I suspect that my Blog has been hacked!?!
By Paul Murray on Friday, 03 January 2014
Posted in Technical Issues
Likes 0
Views 1.5K
Votes 0
Dear support

This is way over my head. I hope that you can help. My site is down and my hosters are telling me that there are some PHP/scripts that are bringing the Site to it knees. Could you please look at the below excerpt from my Sites logs! It seems to me to be Easyblog related. I really do not understand what is happening but I am guessing that something has got out there and is spitting out links probably with a view to cranking up hits for some weird sites!

Start of mail from hosters...

Dear Sir,

> There are a lot of Apache/PHP tasks which create the high use of the
> capacitiy.
> Please check if these services are running properly.
>
> Dear Andreas
>
> The above is Latin to me. Could you kindly point me in the right direction.

you are using a self administered server; you are the admin. Your scripts use a lot of ressources. We don't know why since those are scripts/appications you installed.


What might be odd is the large amount of POST request like (/var/www/vhosts/finalbug.net/statistics/logs/access_log):

root@mail:/var/www/vhosts/finalbug.net/statistics/logs# grep POST access_log | tail
112.111.176.142 - - [03/Jan/2014:12:00:18 +0100] "POST /home-of-bruce/paradigm-shift/fcp-x-4-beginners/trackback?post_id=339 HTTP/1.1" 200 333 "http://www.christianlouboutinsale-cybermonday.co.uk/womens-christian-louboutin-nude-lady-peep-glitter-mini-sky-high-platforms-cyber-monday-sale-p-92.html" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
175.44.27.73 - - [03/Jan/2014:12:00:18 +0100] "POST /home-of-bruce/post-production/resolve/trackback?post_id=295 HTTP/1.1" 200 333 "http://www.14cambridgecourt.com/sac-a-dos-longchamp-rouge-p-84.html" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
59.58.138.184 - - [03/Jan/2014:12:00:19 +0100] "POST /home-of-bruce/more-stuff/cameras-co/trackback?post_id=291 HTTP/1.1" 200 333 "http://www.repadom.fr/category/abercrombie-and-fitch/" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
112.111.173.211 - - [03/Jan/2014:12:00:20 +0100] "POST /home-of-bruce/paradigm-shift/fcp-x-4-beginners/trackback?post_id=360 HTTP/1.1" 200 333 "http://www.johnhindeuk.com/parajumpers-hyggelig-menn-h248yre-h229nd-navy-jakke-fabrikken-direkte-pris-p-134.html" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
112.111.173.244 - - [03/Jan/2014:12:00:20 +0100] "POST /home-of-bruce/paradigm-shift/fcp-x-4-beginners/trackback?post_id=360 HTTP/1.1" 200 333 "http://belstaffparis.nhg-klap.com/" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
175.42.87.136 - - [03/Jan/2014:12:00:22 +0100] "POST /home-of-bruce/more-stuff/bruce-speaks/trackback?post_id=341 HTTP/1.1" 200 333 "http://gucci.matt-cutts.com/" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
60.168.0.140 - - [03/Jan/2014:11:59:43 +0100] "POST /home-of-bruce/paradigm-shift/fcp-x-4-beginners/trackback?post_id=358 HTTP/1.1" 500 1018 "http://www.shopthepelicans.com/tyreke-evans-jersey-xs-63/" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
60.168.3.188 - - [03/Jan/2014:12:00:36 +0100] "POST /home-of-bruce/post-production/resolve/trackback?post_id=295 HTTP/1.1" 200 333 "http://www.shopcoltsjerseysonline.com/womens-cassius-vaughn-elite-jersey-lo-69.html" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
218.86.51.48 - - [03/Jan/2014:12:00:37 +0100] "POST /home-of-bruce/paradigm-shift/fcp-x-4-beginners/trackback?post_id=281 HTTP/1.1" 200 333 "http://www.michalkorsoutlet.com/michael-kors-handbags/" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
60.168.3.100 - - [03/Jan/2014:12:00:41 +0100] "POST /home-of-bruce/paradigm-shift/fcp-x-4-beginners/trackback?post_id=359 HTTP/1.1" 200 333 "http://www.shopthepelicans.com/eric-gordon-jersey-qb-93/" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
root@mail:/var/www/vhosts/finalbug.net/statistics/logs#

I don't know if those are expected, maybe the developer of yuor app can help you.

End of mail from hosters

thanks

Paul
Hello Paurray,

Nope, you are not hacked. Just that some spammers seems to be trying to spam the trackbacks on your site. Your site is loading up pretty slow for me and I don't have the FTP access to the site. The best way that I would suggest is to add the codes below into the file /components/com_easyblog/easyblog.php and at line 15 add the codes below:



if( JRequest::getVar( 'view' ) == 'trackback' )

{

    return JError::raiseError( 404 , 'Goodbye spammer' );

}
Mark
·
Saturday, 04 January 2014 00:11
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Mark

Thanks for your reply. I gave done as you instructed but it does not seem to be helping!

I am including my FTP details below.

If there is anything else that you need please let me know.

thanks

Paul
Paul Murray
·
Monday, 06 January 2014 16:41
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Mark

I think it is working. Probably some kind of cache thingy somewhere!!!

Will confirm......
Paul Murray
·
Monday, 06 January 2014 17:25
·
0 Likes
·
0 Votes
·
0 Comments
·
Hello Paul,

Sure. Keep us updated.

Thanks!
Adelene
·
Monday, 06 January 2014 18:32
·
0 Likes
·
0 Votes
·
0 Comments
·
Did this solution work as I am experiencing the same difficulties.
Michael Gilmour
·
Friday, 07 February 2014 11:26
·
0 Likes
·
0 Votes
·
0 Comments
·
Hello Michael,

I would strongly suggest that you turn off Trackbacks if you do not use them.
Mark
·
Friday, 07 February 2014 12:08
·
0 Likes
·
0 Votes
·
0 Comments
·
I've now turned them off.
Michael Gilmour
·
Friday, 07 February 2014 15:33
·
0 Likes
·
0 Votes
·
0 Comments
·
If it is disabled, you shouldn't receive anymore spams in your trackbacks.
Mark
·
Friday, 07 February 2014 15:42
·
0 Likes
·
0 Votes
·
0 Comments
·
Hello,

Why has this issue not being resolved in recent updates. My site has being crawling like a baby since November 2013 as reported by numerous customers and I finally figured it is your software that is causing the issue. This has had a major impact on my sites performance and I am extremely disappointed to say the least and no doubt it has affected my business. A slow site immediately turns new customers away.

Over 100,000 trackbacks from spam. -
https://dl.dropboxusercontent.com/u/69023408/Pics/easyblog-trackback-spam.PNG
https://dl.dropboxusercontent.com/u/69023408/Pics/easyblog-trackback-spam2.PNG

I wish to have a valid explanation for this as to why it has not being solved in recent updates and when will it be solved

I would like to know what sql query can I run on my db to remove all trackbacks. Doing it from Easyblog control panel is not an option as it would take hours.
John O Connor
·
Thursday, 24 April 2014 15:36
·
0 Likes
·
0 Votes
·
0 Comments
·
Hello John,

First of all, this is not a bug in EasyBlog If you enabled trackback, then EasyBlog has no control how your user wanna use the feature on your site. Anyway, we have decided to remove the trackback feature in version 4.0 as nows a day, more and more spammer use trackback to spam.

To remove all the trackback from your server, run this sql:



truncate table jos_easyblog_trackback;

truncate table jos_easyblog_trackback_sent;


Replace jos_ with your Joomla db table prefix.

Next, disable trackback from your EasyBlog. To do this, go to EasyBlog backend under Settings -> Workflow -> General -> Trackback.

Hope this help and have a nice day
Sam
·
Thursday, 24 April 2014 17:53
·
0 Likes
·
0 Votes
·
0 Comments
·
Hello Sam,

There were actually closer to 1 000,000 trackbacks created. All of which were spam.
Thanks for the Query and advice. A simple feature would be email notification each time a trackback was created. This way I would have spotted the issue from the get go!
John O Connor
Web:http://www.joomlage.com
John O Connor
·
Thursday, 24 April 2014 22:40
·
0 Likes
·
0 Votes
·
0 Comments
·
Hello John,

Yep, agreed but we'll be removing Trackbacks altogether in EasyBlog 4.0 because it looks like Trackback has lost its popularity when most users are actually using it as a spam tool
Mark
·
Thursday, 24 April 2014 23:25
·
0 Likes
·
0 Votes
·
0 Comments
·
@Sam: Thanks, truncate + disable saved my day.
Kay Bothfeld
·
Friday, 04 July 2014 18:21
·
0 Likes
·
0 Votes
·
0 Comments
·
You are most welcome Kay, glad that your issues are resolved now.
Mark
·
Saturday, 05 July 2014 01:35
·
0 Likes
·
0 Votes
·
0 Comments
·
View Full Post