Electric Scotland site issue

[Alastair]

You'll know we were hacked and we've continued to try and resolve the issue as it happened a couple of times since.

We think we have a solution but it's going to take some hours to resolve it as we need to uninstall our site border software then do a clean install plus change our passwords. Due to the issues I have no access to publish to the site. I am hoping we will be fully operational by late afternoon today.

Of course once we're fully back again we'll just have to see if this person is still getting back in.

So right now the site is available to you although apart from the index page you'll find the borders missing on all pages including our menu.

Alastair

[Rick]

Re: Electric Scotland site issue

Thanks Alastair, and a pox on all online predators, hackers and trolls!

[Alastair]

Re: Electric Scotland site issue

Well sites are back up to what they should be so hopefully that will be the end of it.

Only problem left is that I can't get onto the site to publish anything <sigh> and so might take another day to find out what the problem is and get it fixed. The only upside is that there is plenty to read on the site while you're waiting for me to get back in <grin>

Alastair

[Alastair]

Re: Electric Scotland site issue

To give you an update on our server issues I can tell you after extensive analysis we've found a php program running that is generating a denial of service attack on our domains. In contact with Microsoft and PHP we are downloading a program from Microsoft that will run on our server which will find this and any other issues and remove them and close the back door they are using to get onto our server. Microsoft have told us that this will take a while to run as it is a very detailed scan and will likely need to be run more than once.

Our longer term solution to this is to build a new server with the latest release of Windows server. We currently use 2008 but we'll at least move to 2012 as our Front Page extensions will run under 2012 but not yet 2013. Our plan is to ensure we have all the latest releases of our various software and prior to bring up the new server we will run the various bit of software to check we are clean. We are also taking steps to close up the server so any admin tasks can only be done locally by the administrator.

These things really take longer than they should as Steve is a full time contractor in his day job and has the contract to repair a whole block of rented properties so if we have an issue he may be in the middle of pumping water out of someone's basement and obviously can't leave that.

He's intending to take a week off to build the new server but in the meantime we hope the Microsoft download will fix the issue. I might they are sure it will but it could take more than a day to run it through the server until it comes up clean.

In the meantime, while I am seriously challenged to add new content on the site, I am able to add the odd item and continue to publish new chapters of books that are currently being published.

So sorry for all the hassles but looks like a solution in now on the horizon.

Alastair

[Ranald]

Re: Electric Scotland site issue

Thank you for the update Alastair

Even the menu heading for the home page can take nearly one minute to load.

Looking forward to 'back as usual' ....

Regards

Ranald

[Alastair]

Re: Electric Scotland site issue

We had to also disable the Front Page extensiions which carry our menu and advertising. As it's no gone midnight I assume this program is still running so likely the morning my time before we get them back up. I will say the index page still does carry the man menu so you can always refer to the page to get the menu and the site search engine.Alastair

[Ranald]

Re: Electric Scotland site issue

Hi Alastair and Steve, looks as if we are nearly back to normal, thanks to all for the work.

I note that when trying to look at or download a book, it times out before to book is even shown.

Regards

Ranald

[Alastair]

Re: Electric Scotland site issue

We have been working throughout the day and we have isolated the problem to the ES main site. One bit of news we got is that we are going to get some new bandwidth. At the moment we are on 16/2 but we're going to 50/10 around mid week so that's a LOT faster.

Something is running on our ES main site but as it's so large it's very hard to find it as it's obviously hidden away. Right now we think it may be a PHP program but whether it's attached itself to one we run or is standalone we don't know. We are right now in the process of adding back our Front Page Extensions as we uninstalled these to see if they were causing the issue but they weren't so they are going back so we can get back the menu and our advertising.

The Microsoft program did spot a couple of security holes so they are now plugged. They did say that it is perfectly possible for someone to have installed a program on our site a year ago and now just activating it.

We found someone at Comcast who seem to know what they are doing so they are going to check the logs on our Router to verify the IP address that has the issues and see if they can identify anything that might help us. It was that guy that noted we were incorrectly flagged as a residential account and hence the reason we were not provided with the speed upgrade.

I will note that when we stopped all services on the server and then brought them up individually this community was very quick. I came up like greased lightning!!! This means once we have sorted this out and build the new server we are going to look at leaving this software on the old server so it has it's own dedicated one to run on.

So the next thing we are doing is to remove all php programs on the service other than the postcard and genealogy programs. Over the years we have installed a number of those but many didn't make the grade so were never implemented fully so it may be one of those where someone has got in. We do routinely upgrade programs any time there is a security release.

So that's where we are currently.

Alastair

[1938 Observer]

Re: Electric Scotland site issue

I know what is , Our fee for "Halal" certification has not been paid.:tongue:

[Rick]

Re: Electric Scotland site issue

Thanks Alastair, the site seems to be fine tonight and I learn more about computers from you than from my own IT department!

[Alastair]

Re: Electric Scotland site issue

We've at last found the problem!!! And of course why we didn't check this earlier I know not as it now seems obvious but hind sight is a great thing.

We're working with a company called Ezoic which I mentioned in the newsletter a couple of weeks ago. To enable the service we had to change our DNS. So last night we reverted to our own DNS and by magic all is working again!

We still want to work with them so we'll need to talk to their technical people to ensure this doesn't happen again.

You can read an article about Ezoic at http://vator.tv/news/2013-11-13-webs...zoic-lands-56m

It's been absolutely hell for me over this past four days trying to resolve this issue and certainly lacking a lot of sleep in the process.

Alastair

[Ranald]

Re: Electric Scotland site issue

Hi Alastair, now that all the hard work, has given he links of the site, the best speed ever, I trust that you will be able to 'catch up on your sleep.

Thank you.

Ranald