 490490)

I wonder how much easier PhpAdsNew was? Now that I'm starting to dial in OpenX it seems to just make sense. I haven't setup target stuff based on what's in the URL. Which I need to do for setting up content delivery to my link lists. However, as of right now the way I'm using it I'm pretty happy with how things are running.

Being able to split test banners and see which one gets better click thru is just awesome. Or during promotions I can just cram a spot with a certain sponsor is really nice too. |thumb

I will say though it's been kinda of a bitch to wrap my head around and there is still a ton of stuff I bet it can do that I have no clue about.

cd34	2010-09-16 03:25 PM

OpenX Security Update
Security is an important priority at OpenX and we're constantly working to provide security patches and bug fixes as soon as we become aware of any potential issue. As these issues are discovered, we validate, patch and release as quickly as we can. But it's important to understand that avoiding potential security issues also requires server administrators to be vigilant and upgrade their systems to new, patched versions as soon as they become available.
It has been brought to our attention that there is a vulnerability in the 2.8 downloadable version of OpenX that can result in a server running the downloaded version of OpenX being compromised. We have already closed this vulnerability with the latest version of our software. To avoid this issue, we recommend that all users immediately upgrade their systems to 2.8.7.

http://blog.openx.org/09/security-update/

All times are GMT -4. The time now is 06:35 AM.