Thread

Hi There!

Someone posted in our forums and then - randomly - he became me.

I.e., “Ivy Matt” started a topic.

People posted a few times afterwards.

A few days passed.

And then, today, the first post - his post - is suddenly attributed to “Admin”.  How did I become him?  How would that even happen?  Am I being hacked?

Here’s the thread:  http://focusfusion.org/index.php/forums/viewthread/921/

I don’t see any simple way to switch attribution/authorship for a post.  Very weird.

Unsettling.

That is indeed weird. You might want to perform an audit on your posts to see it is just the single item.

But just in case…

  Thanks for reporting this. We take security very seriously and will do our best to work with you on figuring out what’s going on. To that, we need some additional information from you…

  1. EE version and build (found at the bottom of your control panel)
  2. Other scripts on your account, whether in use or not (phpBB, etc…)*

  * If this is a shared hosting environment, the host can make a determination if the attack came through scripts on another account on the server, which is commonly the case with these types of hacks.

  While we work through this, please check through these files:

  * path.php (if using EE 1.x)
  * config.php
  * database.php (if using EE 2.x)
  * index.php

  to ensure that there is no unusual code such as iFrames or Javascript includes; if you do find that code, then please back-up the file and remove said code.  If you are unsure of what does or doesn’t belong in these files, do not hesitate to ask.

  You may also wish to refresh your files by following the build update instructions.

  Also please ensure that you report this to your host immediately as they can help identify where the attack originated from so that steps can be taken to prevent this in the future.

I’m hosted by enginehosting.com - I shall send an email to support.

Version 2.1.3
Build:  20110411

Didn’t see anything in index.php;

Where is database.php?

Thanks!

Hi, focusfusion -

You can find database.php in /system/expressionengine/config

Have you heard back from EngineHosting?

Also, have you run a virus scan on your own computer to make sure there is nothing awry there?