Peter Lemkin Wrote:Thanks for that detailed forensic analysis Peter. Any idea who 'done it'? [Did they leave any clues? hints?] As I remember their hack trophy page said something like Moroccan Liberation Front...or along those lines. Were there other vBulletin victims by the same group or person or entity?

Best not to go into too much detail publicly.

The original exploit was by a Moroccan IP address and the trophy page was ostensibly in support of the Palestinian cause, which is sad considering the robust support for that cause here. However I think it unlikely that DPF was targeted for any reason other than that a vulnerability was discovered by people who search for such things globally and systematically. You will find several thousand similar hacks listed by various sites with a suitable Google search. Its also possible that the access credentials were then passed on (for a consideration or whatever - maybe even automatically through the trophy page) because a US IP address was also heavily involved after the initial hack.

We do know quite a bit more but best to stay mum while continuing to dig.

Peter Lemkin Wrote:Once when I tried to change my email, I was told my email was 'banned'. I haven't tried again...yet. Thanks greatly for the hard work you did!!! Bravo!

It IS possible they began interfering with high volume user accounts. If so, any such changes that were recognized as legitimate by the vB software (ie regular Administrator actions) and done before both the backup we used to restore the site and implementation of the htaccess block would remain in the database. I think it highly unlikely that any such possible changes contain viruses or other nasties though - but you can NEVER be 100% about these things. The entire database was been checked using vB tools and was reported clean.

That's why it would be good to hear of any other such anomalies.