IMPORTANT. Security Alert!
It has come to our attention that a few Dolphin-based sites have been hacked. We investigated the reported vulnerability and can assure you that proper installation of Dolphin is NOT vulnerable.
Attacks are only possible in case your host has the "register_globals=On" setting for PHP, which is expressly prohibited by the Dolphin installation manual and technical requirements.
Dolphin Technical Requirements
Also a quote from the technical requirements "Your host must have any Linux/Unix OS (RedHat, Debian, FreeBSD, Mandrake, etc). NOTE: SAFE_MODE must be OFF, register_globals must be OFF. " Note the "must" word there.
It is also very likely that attacks were executed through 3rd party scripts, such as phpBB.
So, if your site was attacked, make sure to get the "register_globals" setting rewritten to "Off" before reverting to backup. If your site is not affected, double check your PHP settings.
Meanwhile, we're preparing a security update, which will remove any potential vulnerabilities in Dolphin code even with "register_globals=On". It should be available within 24 hours. We still recommend, however, that you switch "register_globals=Off" if you're using any 3rd party scripts. Also check for updates of these 3rd party scripts, latest versions may have own patches to fix similar problem.
I would like to point out that we make thorough security testing before release, and Dolphin now holds an effective "HackerSafe" badge. This particular issue happened ONLY due to incorrect installations, so PLEASE be careful and attentive.
See All ›
About BoonEx•Contacts•© BoonEx (ACN 127966581)
NOTE IXWEBHOSTING will not turn off their register_globals=on
Bad HOST
hostmonster has register_globals=on by see more
this is ideal because you have your olphin sites hosted on a dedicated server that is in effect setup just for dolphin sites, because we use them for our own dolphin sites and make sure we keep them secure.
maybe people need to understand that cheaper is just that, its cheap see more
<? phpinfo(); ?>
then save it like phpinfo.php and upload it to your server. Then call it from your browser like http://yoursite.com/phpinfo.php and find a line containing 'register_globals'. If it's value is Off then everything is OK.
php_flag register_globals Off
If it produce 500 Internal Server Error, please contact your hosting server provider.
They came in through a test site running 6.1 and hot my other regular sites.
And well they have informed me you have issues in your script this was the e-mail I received
Hello,
Whatever the script in /ray/ was, was exploitable and this is how the account was exploited and this malicious script uploaded.
Regards,
Richard F.
Network Security Administrator
Personally boonex is passing the issues on when it is there problem.
But if you have more info about other issues please let us know.
There Name=CebongDevils cebongcrew. This Is The 2nd Time For me The 1st was Shoutbox They put porn pics on it, Thats Not Good I have Kids That go to my site! Boonex Instead of Spending hours on a forum Just Fix it.
what dont you get? The script got in b/c hackers put it in...hackers put it in b/c your globals were on.
Boonex cant control your servers hosting. Just do what you are told, and most importantly read/do every single step.
use this issue to pick up those IP and block them form accessing your account...
just my 2 cents...
We would highly appreciate this information. So, we will be able to do investigation and fix this.
RIPE Network Coordination Centre (50+ instances)
RackVibe LLC
Internet Specialties West ISWEST-BLK-1
HostForWeb Inc. SCNET (20+ instances)
Global see more
Just a quicky - here if Hostforweb has globals on and Boonex recommend them as being perfect for Dolphin.... hmmm doesnt seem right somehow....
Cheers
Max
-- Jason
You should do your best to write your scripts so that they do not require
; register_globals to be on; Using form variables as globals can easily lead
; to possible security problems, if the code is not very well thought of.
register_globals = Off
I have a JOOMLA site www.guardiarepublicana.com/v02
Is hacked for someone how put a lot of links inside all files of the joomla
Maybe you could thing that this is not for this topic, but let me tell you that
The last week I installed a dolphin in the same site but with this URL:
www.guardiarepublicana.com/v03
today the v03 is emty, because was hacked
I goona give you some codes that this hacker put inside the files
Maybe that gonna be important in order to solve see more
I got them off, deleted content.inc.php and uploaded one from dolphin script, same with safehtml ( I forgot the name of file now..) and since then I didnt get any warnings from HFW nor did I had any demages to the site.... I hope it stays that way.