Session Start: Sat Aug 17 00:00:00 2013
Session Ident: #glitchpc
[00:00] * Now talking in #glitchpc
[00:00] * Topic is 'Welcome to #glitchpc chat. Profanity, trolls, and impersonation are not welcome here. Street1 has become a Silent Keyboard. http://www.legacy.com/obituaries/savannah/obituary.aspx?page=lifestory&pid=139870551'
[00:00] * Set by jacky on Tue Mar 02 11:03:23
[00:33] * NotNat (nat@mib-921C62AC.socal.res.rr.com) has joined #glitchpc
[00:34] * Nat (nat@mib-921C62AC.socal.res.rr.com) Quit (Ping timeout)
[01:26] * PCdoc (PCdoc@D1BF5531.77B5DD9.EE292452.IP) has joined #glitchpc
[01:59] * NotNat is now known as Nat
[02:00]<Zuwer> Hmm... Really should stop lending money to my sister, she now owes me $800. :x
[02:01]<@BC_Programming> She needs to kick her Crack habit
[02:01]<Zuwer> Nope, make that $900.
[02:02]<@BC_Programming> heh
[02:02] * KindOne (KindOne@mib-CB9A2D69.dynamic.ip.windstream.net) has joined #glitchpc
[02:02]<Zuwer> Heh, it's because she wanted to buy a wireless repeater, and a benchtop oven, and I paid for the repairs for her car.
[02:02]<Zuwer> Better for me to fork out $500 rather than have the drive shaft fall out. :x
[02:03]<@BC_Programming> hmm that's weird
[02:03]<@BC_Programming> my site's FTP is down
[02:05]<Zuwer> Let me be the first to say, it clearly is the government.. Whenever something goes wrong, it is because of them.
[02:05]<@BC_Programming> hmm still works on the cpanel File Browser
[02:16]<@BC_Programming> hmm questionable
[02:16]<@BC_Programming> strange folder and file on my webhost
[02:17]<@BC_Programming> I forget the original folder name, it was like methaline or something, but the file is corisica.php
[02:18]<@BC_Programming> seems like it is some sort of wordpress plugin, could be I just installed one improperly or something
[02:22]<@BC_Programming> nope
[02:22]<@BC_Programming> google's say it's a backdoor
[02:22]<@BC_Programming> hmm
[02:22]<@BC_Programming> guess I need to change my FTP password... I'll check my FTP logs to see where it was
[02:25]<@BC_Programming> Found it.... from May :O
[02:30]<@BC_Programming> hu May 09 13:13:26 2013 0 46.105.161.50 45 /home/bcprogra/__check.html a _ i r bcprogra ftp 1 * c
[02:30]<@BC_Programming> Thu May 09 13:13:30 2013 0 46.105.161.50 45 /home/bcprogra/public_html/__check.html a _ i r bcprogra ftp 1 * c
[02:30]<@BC_Programming> Thu May 09 13:13:31 2013 0 46.105.161.50 21762 /home/bcprogra/public_html/index.php a _ o r bcprogra ftp 1 * c
[02:30]<@BC_Programming> Thu May 09 13:13:31 2013 0 46.105.161.50 20971 /home/bcprogra/public_html/index.php a _ i r bcprogra ftp 1 * c
[02:30]<@BC_Programming> Thu May 09 13:13:33 2013 0 46.105.161.50 20951 /home/bcprogra/public_html/index.php a _ i r bcprogra ftp 1 * c
[02:30]<@BC_Programming> Thu May 09 13:13:37 2013 0 46.105.161.50 2027 /home/bcprogra/public_html/dimethylamine/check.php a _ i r bcprogra ftp 1 * c
[02:30]<@BC_Programming> Thu May 09 13:13:37 2013 0 46.105.161.50 21977 /home/bcprogra/public_html/dimethylamine/corisica.php a _ i r bcprogra ftp 1 * c
[02:30]<@BC_Programming> sneaky bugger
[02:30]<@BC_Programming> in France
[02:31]<@BC_Programming> well... guess I should change my password
[02:31]<@BC_Programming> gah this is going to mean changing it for all sorts of stuff now... oh well
[02:32] * itsjustme (itsjustme@mib-6F91720A.static.bresnan.net) has joined #glitchpc
[02:32] * itsjustme (itsjustme@mib-6F91720A.static.bresnan.net) has left #glitchpc
[02:34] * PCdoc (PCdoc@D1BF5531.77B5DD9.EE292452.IP) Quit (Ping timeout)
[02:35] * PCdoc (PCdoc@D1BF5531.77B5DD9.EE292452.IP) has joined #glitchpc
[02:42]<@BC_Programming> password changed... whew
[02:43]<@BC_Programming> wonder how they got the password :/
[02:58]<PCdoc> wow! google was down for 5mins in morning !!
[02:59]<@BC_Programming> yeah I heard about that
[03:01]<PCdoc> lol obviously, ppl who saw google not opening, they started to check there routers and modems if internet was not working ...
[03:01]<PCdoc> can never think servers of google can go down
[03:50] * BC_Programmer (BC_Program@mib-13715436.no.shawcable.net) has joined #glitchpc
[03:51] * BC_Programming (BC_Program@13DD81E6.53558F13.6889CB60.IP) Quit (Ping timeout)
[03:51] * BC_Programmer is now known as BC_Programming
[03:51] * ChanServ sets mode: +a
[03:51] * ChanServ sets mode: +o BC_Programming
[04:29]<@BC_Programming> ahhh! WordPress was vulnerable, that's how they got in
[04:29]<@BC_Programming> wp-cron
[04:29]<@BC_Programming> disabled it and installed a plugin that secures WordPress Cron
[04:35] * Nat (nat@mib-921C62AC.socal.res.rr.com) Quit (Quit: zzzZZZzzzZZzzZZZzz)
[06:12] * jacky (the_kink@mib-C0298AE8.slsbmd.east.verizon.net) has joined #glitchpc
[06:12] * ChanServ sets mode: +q
[06:12] * ChanServ sets mode: +o jacky
[06:12] * ChanServ sets mode: -q
[06:21] * PCdoc (PCdoc@D1BF5531.77B5DD9.EE292452.IP) Quit (Ping timeout)
[06:21] * PCdoc (PCdoc@D1BF5531.77B5DD9.EE292452.IP) has joined #glitchpc
[06:42] * Kevin (Mibbit@mib-C554203.dhcp.aldl.mi.charter.com) Quit (Quit: http://www.mibbit.com ajax IRC Client)
[06:52] * BC_Programmer (BC_Program@13DD81E6.53558F13.6889CB60.IP) has joined #glitchpc
[06:54] * BC_Programming (BC_Program@mib-13715436.no.shawcable.net) Quit (Ping timeout)
[07:45] * kashif (Mibbit@805F46B7.231C1EFA.F02F5F16.IP) has joined #glitchpc
[07:46]<kashif> hello
[07:46]<kashif> ;)
[07:47]<kashif> :P
[07:47]<kashif> :/
[07:47]<kashif> :D
[07:47]<kashif> :(
[07:47]<kashif> :)
[07:47]<kashif> :O
[07:47]<kashif> ;)
[07:50] * kashif (Mibbit@805F46B7.231C1EFA.F02F5F16.IP) Quit (Quit: http://www.mibbit.com ajax IRC Client)
[08:57] * PCdoc (PCdoc@D1BF5531.77B5DD9.EE292452.IP) Quit (Quit: Leaving)
[09:14] * jacky (the_kink@mib-C0298AE8.slsbmd.east.verizon.net) has left #glitchpc
[10:17] * Erlend (erlend@mib-8D855F84.kylatee.kodu.ee) has joined #glitchpc
[12:26] * Nat (nat@mib-921C62AC.socal.res.rr.com) has joined #glitchpc
[12:51] * Craig (ce@68A63EDB.12C040BF.6FA62CE2.IP) Quit (Quit: )
Session Start: Sat Aug 17 13:30:18 2013
Session Ident: #glitchpc
[13:30] * Now talking in #glitchpc
[13:30] * Topic is 'Welcome to #glitchpc chat. Profanity, trolls, and impersonation are not welcome here. Street1 has become a Silent Keyboard. http://www.legacy.com/obituaries/savannah/obituary.aspx?page=lifestory&pid=139870551'
[13:30] * Set by jacky on Tue Mar 02 11:03:23
[13:30] * ChanServ sets mode: +a
[13:30] * ChanServ sets mode: +o ChanbotVII
[14:08] * KindOne (KindOne@mib-CB9A2D69.dynamic.ip.windstream.net) Quit (Ping timeout)
[14:11] * KindOne (KindOne@mib-32D2A45F.dynamic.ip.windstream.net) has joined #glitchpc
[14:33] * pottsi (Mibbit@pottsi.staff.mibbit.net) has joined #glitchpc
[14:33] * ChanbotVII sets mode: +v pottsi
[14:38] * Nat (nat@mib-921C62AC.socal.res.rr.com) Quit (Quit: zzzZZZzzzZZzzZZZzz)
[14:41] * Nat (nat@mib-921C62AC.socal.res.rr.com) has joined #glitchpc
[15:25] * KindOne (KindOne@mib-32D2A45F.dynamic.ip.windstream.net) Quit (Ping timeout)
[15:27] * KindOne (KindOne@mib-A904652E.dynamic.ip.windstream.net) has joined #glitchpc
[15:29] * BC_Programmer is now known as BC_Programming
[15:29] * ChanServ sets mode: +a
[15:29] * ChanServ sets mode: +o BC_Programming
[16:32] * KindOne (KindOne@mib-A904652E.dynamic.ip.windstream.net) Quit (Ping timeout)
[16:35] * KindOne (KindOne@mib-683520D9.dynamic.ip.windstream.net) has joined #glitchpc
[17:11] * Erlend (erlend@mib-8D855F84.kylatee.kodu.ee) Quit (Ping timeout)
[17:28] * Kevin (Mibbit@mib-C554203.dhcp.aldl.mi.charter.com) has joined #glitchpc
[17:29] * pottsi (Mibbit@pottsi.staff.mibbit.net) Quit (Quit: http://www.mibbit.com ajax IRC Client)
[17:33] * Nat (nat@mib-921C62AC.socal.res.rr.com) Quit (Quit: zzzZZZzzzZZzzZZZzz)
[17:35] * Nat (nat@mib-921C62AC.socal.res.rr.com) has joined #glitchpc
[19:06]<jamer> 26% battery XD
[19:06]<@BC_Programming> heh the hacker or hackbot or whatever it is tried to access my wp-cron.php again today
[19:07]<@BC_Programming> this time greeted by a fake "internal Server Error"
[19:08]<@BC_Programming> hmm no Jacky :/
[19:08]<jamer> Lol
[19:09]<@BC_Programming> looks like Chanbot hasn't been able to upload logs since the 15th or something
[19:09]<jamer> O.o
[19:09]<@BC_Programming> I have no idea why but my webhost times out on all FTP requests :/
[19:14]<jamer> O.o
[19:14]<@BC_Programming> That how I found the hack code, since I used the cPanel browser and saw a weird folder
[19:14]<@BC_Programming> diMethyline or something
[19:14]<@BC_Programming> and was like, wtf?
[19:15]<@BC_Programming> looked inside and it was clearly some sort of hack bouncer
[19:15]<@BC_Programming> I investigated by poring over the ftp and http logs and determined that the cause was actually a vulnerability in wordpress
[19:16]<@BC_Programming> deleted the hack code, patched the WP problem, and changed all the passwords, as well as changing my main site to use a specific DB password rather than the same password as the FTP account.
[19:18]<jamer> !w lima ohio
[19:39]<jamer> We caught a tree on fire...
[19:48] * KindOne (KindOne@mib-683520D9.dynamic.ip.windstream.net) Quit (Ping timeout)
[19:51] * KindOne (KindOne@mib-74A3FAF3.dynamic.ip.windstream.net) has joined #glitchpc
[19:56] * KindOne (KindOne@mib-74A3FAF3.dynamic.ip.windstream.net) Quit (Ping timeout)
[19:58] * KindOne (KindOne@mib-4F12B57C.dynamic.ip.windstream.net) has joined #glitchpc
[21:40] * KindOne (KindOne@mib-4F12B57C.dynamic.ip.windstream.net) Quit (Ping timeout)
[21:43] * KindOne (KindOne@mib-5C3FD700.dynamic.ip.windstream.net) has joined #glitchpc
[22:18] * DispleasedS (Mibbit@mib-C8ECDECD.war.clearwire-wmx.net) has joined #glitchpc
[22:19]<DispleasedS> what is this channel about?
[22:19]<DispleasedS> !help
[22:19]<Craig> Whats with you guys and !help, who actually has that command on their bot?
[22:19]<@BC_Programming> I think eggdrop actually has it by default doesn't it
[22:19]<Craig> Seriously, most of the time most bots respond to the word help by itself.
[22:20]<DispleasedS> !weather Seattle, United States
[22:20]<DispleasedS> Cool :D
[22:20]<@BC_Programming> oh Craig btw I think chanbot DOES respond to help
[22:20]<Craig> !help
[22:21]<DispleasedS> !forecast Seattle, United States
[22:21]<Craig> :P touche'
[22:21] * DispleasedS (Mibbit@mib-C8ECDECD.war.clearwire-wmx.net) has left #glitchpc
[22:21]<@BC_Programming> lol
[22:21]<Craig> Its jacky's bot anyway :P
[22:21]<Craig> Really, makes a request then leaves?
[22:22]<@BC_Programming> yeah my FTP is busted for some reason so the bot hasn't been able to upload logs :/
[22:22]<Craig> Are you sure its you and not me?
[22:22]<@BC_Programming> I can't access it either
[22:22]<Craig> Oh heh
[22:22]<Craig> :S
[22:22]<@BC_Programming> I just get connection timeouts
[22:22]<@BC_Programming> interestingly enough, I got timeouts and then used the cPanel file browser
[22:22]<@BC_Programming> say a strange directory in my public_html
[22:23]<@BC_Programming> turns out my site had been hacked through wordpress at some point
[22:23]<@BC_Programming> had to pore through the ftp and http logs to find out how it all happened... seems like it used wordpress to schedule something and was able to execute a script on the host and add files
[22:24]<@BC_Programming> I don't think it's related to my FTP timing out, though.
[22:24]<Craig> Wow, someone actually hacked your site?
[22:24]<Craig> That sucks,
[22:24]<Craig> what did they do?
[22:25]<@BC_Programming> they didn't do anything, the file was never accessed except to create it
[22:25]<@BC_Programming> the file was a bouncer
[22:25]<Craig> Strange
[22:25]<Craig> Bouncer?
[22:25]<@BC_Programming> you passed in a URL and it would retrieve the contents of that url on the webhost and then serve it from the host itself, so it was basically working as a proxy
[22:25]<Craig> Ahh
[22:26]<@BC_Programming> also it tried to do something to index.php
[22:26]<Craig> ?
[22:26]<@BC_Programming> but apparently I was also making changes at the time, so when I saved my changes it overwrote whatever was done
[22:26]<Craig> hahahahah nice
[22:27]<@BC_Programming> This happened all the way back in May apparently
[22:27]<Craig> Wow
[22:27]<@BC_Programming> I deleted it, changed all the appropriate passwords, and patched the WordPress wp-cron issue
[22:27]<Craig> Crazy
[22:30] * Nat (nat@mib-921C62AC.socal.res.rr.com) Quit (Quit: zzzZZZzzzZZzzZZZzz)
[22:32] * Nat (nat@mib-921C62AC.socal.res.rr.com) has joined #glitchpc
[23:42] * KindOne (KindOne@mib-5C3FD700.dynamic.ip.windstream.net) Quit (Ping timeout)
[23:46] * KindOne (KindOne@mib-1D5E58B2.dynamic.ip.windstream.net) has joined #glitchpc