It'll Never Fly » tng http://wqoq.com Clever... not good, but clever. Thu, 20 Oct 2011 19:50:06 +0000 en hourly 1 http://wordpress.org/?v=3.3-beta1-18972 Survey says…! http://wqoq.com/2007/05/18/survey-says/ http://wqoq.com/2007/05/18/survey-says/#comments Sat, 19 May 2007 02:29:28 +0000 Bob http://wqoq.com/2007/05/18/survey-says/ I’ve updated my genealogy site. New version of PHP and new version of TNG. Looks pretty snazzy, even if it is just using one of the pre-made templates. The data is still from 2004, but the site is all new like.

]]> http://wqoq.com/2007/05/18/survey-says/feed/ 0 Neat! I was hacked. http://wqoq.com/2007/05/16/neat-i-was-hacked/ http://wqoq.com/2007/05/16/neat-i-was-hacked/#comments Thu, 17 May 2007 03:01:56 +0000 Bob http://wqoq.com/2007/05/16/neat-i-was-hacked/ My non-blogging site, rjmaguire.com, that mainly hosts my genealogy stuff, was hacked recently. The perp found an underground published security hole in the 3rd party genealogy software I use called TNG: The Next Generation. I found a message on their support forums that describes how to close the hole and now it has. I’ve also replaced the damaged file (as they at least were kind enough to only do a minimal amount of damage).

I don’t blame the author of the software or the PHP programming language. It was an easy mistake to make. I still intend on using the software (and upgrade to the newest version even). It was my own fault for not keeping a closer eye on the server logs and on the TNG mailing list to notice that this kind of thing was going on.

I haven’t actually been able to pinpoint the exact day or time when the hack occurred. The first attempts began in mid-March. I don’t think the hack actually occurred until just a few days ago, when I noticed the page on my site was posted in a Spanish-language forum as a badge of honour as it were. Thankfully, the kids trying this stuff out aren’t really that bright, as witnessed by a lot of failures to even copy and paste correctly.

One of them actually managed to copy a couple of executables that looked like IRC server software or something, but was undoubtedly stopped cold when it had no chance of running on my server’s architecture.


These are the IPs of the machines from which these kiddies attempted their hacks, followed by the URLs where they hosted their payloads:

Update (18 Jul 2007): I’ve created a quick and dirty live feed of hack attempts and the external links from where the attack scripts are being hosted, seeing as I’m still getting the odd attempt now and then…

Update (15 Sep 2007): List removed since it’s grossly out of date.

]]> http://wqoq.com/2007/05/16/neat-i-was-hacked/feed/ 8