Member
I am forgiving my splash screen for the next months, and will be replacing it with:
Just a word of advice, I recently came back from being
compromised.
I downloaded the script for ZENPHOTO. Less than 2 days later
I was banned from Google as well as other search engines.
ZenPhoto was no help, actually they were nasty. Think, before
You install it.
I believe it was an inside Job.
Just a word of advice, I recently came back from being
compromised.
I downloaded the script for ZENPHOTO. Less than 2 days later
I was banned from Google as well as other search engines.
ZenPhoto was no help, actually they were nasty. Think, before
You install it.
I believe it was an inside Job.
Member
So let me break this down for those playing at home... And no, I'm not part of the zenphoto team, just an active contributor the community.
[list=1]
[*]Zenphoto websites are targeted by an exploit found in the TinyMCE plugin that was being used (a 3rd party platform that the Zenphoto team did not create).
[*]Zenphoto team is made aware of the hacks happening and work quickly with the community to find the problem, and then work with the author of the plugin to correct the security flaw.
[*]Somewhere during this timeframe, [b]baddco[/b] installs Zenphoto. He later admits amid his rant and accusation that the Zenphoto team did an Inside Job because his HOST installed an out-dated and vulnerable script.
[/list]
What do we learn from this boys and girls? Don't use script-installers from hosts, do the work yourself.
What did [b]baddco[/b] learn from this endeavor? His 7 years of page rankings went down the tube because he was too lazy to install Zenphoto on his own...
Sorry, I just get tired of seeing people bash Zenphoto's developers, especially when it's not something that should be at their feet for fault.
[i][b]@baddco[/b] If you're goint to sensationalize the scenario, at least do so truthfully. You [b]didn't[/b] download the ZENPHOTO script. You clicked "install now" through your host's script install (my guess is either Fantastico or Scriptaculous). HAD you downloaded and installed the Zenphoto scripts from the site, you'd have downloaded the proper versions and not been subjected to a known exploit.[/i]
[list=1]
[*]Zenphoto websites are targeted by an exploit found in the TinyMCE plugin that was being used (a 3rd party platform that the Zenphoto team did not create).
[*]Zenphoto team is made aware of the hacks happening and work quickly with the community to find the problem, and then work with the author of the plugin to correct the security flaw.
[*]Somewhere during this timeframe, [b]baddco[/b] installs Zenphoto. He later admits amid his rant and accusation that the Zenphoto team did an Inside Job because his HOST installed an out-dated and vulnerable script.
[/list]
What do we learn from this boys and girls? Don't use script-installers from hosts, do the work yourself.
What did [b]baddco[/b] learn from this endeavor? His 7 years of page rankings went down the tube because he was too lazy to install Zenphoto on his own...
Sorry, I just get tired of seeing people bash Zenphoto's developers, especially when it's not something that should be at their feet for fault.
[i][b]@baddco[/b] If you're goint to sensationalize the scenario, at least do so truthfully. You [b]didn't[/b] download the ZENPHOTO script. You clicked "install now" through your host's script install (my guess is either Fantastico or Scriptaculous). HAD you downloaded and installed the Zenphoto scripts from the site, you'd have downloaded the proper versions and not been subjected to a known exploit.[/i]
Member
Pretty much that's it in a Nutshell. Ya offer a Hack version and a clean version? Is that how you're trying to say it?
I was at StopBadware earlier, and dropped off a good word for ya too. Too bad the staff here rips on the posters, I noticed others in threads... even though I don't read them that is. I'm pretty certain there would be others that would spill their guts if they didn't need to be concerned about a public flogging.
I was at StopBadware earlier, and dropped off a good word for ya too. Too bad the staff here rips on the posters, I noticed others in threads... even though I don't read them that is. I'm pretty certain there would be others that would spill their guts if they didn't need to be concerned about a public flogging.
Member
baddco you can't just come here with the attitude you have and expect to get a nice response. i've found the admins here very helpful and everyone was shocked and taken by surprise by the recent hacks which affected loads of people with large sites, not just you.
to say its an inside job is almost as laughable as coming on here and saying "I have many friends too" as some kind of veiled threat.....
to say its an inside job is almost as laughable as coming on here and saying "I have many friends too" as some kind of veiled threat.....
Administrator
Thanks micheall and thebluebus, very appreciated!
On this forum you get often much more and more detailed help than on other projects. Considering that we are only volunteers in a quite small team we acted pretty fast and well on this. Software is and can never be flawless as the humans creating it are not. Yes, we do make mistakes or miss things. Guess what, we don't release new versions for no reason.
That said, it is not needed to "worship" us for doing Zenphoto but a little more respect for our voluntary and quite idealistic work we don't even need to do would be really polite. I guess some people are too used to get everything for free and granted...
It is really not our repsonibility to take care of security on your install. If using a open source script like ours it is your or your service provider's repsonsibility to stay up to date regarding issues. Hacks could and did happen with much bigger CMS projects in the past as well. And this was the first big hack occurance on Zenphoto within over 5 years of existence (as far as I know).
(I won't refer to the "no warranty" section of the GPL v2 licences btw, no I won't...)
Quote:Ya offer a Hack version and a clean version? Is that how you're trying to say it?baddco: I can sort of understand that you are upset. Anyway, you really should make up your mind and rethink your attitude.
On this forum you get often much more and more detailed help than on other projects. Considering that we are only volunteers in a quite small team we acted pretty fast and well on this. Software is and can never be flawless as the humans creating it are not. Yes, we do make mistakes or miss things. Guess what, we don't release new versions for no reason.
That said, it is not needed to "worship" us for doing Zenphoto but a little more respect for our voluntary and quite idealistic work we don't even need to do would be really polite. I guess some people are too used to get everything for free and granted...
It is really not our repsonibility to take care of security on your install. If using a open source script like ours it is your or your service provider's repsonsibility to stay up to date regarding issues. Hacks could and did happen with much bigger CMS projects in the past as well. And this was the first big hack occurance on Zenphoto within over 5 years of existence (as far as I know).
(I won't refer to the "no warranty" section of the GPL v2 licences btw, no I won't...)
Member
[b]@baddco[/b]
As Acrylian said, this is the first major exploit/security hole there has been with zenphoto in 5 years, and it was in a plugin (from a different 3rd party source) that was being distributed.
Everybody can understand that you're upset, most of those affected were frustrated too, myself included. The reason your reception was handled the way it was, and is being treated laughably right now is because you seem not to be aware of how open source works. First you come in expecting the world to be handed to you on a plate, then you throw threats around.. Not really conducive to a helpful response. And that's going just by your posts, I have no idea what you emailed to the team.
Quote:Pretty much that's it in a Nutshell. Ya offer a Hack version and a clean version? Is that how you're trying to say it?No, they offer the version that's available via the download option. The problem here is that you didn't get the package via that method, you relied upon a 3rd party source who didn't update the version they were using with their script installer.
As Acrylian said, this is the first major exploit/security hole there has been with zenphoto in 5 years, and it was in a plugin (from a different 3rd party source) that was being distributed.
Everybody can understand that you're upset, most of those affected were frustrated too, myself included. The reason your reception was handled the way it was, and is being treated laughably right now is because you seem not to be aware of how open source works. First you come in expecting the world to be handed to you on a plate, then you throw threats around.. Not really conducive to a helpful response. And that's going just by your posts, I have no idea what you emailed to the team.
Member
Must be an In-Law. Originally I came in just pissed, as anyone would be. After getting ragged on at the get go... puts a different taste in your mouth. I wasn't the one to initiate the mud slinging, name calling & innuendoes, But I am perfectly capable of fending for myself, without bringing the rest of the gang in. My next stop is download sites. People do read the Pro's and Con's, I have one for them to read.
Administrator
@micheall: His mail was similar to his first post and I replied with links refering to this topic and the news section where the issue is explained. Hoping he will understand. Although we normally do not answer support mails at all (well, I do mostly...).
He was a little insulting in tone about his loss of rank and "our script bringing him in this position" so I could not resist to reply in a similar tone. I probably should have just ignored that but I am just a human, too... But regardless I provided links to the news and this topic. And referred to the installation page so he can learn what to remove to uninstall Zenphoto. Next he does is posting the same complaint on the forum apparently without reading the links I sent him.
Btw, the security hole technically was even a plugin within a plugin.
He was a little insulting in tone about his loss of rank and "our script bringing him in this position" so I could not resist to reply in a similar tone. I probably should have just ignored that but I am just a human, too... But regardless I provided links to the news and this topic. And referred to the installation page so he can learn what to remove to uninstall Zenphoto. Next he does is posting the same complaint on the forum apparently without reading the links I sent him.
Btw, the security hole technically was even a plugin within a plugin.
Administrator
@baddco, you either don't understand or don't want to understand how open source works. And you probably don't code yourself. It was not our code that was the cause (all lenghtly explained already....).
You are always installing open source software on your own risk. If you don't want that use commercial software and pay the big bucks. But even then it will not be always flawless.
Again, it is not that anyone cannot understand that you have been hacked. As micheall said anyone would be. We are the first to admit mistakes we make.
So let's get it straiht: You have been because your provider installed an outdated vulnerable Zenphoto version weeks after the issue had been fixed. We did not install the version and had nothing to do with that install. So the provider did not keep his automatic installer up to date which is his responsibility. Not ours.
It is your tone that also got through in your email you come here as a new forum member. Btw, this "gang" is the Zenphoto community and we did not "call" them...
You are always installing open source software on your own risk. If you don't want that use commercial software and pay the big bucks. But even then it will not be always flawless.
Again, it is not that anyone cannot understand that you have been hacked. As micheall said anyone would be. We are the first to admit mistakes we make.
So let's get it straiht: You have been because your provider installed an outdated vulnerable Zenphoto version weeks after the issue had been fixed. We did not install the version and had nothing to do with that install. So the provider did not keep his automatic installer up to date which is his responsibility. Not ours.
It is your tone that also got through in your email you come here as a new forum member. Btw, this "gang" is the Zenphoto community and we did not "call" them...
Member
It's no matter. I was upset when I came in, was looking for help, and promptly got ragged on. Who wouldn't have a tone or attitude. It's like a huge clique, and most are on the wrong side of the fence. I do support Open Source by the way, Ubunto rocks.
If it's my provider that had a bad on them, think of it as this... If General Motors produced a weeks worth of cars with brakes that failed after 15 miles, would they be forgiven for producing cars after that point with brakes that worked? Just blowing off what was already out there? Same deal.
If it's my provider that had a bad on them, think of it as this... If General Motors produced a weeks worth of cars with brakes that failed after 15 miles, would they be forgiven for producing cars after that point with brakes that worked? Just blowing off what was already out there? Same deal.
Member
No, we think of it more as:
Well, I found this inexpensive car in Mexico. Bought it from this guy who also had a whole bunch of great bargan watches hanging from the inside of his coat. It was a Corvair at a really good price.
Unfortunately, I had an accident driving it. Damn GM for making an unreliable car. Certainly not my fault that the problems with this vehicle have been well documented for some time. They should have found and fixed each and every one of them so that some person like me would not get hurt.
Remember my last post. Guess The answer is "the latter".
Well, I found this inexpensive car in Mexico. Bought it from this guy who also had a whole bunch of great bargan watches hanging from the inside of his coat. It was a Corvair at a really good price.
Unfortunately, I had an accident driving it. Damn GM for making an unreliable car. Certainly not my fault that the problems with this vehicle have been well documented for some time. They should have found and fixed each and every one of them so that some person like me would not get hurt.
Remember my last post. Guess The answer is "the latter".
Member
Member
I think at this point the thread has probably served it's purpose. baddco wants the publicity of his "horrible experience" with Zenphoto, we've already established that his blame really should be upon his host for not keeping their automated install scripts updated. On top of that he claims that he reads reviews etc before installing, so he should have been aware of the exploit (as it was documented and resolved two weeks before his first post). The only thing we're doing at this point is feeding a troll, so I for one will stop after this post.
However, as baddco did make one final analogy to try and assert his point, I'll respond to that then I'm done trying to explain reason.
@baddco, you bring up GM and cars etc. What happens when that situation happens? GM issues a recall, right? And then it's up to the end user to get their device fixed. Zenphoto issued a news post, more than one actually, as well as resolved the issue within an acceptable amount of time. Whether or not you responded to the "recall notice" (read in your news on your overview page that there was a security risk, or even the news page on the site, or even the forums here).
Another thing to factor in that you may not have at this point, English is not a native language for many of the people on the forums here. Sometimes you may perceive something that truly wasn't there or intended the way it was perceived.
At this point, you're obviously done with Zenphoto which is truly sad. I've worked with the other gallery options out there and Zenphoto by far is the easiest to work with which is why I use it.
I'll make you an offer, and I truly do hope you take me up on it. If you want to give zenphoto another shot, I'll help you get it installed (not from the auto-installer you used previously) so you're using the most up to date, and I'll even try to help you if you have any issues past that, at least point you in the right direction. If not, no loss either way, just hate to see you resort to bloated over-weight scripts like Gallery or Coppermine etc.
Take care, and remember, not everything you read is intended the way you read it, especially on the internet.
However, as baddco did make one final analogy to try and assert his point, I'll respond to that then I'm done trying to explain reason.
@baddco, you bring up GM and cars etc. What happens when that situation happens? GM issues a recall, right? And then it's up to the end user to get their device fixed. Zenphoto issued a news post, more than one actually, as well as resolved the issue within an acceptable amount of time. Whether or not you responded to the "recall notice" (read in your news on your overview page that there was a security risk, or even the news page on the site, or even the forums here).
Another thing to factor in that you may not have at this point, English is not a native language for many of the people on the forums here. Sometimes you may perceive something that truly wasn't there or intended the way it was perceived.
At this point, you're obviously done with Zenphoto which is truly sad. I've worked with the other gallery options out there and Zenphoto by far is the easiest to work with which is why I use it.
I'll make you an offer, and I truly do hope you take me up on it. If you want to give zenphoto another shot, I'll help you get it installed (not from the auto-installer you used previously) so you're using the most up to date, and I'll even try to help you if you have any issues past that, at least point you in the right direction. If not, no loss either way, just hate to see you resort to bloated over-weight scripts like Gallery or Coppermine etc.
Take care, and remember, not everything you read is intended the way you read it, especially on the internet.
Member
Thank You Micheall, there are cool people here. That I respect. I do believe you are sincere. I would take you up on your offer, but I didn't need anything that involved originally. I only intended to display retired Splash Screens. Had I known what I was in for then, I would have passed it up then. If I had hundreds of images to display, I'd go with your offer, but as of now there are under 25, I can put them in a simple table.
I'm not a glory seeker, quite the opposite. But when out of the starting gate get called an idiot, you ( I ) get an attitude. I do wish most, not all.. a good Holiday Season. And as you mentioned, I do believe the thread has terminated.
Thank You
I'm not a glory seeker, quite the opposite. But when out of the starting gate get called an idiot, you ( I ) get an attitude. I do wish most, not all.. a good Holiday Season. And as you mentioned, I do believe the thread has terminated.
Thank You
Administrator
Maybe we just got a really bad start... It is well known that written text in mails etc. easily can be missunderstood and also it is probably not a good idea to write support request when "heated up". I know that by myself. (And yes, English is not my native language, too).
Junior Member
Hi,
I got the same problem where the Zenphoto installation got hacked (by the time I was ready to update to the latest, the deed had already been done). This took out all my Wordpress installations as well (should have done the update earlier).
Now, I am slowly restoring all the blogs, but also wanted to ensure that this does not happen again. I tried searching for information on how to keep each blog / Zenphoto installation separate on my hosted account (I host at Hostmonster) so that one hack does not affect the others, but so far d not have any clear clues on what to do. If somebody can provide guidance, I will be grateful.
I looked at the forums, but could also see the bit about security settings for files / folders to be set as 644/755
I got the same problem where the Zenphoto installation got hacked (by the time I was ready to update to the latest, the deed had already been done). This took out all my Wordpress installations as well (should have done the update earlier).
Now, I am slowly restoring all the blogs, but also wanted to ensure that this does not happen again. I tried searching for information on how to keep each blog / Zenphoto installation separate on my hosted account (I host at Hostmonster) so that one hack does not affect the others, but so far d not have any clear clues on what to do. If somebody can provide guidance, I will be grateful.
I looked at the forums, but could also see the bit about security settings for files / folders to be set as 644/755
Administrator
Well, if you have one hosting account/server with serveral sites/installations of several CMS a hack that gets into that account can affect all. That is what happened with these hacks.
If you say that happened after you upgrade Zenphoto the cause of your hack might have been another system/install you had. As far as I read on the net that weeks/months ago the same hackers that exploited our security hole exploited already others. There are numerous reasons why someone could get in.
If you say that happened after you upgrade Zenphoto the cause of your hack might have been another system/install you had. As far as I read on the net that weeks/months ago the same hackers that exploited our security hole exploited already others. There are numerous reasons why someone could get in.
Member
So happy to have found this discussion. We got hacked about a month ago and I've been pulling my hair out trying to plug the hole.
We have two Drupal sites on one Bluehost account, and also had three ZenPhoto installs going as well as Gallery2 (since it plays nicely with Drupal). ALL PHP files on the account got filled with malicious code, and most of the .htaccess files were also edited - even in the root. Other random php files with suspicious and random names were also added here and there.
The hacks added redirects that are only called if your site is found through a referrer. Go directly to the site and it looked fine. Redirected to a series of .ru malware sites. Bad news.
After trying everything, I slapped up a splash page and started uninstalling bits and pieces. That's when I found the ajaxfilemanager problem. When ZP was uninstalled, that directory remained, and its permissions (as well as all files inside) were set to 000. The only way to delete the files was to individually change permissions and delete. On one install, Bluehost support had do the killing, as some of the offending files returned as soon as I deleted them in Cpanel.
My suggestion would be to dump tinymce since they are loading you up with bad code. This is unforgivable. This hassle cost me about two weeks of work during the holidays and caused our site to be down.
We have two Drupal sites on one Bluehost account, and also had three ZenPhoto installs going as well as Gallery2 (since it plays nicely with Drupal). ALL PHP files on the account got filled with malicious code, and most of the .htaccess files were also edited - even in the root. Other random php files with suspicious and random names were also added here and there.
The hacks added redirects that are only called if your site is found through a referrer. Go directly to the site and it looked fine. Redirected to a series of .ru malware sites. Bad news.
After trying everything, I slapped up a splash page and started uninstalling bits and pieces. That's when I found the ajaxfilemanager problem. When ZP was uninstalled, that directory remained, and its permissions (as well as all files inside) were set to 000. The only way to delete the files was to individually change permissions and delete. On one install, Bluehost support had do the killing, as some of the offending files returned as soon as I deleted them in Cpanel.
My suggestion would be to dump tinymce since they are loading you up with bad code. This is unforgivable. This hassle cost me about two weeks of work during the holidays and caused our site to be down.
Administrator
Quote:My suggestion would be to dump tinymce since they are loading you up with bad code. This is unforgivable.Maybe you should read the whole topic and also the posts on our news section about this. Then you would know that it was NOT the fault of TinyMCE but another 3rd party plugin FOR TinyMCE we just used (it is NOT the file manager moxicode provides as a paid tool naturally). The issues have been fixed for 1.4.2 and the file manager has been made optional.
So, we won't be dropping TinyMCE. But you are free to write a plugin for any other editor you like as well.