No access to admin after conference!

[tlove]

Hello,
The conference finished yesterday and today when I try to log in as conference manager I get a blank screen and no access.

The URL is http://www.designoutcrime.org/ocs2/inde ... login/signIn
The problem occurs in all the browsers I've tried: IE8, Firefox 3.5.5 and Chrome 3.0.195.33

I'm guessing, as it aligns with the conference finishing, that there is a date setting incorrect but I haven't the faintest which bit of the database to edit!

Any ideas on how to fix this? Its really urgent on a number of fronts.

My apologies, I just posted this question in error to the general OCS discussion forum before realizing it is a technical issue.

Best wishes,
Terry

[tlove]

The OCS site was linked to via a Joomla website. The Joomla part of the website was extensively hacked yesterday with code injections.I haven't had time yet to check the OCS website for code injections but I'm presuming the OCS php code will also be badly compromised. .
I'd welcome expert advice on three things:
1. Is there a straightforward way to search for code injections in the mysql database
2. Are there any reports of a security risk via scripts being uploaded with documents into the ocsfiles upload directory and then being activated from there?
3. Are there particular security weaknesses I should know about in OCS?
Best regards and thanks in advance,
Terry

[asmecher]

Hi Terry,

I'd be extremely surprised to see anything in the database; chances are very good that you'll need to worry about your PHP scripts and nothing more. I'd suggest doing a full comparison (using e.g. the diff tool) of your installation against a stock version of OCS. Review the diff file for evidence of tampering and reverse the parts of the patch that represent hacking.

Your files_dir should be located outside of your web root so that it cannot be accessed directly by the server. This is recommended in our documentation and should already be the case. This way, harmful files like PHP scripts cannot be uploaded via the OCS interface and then invoked remotely. It also provides secure storage of your documents, i.e. so that unreviewed documents can't be downloaded via the browser without going through OCS's access checks first.

OCS has no known security problems; we do our best to make sure that our apps are secure and our track record so far is very good.

Most attacks come in via automated scans for out-of-date application installs with known vulnerabilities. You can usually find out what happened by looking at the file modification dates of the compromised scripts and correlating that date and time against your request log e.g. for something like a remote include vulnerability. Determining the cause can help determine the extent of the attack.

Regards,
Alec Smecher
Public Knowledge Project Team

[tlove]

Thanks Alec. Great you are good on the security side! Its been a trying time. I had 9 sites down out of 15. Interestingly all on the same hosting provider and none on the other provider. I'd managed to tie things confusingly in knots by accidentally installing OSC 2.1.2 on a site that had previously OSC 2.1.1.2. That gave some strange error messages and led me to think that a table (review.forms) had been dropped. I also revealed that the user table was full of false user entries.
Seems to be ok now except for sorting the header images out.
Many many thanks again. Would be useful to have your message reworked as a security FAQ!
All the best for the holidays,
Terry