How was I hacked?

[ak111in]

...

[Come-from-Beyond]

Hi,
Today my bitcoin based website was hacked. The hacker changed the password of admin and other major accounts and changed the withdrawal bitcoin address of all accounts which had major balance. Though I did not lose any bitcoins as he broke the website by messing up the database and I became aware of the hack. The hacker was able to access my database , I suppose through phpmyadmin but I think he was not able to get ssh root access.

So I want to know how feasible it is to brute force a 17 character password having numbers+characters+symbol or should I look for any other way the hacker may have got in.

Hacker bitcoin address to which all the withdrawal addresses were set: 1A8AzZSQp2oxzdSJeUUpoNmeff9bLQKBRo

Regards

Recent hacks of Bitcoin related sites and exchanges hint that it's a 3-letter agency behind them. You should ask Snowden how your website was hacked.

[abyrnes81]

Hi,
Today my bitcoin based website was hacked. The hacker changed the password of admin and other major accounts and changed the withdrawal bitcoin address of all accounts which had major balance. Though I did not lose any bitcoins as he broke the website by messing up the database and I became aware of the hack. The hacker was able to access my database , I suppose through phpmyadmin but I think he was not able to get ssh root access.

So I want to know how feasible it is to brute force a 17 character password having numbers+characters+symbol or should I look for any other way the hacker may have got in.

Hacker bitcoin address to which all the withdrawal addresses were set: 1A8AzZSQp2oxzdSJeUUpoNmeff9bLQKBRo

Regards

Most probable the hacker didn't bruteforce the password, it was another external type of attack (maybe as you said ssh root access). Can I ask you where have you stored your site? On a vps or professional hosting?

[zetaray]

A long password takes too long to bruteforce. Hackers usually go for faster and easier ways. if the site is important to you, spend some btc and hire a white hat hacker to hack your site. Then you will know.

[ak111in]

Hi,
Today my bitcoin based website was hacked. The hacker changed the password of admin and other major accounts and changed the withdrawal bitcoin address of all accounts which had major balance. Though I did not lose any bitcoins as he broke the website by messing up the database and I became aware of the hack. The hacker was able to access my database , I suppose through phpmyadmin but I think he was not able to get ssh root access.

So I want to know how feasible it is to brute force a 17 character password having numbers+characters+symbol or should I look for any other way the hacker may have got in.

Hacker bitcoin address to which all the withdrawal addresses were set: 1A8AzZSQp2oxzdSJeUUpoNmeff9bLQKBRo

Regards

Most probable the hacker didn't bruteforce the password, it was another external type of attack (maybe as you said ssh root access). Can I ask you where have you stored your site? On a vps or professional hosting?

vps

[abyrnes81]

Hi,
Today my bitcoin based website was hacked. The hacker changed the password of admin and other major accounts and changed the withdrawal bitcoin address of all accounts which had major balance. Though I did not lose any bitcoins as he broke the website by messing up the database and I became aware of the hack. The hacker was able to access my database , I suppose through phpmyadmin but I think he was not able to get ssh root access.

So I want to know how feasible it is to brute force a 17 character password having numbers+characters+symbol or should I look for any other way the hacker may have got in.

Hacker bitcoin address to which all the withdrawal addresses were set: 1A8AzZSQp2oxzdSJeUUpoNmeff9bLQKBRo

Regards

Most probable the hacker didn't bruteforce the password, it was another external type of attack (maybe as you said ssh root access). Can I ask you where have you stored your site? On a vps or professional hosting?

vps

Have you checked your e-mail address? Has been it compromise or not? Maybe the hacked 'caught' the access to your address and requested a password reset for you admin vps account.

[ak111in]

Have you checked your e-mail address? Has been it compromise or not? Maybe the hacked 'caught' the access to your address and requested a password reset for you admin vps account.

There are no signs that my email has been compromised, since all the changes were made only in database I think he did not get access to my vps account or ssh but only got through phpmyadmin.

A long password takes too long to bruteforce. Hackers usually go for faster and easier ways. if the site is important to you, spend some btc and hire a white hat hacker to hack your site. Then you will know.

Can you suggest someone or where can I find one

[EcuaMobi]

Are you using the latest version of phpMyAdmin? I think an older version had a security bug.
Also is it installed on tje default /phpmyadmim? Try a unique URL. Just to confirm I guess it uses SSL right?
And finally make sure to use .htpasswd besides the normal DB password. Were you already using it?

[ak111in]

Are you using the latest version of phpMyAdmin? I think an older version had a security bug.
Also is it installed on tje default /phpmyadmim? Try a unique URL. Just to confirm I guess it uses SSL right?
And finally make sure to use .htpasswd besides the normal DB password. Were you already using it?

Have updated everything now, but do not have SSL or .htpasswd

[EcuaMobi]

Are you using the latest version of phpMyAdmin? I think an older version had a security bug.
Also is it installed on tje default /phpmyadmim? Try a unique URL. Just to confirm I guess it uses SSL right?
And finally make sure to use .htpasswd besides the normal DB password. Were you already using it?

Have updated everything now, but do not have SSL or .htpasswd

If you think the hacker may have accessed the DB that way you should definitely add those. Regarding SSL a self signed certificate would do, just to prevent your DB password from being sent as plain text.

[ak111in]

Are you using the latest version of phpMyAdmin? I think an older version had a security bug.
Also is it installed on tje default /phpmyadmim? Try a unique URL. Just to confirm I guess it uses SSL right?
And finally make sure to use .htpasswd besides the normal DB password. Were you already using it?

Have updated everything now, but do not have SSL or .htpasswd

If you think the hacker may have accessed the DB that way you should definitely add those. Regarding SSL a self signed certificate would do, just to prevent your DB password from being sent as plain text.

Thanks will add SSL to the website.

[abyrnes81]

Have you checked your e-mail address? Has been it compromise or not? Maybe the hacked 'caught' the access to your address and requested a password reset for you admin vps account.

There are no signs that my email has been compromised, since all the changes were made only in database I think he did not get access to my vps account or ssh but only got through phpmyadmin.

A long password takes too long to bruteforce. Hackers usually go for faster and easier ways. if the site is important to you, spend some btc and hire a white hat hacker to hack your site. Then you will know.

Can you suggest someone or where can I find one

Then yes, the malicious user has granted the access through the phpmyadmin panel. Maybe your password was 'weak' now you should improve your security.

[Professor Plums]

So I want to know how feasible it is to brute force a 17 character password having numbers+characters+symbol or should I look for any other way the hacker may have got in.

It doesn't matter how long or complex your password is if you've got a keylogger or spyware. Have you scanned your comp for viruses?

[ak111in]

So I want to know how feasible it is to brute force a 17 character password having numbers+characters+symbol or should I look for any other way the hacker may have got in.

It doesn't matter how long or complex your password is if you've got a keylogger or spyware. Have you scanned your comp for viruses?

Yes nothing there. I keylogger would have caused bigger problems.

[rax]

SSH (/etc/ssh/sshd_config)

1. Disable root SSH access.

Code:

PermitRootLogin no

2. Disable password-based SSH logins, use public keys instead.

Code:

PubkeyAuthentication yes
ChallengeResponseAuthentication no
PasswordAuthentication no

Learn more about key-based authentication here. Even better, read the whole Linux Crypto post series.


Other services

3. Remove phpMyAdmin. If you need to fuck shit up just log into the database server and issue plain SQL queries using mysql-client. Bottom line: don't expose any service to the internet other than SSH, HTTPS and/or HTTP.

4. Setup a firewall using ufw.


Passwords

5. Change every single password in the system. Follow the Diceware approach to password generation. Use 8 to 10 words at least. Do write down your passwords. Paper will work, an encrypted file using your (properly stored) GPG key would be even better.

6. Hope for the best.

[bitmarket.io]

cuz you's a dumbfuk

[Sarthak]

Thats Hackers address?
I found something interesting!

http://earnfreebitcoins.com/address/1A8AzZSQp2oxzdSJeUUpoNmeff9bLQKBRo

Contact the admin of earnfreebitcoins.com for the hackers ip! I don't think the hacker used any software like Tor when he used to visit sites to earn free bitcoins! The hacker is a cheap one! He just earned 0.0000083 from that free bitcoin site xD

[notlist3d]

Hi,
Today my bitcoin based website was hacked. The hacker changed the password of admin and other major accounts and changed the withdrawal bitcoin address of all accounts which had major balance. Though I did not lose any bitcoins as he broke the website by messing up the database and I became aware of the hack. The hacker was able to access my database , I suppose through phpmyadmin but I think he was not able to get ssh root access.

So I want to know how feasible it is to brute force a 17 character password having numbers+characters+symbol or should I look for any other way the hacker may have got in.

Hacker bitcoin address to which all the withdrawal addresses were set: 1A8AzZSQp2oxzdSJeUUpoNmeff9bLQKBRo

Regards

I would say most likely it was a exploit to gain acess.   Bruteforcing a 17 char password is something you really could not do espically if you are trying against a place online.   Unless just horrible security it would stop IP access if you just keep hitting it with wrong passwords.

[ak111in]

SSH (/etc/ssh/sshd_config)

1. Disable root SSH access.

Code:

PermitRootLogin no

2. Disable password-based SSH logins, use public keys instead.

Code:

PubkeyAuthentication yes
ChallengeResponseAuthentication no
PasswordAuthentication no

Learn more about key-based authentication here. Even better, read the whole Linux Crypto post series.


Other services

3. Remove phpMyAdmin. If you need to fuck shit up just log into the database server and issue plain SQL queries using mysql-client. Bottom line: don't expose any service to the internet other than SSH, HTTPS and/or HTTP.

4. Setup a firewall using ufw.


Passwords

5. Change every single password in the system. Follow the Diceware approach to password generation. Use 8 to 10 characters at least. Do write down your passwords. Paper will work, an encrypted file using your (properly stored) GPG key would be even better.

6. Hope for the best.

Thanks done some of them , working on doing others.

[ak111in]

Thats Hackers address?
I found something interesting!

http://earnfreebitcoins.com/address/1A8AzZSQp2oxzdSJeUUpoNmeff9bLQKBRo

Contact the admin of earnfreebitcoins.com for the hackers ip! I don't think the hacker used any software like Tor when he used to visit sites to earn free bitcoins! The hacker is a cheap one! He just earned 0.0000083 from that free bitcoin site xD

Thanks I will try and contact earnfreebitcoins.com, the tragedy is that a cheaper hacker was able to get complete access to the database but in the end his stupidity saved my bitcoins.