What happened to the site?

[Stonehenge]

I see this 'hacked by illegal team' message and now it's spiritplants.org instead of yage net. What on earth is going on?

[domino]

I got the same e-mail.  Kinda looks like someone hacked in and got our addresses?

[Mok]

X-Apparently-To:    *CENSORED*@yahoo.com via 216.109.116.125; Mon, 21 Mar 2005 13:14:46 -0800
Authentication-Results:   mta116.mail.sc5.yahoo.com from=yage.net; domainkeys=neutral (no sig)
X-Originating-IP:   [67.15.72.26]
Return-Path:   <spf@spiritplants.yage.net>
Received:   from 67.15.72.26 (EHLO ns1.luibh.com) (67.15.72.26) by mta116.mail.sc5.yahoo.com with SMTP; Mon, 21 Mar 2005 13:14:44 -0800
X-ClientAddr:   127.0.0.1
Received:   from spiritplants.yage.net (localhost.localdomain [127.0.0.1]) by ns1.luibh.com (8.12.11/8.12.10) with ESMTP id j2LLCXrC030091; Mon, 21 Mar 2005 21:12:33 GMT
Received:   (from spf@localhost) by spiritplants.yage.net (8.12.11/8.12.11/Submit) id j2LLCKIw030083; Mon, 21 Mar 2005 21:12:20 GMT
To:   site_blackhole@yage.net
From:   www.spiritplants.org
X-AntiAbuse:   User_id - 2
X-AntiAbuse:   Username - admin
X-AntiAbuse:   User IP - 195.174.64.155
X-Luibh.com-MailScanner-Information:   Please contact the ISP for more information
X-Luibh.com-MailScanner:   Not scanned: please contact your Internet E-Mail Service Provider for details
X-MailScanner-From:   site_blackhole@yage.net

Include this full email (particularly the headers).

Message sent to you follows:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This Site Hacked By iLLeGaLTeam
Security Risk Patch YouR Bug
--- www.illegalteam.com ---

[Stonehenge]

It wasn't just an email. I came back here around 4 hours ago and at the top of the site was this big message, I think it was orange on black and the site was stretched out to the sides. It seems to be back to normal now. We were hacked.

[byrooon]

I went to the site on the message and the web page appeared to be in Russian... Russian hackers?

[andy]

Hey. The forums were indeed defaced by a Turkish hacker group, who wanted to point out the insecurity of the version of phpBB we were running.

They didn't have access to our database, and only included a small piece of HTML to one of the forum descriptions to show their message on the front page. The software has now been upgraded to the latest version so it won't happen again.

Sorry for the inconvenience but all is now well again.

Andy

[judih]

hey andy -
thanks!

[Stonehenge]

Yeah, it seemed like 'good' hackers since they didn't do any real damage. Hopefully, it wont happen again but I have no doubt it's still possible. They did more than deface the main page, they sent out those emails. They must have had access to the database to do that. I must have missed the info on the switchover to spiritplants.org. It seems to have happened seemlessly. Well, everything appears back to normal so all's well