Member
A site I manage using Zenphoto was just hacked by Moroccan hackers calling themselves, Driss Moroccan Hacker. A simple Google search for that name shows lots of Zenphoto sites compromised. I was using version 1.2.9 and quickly removed the defacement and upgraded to 1.3.1.1. Apparently they were able to gain access through the admin access using XSS. They were also able to upload a theme template with the defacement.
After upgrading I checked the security log again and found the following information as the perpetrators were attempting to gain access once again. The response is in French (No Access and Fail)
2010-09-01 19:42:36 41.141.0.192 Pas d'accès [Echoué] /zp-core/admin-users.php%3Fticket%3Dda704c76c580a4639747b6b08db71efb%26user%3Ddriss
2010-09-01 19:43:00 41.141.0.192 Site d'administration driss [Echoué] casamar
2010-09-01 19:43:18 41.141.0.192 Site d'administration admin [Echoué] casamar
2010-09-01 19:43:24 41.141.0.192 Site d'administration admin [Echoué] admin
2010-09-01 19:43:32 41.141.0.192 Site d'administration admin [Echoué] casamar1882
2010-09-01 19:43:50 41.141.0.192 Site d'administration admin [Echoué] pi7v4
2010-09-01 19:44:09 41.141.0.192 Site d'administration [Echoué] utryq
I blocked the ip address which was originating from Morocco and hardened the site even further.
I hope this information helps.
Thanks
After upgrading I checked the security log again and found the following information as the perpetrators were attempting to gain access once again. The response is in French (No Access and Fail)
2010-09-01 19:42:36 41.141.0.192 Pas d'accès [Echoué] /zp-core/admin-users.php%3Fticket%3Dda704c76c580a4639747b6b08db71efb%26user%3Ddriss
2010-09-01 19:43:00 41.141.0.192 Site d'administration driss [Echoué] casamar
2010-09-01 19:43:18 41.141.0.192 Site d'administration admin [Echoué] casamar
2010-09-01 19:43:24 41.141.0.192 Site d'administration admin [Echoué] admin
2010-09-01 19:43:32 41.141.0.192 Site d'administration admin [Echoué] casamar1882
2010-09-01 19:43:50 41.141.0.192 Site d'administration admin [Echoué] pi7v4
2010-09-01 19:44:09 41.141.0.192 Site d'administration [Echoué] utryq
I blocked the ip address which was originating from Morocco and hardened the site even further.
I hope this information helps.
Thanks
Member
Cross site reference forgeries are a kind of social hack. The attacker has to cause you to visit a poisoned site which then posts a request to zenphoto. If you are logged into zenphoto then (before version 1.3.1) the post would be accepted.
Version 1.3.1 provides protection against this in general. HOWEVER, if you have the front-end editing enabled we are unable to make the protection, so you are still vulnerable. This is why the front-end editing is disabled by default.
But "blocked access" is not cross site forgery. It is simply a post submitted from some site. There must have been a missing check on a logged in administrator, though I don't know what that would have been. There should also have been a link in the "additional information" which will tell which access the hackers believed was open.
Version 1.3.1 provides protection against this in general. HOWEVER, if you have the front-end editing enabled we are unable to make the protection, so you are still vulnerable. This is why the front-end editing is disabled by default.
But "blocked access" is not cross site forgery. It is simply a post submitted from some site. There must have been a missing check on a logged in administrator, though I don't know what that would have been. There should also have been a link in the "additional information" which will tell which access the hackers believed was open.
Member
Member
Thank you for clarifying a few things. However, so what you're saying is even with the update to 1.3.1.1 they were able to gain access again based upon the first entry of the log? Could this have been a result of being logged into the admin section when they attempted again? They had compromised zenphoto for complete admin access and changed the admin email and password as well. There is only one user and that is the admin (me).
The log was recorded after upgrading to 1.3.1.1. Front end editing was disabled. What really bothers me is how were they able to install defacement themes? This would really indicate a hole someplace.
Thank you for your help.
The log was recorded after upgrading to 1.3.1.1. Front end editing was disabled. What really bothers me is how were they able to install defacement themes? This would really indicate a hole someplace.
Thank you for your help.
Administrator
Did you contact your host about that? It might also have been a combination of a security hole in the old Zenphoto install and on the server itself. Just to be sure I would contact them.
My demo install had been hacked a while back as well but that was my fault as I accidentally had to low folder permissions.
My demo install had been hacked a while back as well but that was my fault as I accidentally had to low folder permissions.
Member
Member
I have reviewed the 1.2.9 release. The hack captured above would not work on that release either. The hacker would have to have had a login on your site to get to that page. Given the other log entries I do not think he did. Those are all login failures with various password attempts
Member
Member
The perpetrators are back and in force. However, I'm posting the raw server logs with the domain changed in hope that someone can analyze their system of attack.
41.201.195.5 - - [02/Sep/2010:13:03:07 -0700] "GET /mywebsite.com/photos/zp-core/admin.php HTTP/1.1" 200 1114 "http://www.google.fr/search?q=intitle:%22zenphoto+administration%22&hl=fr&ei=1AKATKPpHcmN4gau6KzTCw&start=60&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/admin.css HTTP/1.1" 200 32564 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/zenphoto.js HTTP/1.1" 200 402 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/toggleElements.css HTTP/1.1" 200 1778 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.css HTTP/1.1" 200 27782 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/admin.js HTTP/1.1" 200 7964 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.tooltip.js HTTP/1.1" 200 7182 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/colorbox.css HTTP/1.1" 200 3015 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/jquery.colorbox-min.js HTTP/1.1" 200 8762 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/images/zen-logo.png HTTP/1.1" 200 1748 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/c.php?i=226f927bd4 HTTP/1.1" 200 3703 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:14 -0700] "GET /mywebsite.com/photos/zp-core/images/reset.png HTTP/1.1" 200 229 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.js HTTP/1.1" 200 160712 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.js HTTP/1.1" 200 221159 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:11 -0700] "GET /mywebsite.com/photos/zp-core/admin-edit.php?page=edit HTTP/1.1" 302 20 "http://www.google.fr/search?q=intitle:%22zenphoto+administration%22&hl=fr&ei=6wKATMaeFcPU4wbG6JjTCw&start=70&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:12 -0700] "GET /mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit HTTP/1.1" 200 1122 "http://www.google.fr/search?q=intitle:%22zenphoto+administration%22&hl=fr&ei=6wKATMaeFcPU4wbG6JjTCw&start=70&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:13 -0700] "GET /mywebsite.com/photos/zp-core/admin.css HTTP/1.1" 206 25304 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:16 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/jquery.colorbox-min.js HTTP/1.1" 200 8762 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:16 -0700] "GET /mywebsite.com/photos/zp-core/c.php?i=1e7db521ca HTTP/1.1" 200 3668 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:17 -0700] "GET /mywebsite.com/photos/zp-core/js/admin.js HTTP/1.1" 200 7964 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:17 -0700] "GET /mywebsite.com/photos/zp-core/js/zenphoto.js HTTP/1.1" 200 402 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:17 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.tooltip.js HTTP/1.1" 200 7182 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:14 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.js HTTP/1.1" 200 160712 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:21 -0700] "GET /mywebsite.com/favicon.ico HTTP/1.1" 200 894 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:14 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.js HTTP/1.1" 200 221159 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:21 -0700] "GET /mywebsite.com/photos/zp-core/admin-themes.php HTTP/1.1" 302 20 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:25 -0700] "GET /mywebsite.com/favicon.ico HTTP/1.1" 200 894 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:25 -0700] "GET /mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php HTTP/1.1" 200 1116 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/zenphoto.js HTTP/1.1" 200 402 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.tooltip.js HTTP/1.1" 200 7182 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/jquery.colorbox-min.js HTTP/1.1" 200 8762 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/admin.js HTTP/1.1" 200 7964 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/c.php?i=3d0bd030ee HTTP/1.1" 200 3751 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.js HTTP/1.1" 200 160712 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.js HTTP/1.1" 200 221159 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:07 -0700] "GET /mywebsite.com/photos/zp-core/admin.php HTTP/1.1" 200 1114 "http://www.google.fr/search?q=intitle:%22zenphoto+administration%22&hl=fr&ei=1AKATKPpHcmN4gau6KzTCw&start=60&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/admin.css HTTP/1.1" 200 32564 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/zenphoto.js HTTP/1.1" 200 402 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/toggleElements.css HTTP/1.1" 200 1778 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.css HTTP/1.1" 200 27782 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/admin.js HTTP/1.1" 200 7964 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.tooltip.js HTTP/1.1" 200 7182 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/colorbox.css HTTP/1.1" 200 3015 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/jquery.colorbox-min.js HTTP/1.1" 200 8762 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/images/zen-logo.png HTTP/1.1" 200 1748 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:13 -0700] "GET /mywebsite.com/photos/zp-core/c.php?i=226f927bd4 HTTP/1.1" 200 3703 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:14 -0700] "GET /mywebsite.com/photos/zp-core/images/reset.png HTTP/1.1" 200 229 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.js HTTP/1.1" 200 160712 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:03:12 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.js HTTP/1.1" 200 221159 "http://www.mywebsite.com/photos/zp-core/admin.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:11 -0700] "GET /mywebsite.com/photos/zp-core/admin-edit.php?page=edit HTTP/1.1" 302 20 "http://www.google.fr/search?q=intitle:%22zenphoto+administration%22&hl=fr&ei=6wKATMaeFcPU4wbG6JjTCw&start=70&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:12 -0700] "GET /mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit HTTP/1.1" 200 1122 "http://www.google.fr/search?q=intitle:%22zenphoto+administration%22&hl=fr&ei=6wKATMaeFcPU4wbG6JjTCw&start=70&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:13 -0700] "GET /mywebsite.com/photos/zp-core/admin.css HTTP/1.1" 206 25304 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:16 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/jquery.colorbox-min.js HTTP/1.1" 200 8762 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:16 -0700] "GET /mywebsite.com/photos/zp-core/c.php?i=1e7db521ca HTTP/1.1" 200 3668 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:17 -0700] "GET /mywebsite.com/photos/zp-core/js/admin.js HTTP/1.1" 200 7964 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:17 -0700] "GET /mywebsite.com/photos/zp-core/js/zenphoto.js HTTP/1.1" 200 402 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:17 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.tooltip.js HTTP/1.1" 200 7182 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:14 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.js HTTP/1.1" 200 160712 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:21 -0700] "GET /mywebsite.com/favicon.ico HTTP/1.1" 200 894 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:14 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.js HTTP/1.1" 200 221159 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-edit.php%3Fpage%3Dedit" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:21 -0700] "GET /mywebsite.com/photos/zp-core/admin-themes.php HTTP/1.1" 302 20 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:25 -0700] "GET /mywebsite.com/favicon.ico HTTP/1.1" 200 894 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:25 -0700] "GET /mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php HTTP/1.1" 200 1116 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/zenphoto.js HTTP/1.1" 200 402 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.tooltip.js HTTP/1.1" 200 7182 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/colorbox/jquery.colorbox-min.js HTTP/1.1" 200 8762 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/admin.js HTTP/1.1" 200 7964 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/c.php?i=3d0bd030ee HTTP/1.1" 200 3751 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/jquery.js HTTP/1.1" 200 160712 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
41.201.195.5 - - [02/Sep/2010:13:04:27 -0700] "GET /mywebsite.com/photos/zp-core/js/jqueryui/jquery_ui_zenphoto.js HTTP/1.1" 200 221159 "http://www.mywebsite.com/photos/zp-core/admin.php?from=/zp-core/admin-themes.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2.8) Gecko/20100722 FileDownloader"
Member
Member
Here you go.
2010-09-02 13:04:12 41.201.195.5 Pas d'accès [Echoué] /zp-core/admin-edit.php%3Fpage%3Dedit
2010-09-02 13:04:24 41.201.195.5 Pas d'accès [Echoué] /zp-core/admin-themes.php
2010-09-02 13:15:33 41.201.195.5 Pas d'accès [Echoué] /zp-core/admin-upload.php%3Falbum%3Dsomealbum
2010-09-02 13:04:12 41.201.195.5 Pas d'accès [Echoué] /zp-core/admin-edit.php%3Fpage%3Dedit
2010-09-02 13:04:24 41.201.195.5 Pas d'accès [Echoué] /zp-core/admin-themes.php
2010-09-02 13:15:33 41.201.195.5 Pas d'accès [Echoué] /zp-core/admin-upload.php%3Falbum%3Dsomealbum
Member
All is good. Zenphoto is prohibiting these attacks as it should. Short of blocking the IP from your server there is not much you can do that is not already been done. Anyone can concoct a URL to your site and try to access it. That is the nature of the internet. But of course, no one but a logged in user should be able to complete the transaction. That is what has been happening on your site.
I suppose the hackers could have tried a similar ploy to write files to your site. That can be prevented only by having the proper strong file permissions in place.
I suppose the hackers could have tried a similar ploy to write files to your site. That can be prevented only by having the proper strong file permissions in place.
Member
A follow up post on this exploit. I contacted the security admin support for my provisioner, Media Temple, and according to them they claimed that the perpetrators, once they had access to the zen photo admin, they were able to upload altered themes to their intended target without FTP access or SSH. I'm only going by what they said - perhaps deflecting any blame on their part. However, it does appear that Zenphoto has been compromised on a lot of sites with different provisioners recently, by these same individuals. I just wish I knew their methodology of entry so it can be patched.
Thanks for everyone's help.
Thanks for everyone's help.
Administrator
If the file/folder permissions were set to low that probably might happen but is not exactly the fault of Zenphoto.
You say there have been more Zenphoto sites compromised. It would be interessting to know details about those (what version, what permissions).
It is always possible that we missed something (it's software...). Anyway, I would suggest you inform your host to tell those users to immediatly upgrade to our recent release (1.3.1.2).
You say there have been more Zenphoto sites compromised. It would be interessting to know details about those (what version, what permissions).
It is always possible that we missed something (it's software...). Anyway, I would suggest you inform your host to tell those users to immediatly upgrade to our recent release (1.3.1.2).
Member
You should be gravely concerned about the knowledge of Media Temple with respect to security (at least.)
There is no provision in Zenphoto to upload themes. At best if a hacker gained admin rights to your site he could copy and edit a theme that you already had.
But there is no indication that the hackers did get admin rights on your site. You could tell if there were a "new" admin you did not create. Since you have not mentioned that, I presume that there was not. So only if the hacker gained your user/password could he access your site without your knowing. That seems unlikely since the above log shows him trying to guess a user/password. Why would he do that if he already knew one.
Most likely the cause of any breach is inadequate file permissions on the site.
There is no provision in Zenphoto to upload themes. At best if a hacker gained admin rights to your site he could copy and edit a theme that you already had.
But there is no indication that the hackers did get admin rights on your site. You could tell if there were a "new" admin you did not create. Since you have not mentioned that, I presume that there was not. So only if the hacker gained your user/password could he access your site without your knowing. That seems unlikely since the above log shows him trying to guess a user/password. Why would he do that if he already knew one.
Most likely the cause of any breach is inadequate file permissions on the site.
Member
Actually, the perpetrators were able to gain access to manage the admin prior to updating to 1.3.1.1 with version 1.2.9. I had to go into phpMyadmin and wipe the user.
I had to take additional security measures and block all traffic with .htaccess from all of Morocco. All has been quiet for the past few days until failed attempts are showing up now originating out of France and Bulgaria. Since this site only really benefits the North American and English speaking counties I'm going to block access from all the former Soviet block nations as well and mainland China.
A few more logs from to help you analyze attempted incursions.
2010-09-06 11:11:31 78.246.80.48 Pas d'accès [Echoué] /zp-core/admin-themes.php%3Faction%3Dsettheme%26themealbum%3D%26theme%3Dstopdesign
2010-09-06 15:29:46 76.167.243.98 Blocked access Failed /zp-core/admin-themes.php%3Faction%3Dsettheme%26themealbum%3D%26theme%3Dstopdesign
Thank you.
I had to take additional security measures and block all traffic with .htaccess from all of Morocco. All has been quiet for the past few days until failed attempts are showing up now originating out of France and Bulgaria. Since this site only really benefits the North American and English speaking counties I'm going to block access from all the former Soviet block nations as well and mainland China.
A few more logs from to help you analyze attempted incursions.
2010-09-06 11:11:31 78.246.80.48 Pas d'accès [Echoué] /zp-core/admin-themes.php%3Faction%3Dsettheme%26themealbum%3D%26theme%3Dstopdesign
2010-09-06 15:29:46 76.167.243.98 Blocked access Failed /zp-core/admin-themes.php%3Faction%3Dsettheme%26themealbum%3D%26theme%3Dstopdesign
Thank you.