Tweet
Hey everyone,
I'm the server guy, who runs the hardware/software here. I only seem to pop in when there are outages or problems, as there was this week.
I wanted to give you all a heads-up about some recent events affecting the forum.
What happened:
The forum server was compromised. Starting Tuesday morning, and we noticed Wednesday. Attackers had gained unauthorized access and had planted malicious files on the system. While we have no evidence that member data was accessed or exfiltrated, we took the situation very seriously.
What we did:
I spent Thursday trying to recover from it, but the files were too buggered. So the compromise actually accelerated a migration we had already been planning on moving the forum to new hardware on a faster, isolated network. Here's a summary of what was done:
• Removed all malicious files and cleaned the server, eventually giving up
• Migrated the forum to a new server with stronger hardware
• Network should be higher speeds; unsure if that will be noticeable.
• Updated software installed for this major version of VBulletin
• Implemented a dual-layer firewall (both at the network VM level and at the operating system level) with strict outbound traffic controls
• Routed all public traffic through Cloudflare, which now provides DDoS protection and bot filtering
• Removed all remote access paths from the internet. Only through the Cloudflare tunnel now.
• Added a Cloudflare security challenge on the admin panel to block automated attacks
• Locked down server-level script execution to prevent future exploitation
• Configured secure email delivery through Mailgun
This should greatly reduce the effectiveness of the inevitable future exploit found in this forum software.
The good news:
The forum is back online, faster, and significantly more secure than before. Most things should be working as expected.
We need your help:
If you notice anything that isn't working correctly or broken links, missing images, login issues, or anything else that seems off, please reply to this thread and let me know. Your reports will help us catch anything we may have missed during the transition.
I do see the broken emojis on this message. I'll work on that a bit today. Not sure how long they've been broken images.
Thank you for your patience and understanding!
— Ted
I'm the server guy, who runs the hardware/software here. I only seem to pop in when there are outages or problems, as there was this week.
I wanted to give you all a heads-up about some recent events affecting the forum.
What happened:
The forum server was compromised. Starting Tuesday morning, and we noticed Wednesday. Attackers had gained unauthorized access and had planted malicious files on the system. While we have no evidence that member data was accessed or exfiltrated, we took the situation very seriously.
What we did:
I spent Thursday trying to recover from it, but the files were too buggered. So the compromise actually accelerated a migration we had already been planning on moving the forum to new hardware on a faster, isolated network. Here's a summary of what was done:
• Removed all malicious files and cleaned the server, eventually giving up
• Migrated the forum to a new server with stronger hardware
• Network should be higher speeds; unsure if that will be noticeable.
• Updated software installed for this major version of VBulletin
• Implemented a dual-layer firewall (both at the network VM level and at the operating system level) with strict outbound traffic controls
• Routed all public traffic through Cloudflare, which now provides DDoS protection and bot filtering
• Removed all remote access paths from the internet. Only through the Cloudflare tunnel now.
• Added a Cloudflare security challenge on the admin panel to block automated attacks
• Locked down server-level script execution to prevent future exploitation
• Configured secure email delivery through Mailgun
This should greatly reduce the effectiveness of the inevitable future exploit found in this forum software.
The good news:
The forum is back online, faster, and significantly more secure than before. Most things should be working as expected.
We need your help:
If you notice anything that isn't working correctly or broken links, missing images, login issues, or anything else that seems off, please reply to this thread and let me know. Your reports will help us catch anything we may have missed during the transition.
I do see the broken emojis on this message. I'll work on that a bit today. Not sure how long they've been broken images.
Thank you for your patience and understanding!
— Ted