Hacked again - site is sending emails

My site has apparently been hacked again.  It is sending messages to everyone with just the header, and no content.   I don't believe this was done by a member, but was somehow done externally.  The last time this happened I was told here this was not possible, but it just happened again.  I just upgraded the to 7.0.4 - the spam protection version, before this happened.  Does anyone know why this is happening, and what I can do to secure my site?

Rob

MOTHER CRAP!!   It is doing it again.  My site is spamming my own member.    No one responded to this post and  Boonex hasn't responded to my support request.  I even bought support credits and that didn't work.   I just got the Periodic Report and am collecting the bounces - it is sending messages from the site, but with a blank header and body as it did before.  I am really pissed that this is doing this, and will likely be blacklisted soon.  Is there anyone out there who knows how to keep our sites from sending spam?

if you own a VPS

start here

http://adminspot.net/topic/615-how-to-secure-your-vps/

abt. securing Dolphin, i dont know, i just started myself with it.;

Not a VPS - just a regular old shared server, however it has never been a problem before.  I think this has something to do with the software.

This is still happening.   Members get emails from the site with blank subject and nothing in the body text.   I have come to the conclusion it only happens when I go into the admin area, even if I do nothing related to sending mail.   Today I just changed a few language keys.  Something happens were it then cues up a bunch of messages and they get processed by chron.   Does anyone even have a theory of what might be wrong?  If I can't fix this, I at least need to disable it somehow.

Rob

Have you looked though all the email templates @ administration > Settings > Email Templates  to see if there's an entry with no Subject or Body?

Some third party mods add email notifications.... maybe some mod you installed/uninstalled left some strange remnants.   You can also look in the db table sys_email_templates to see if anything looks unusual.

No, it wasn't any of those things, and apparently I can't even go into the admin for my site anymore because it starts sending out those blank messages.  The piece of crap.   Does anyone have any other ideas on how I can fix this or at least turn it off.

Rob

While you are troubleshooting your issue, remove the cron job for your website. It will not send the emails if the cron job is missing.

Yeah, that will turn the rest of the site off, and I think it works for everyone else.  I'll have to turn off chron every time I use admin I guess.  Any idea what I should even look at?

Honestly, I have no idea how going into your admin panel could 'queue' blank emails to all your members. Do you have ANY 3rd party modules that are used to send emails (like the default Mass Mailer)? It sounds like something (that may no longer exist) may be 'resending' emails to your members. Of course if the module did not remove properly or has 'floating' files/code it still may be trying to function.

An example, I had installed a module from ESASE then removed it, but every night at 3AM I get a database error from it.

If you have not made any recent code changes to your files, you could search through the directories (like /inc ) to see if any files have been modified lately.

I haven't done any major mods of anything related to email on this site.   I may have disabled a block of code to prevent cupids from going out.  Also, I can't remember if it was D6.1 or an early D7 - but we were having trouble with the mass mailer not sending to people who didn't have birthdays in the system - and I think someone came up with a minor fix.

I am pretty sure these preceded the blanks going out.  This is a weird one.

Change your SSH port and all passwords

I did change the passwords fairy recently - but not the SSH port - what is your theory?

This just makes me want to cry.   I just activated an account on my site - being careful to disable the chron first - a huge pain in the ass.  It didn't make any difference - my site spammed everyone anyway.   This is completely humiliating, especially given the years I have spent trying to make this crap software work, and it looks like my site is being black listed all over the place.

My piece of shit site at  http://caltrade.com/community is spamming the shit out of everybody again.   I am totally humiliated by this - there is NOTHING more pathetic than spamming your own members.

I wrote a ticket for this but Boonex staff told me to change the FTP passwords then closed the ticket.  I changed those passwords but I know that wasn't it.  This usually only gets activated when I am in the admin panel, and since it had worked a few times, I had a brief moment of hope that this might actually work.  

I am some combination of heartbroken and disgusted right now, and I no longer have any idea of what to do.

@caltrade,

do your emails look like this:

To:

Subject: =?UTF-8?B?TWF0Y2ggTm90aWZpY2F0aW9u?=

Content-type: text/html; charset=UTF-8

MIME-Version: 1.0

From: =?UTF-8?B?RXogU3VycGx1cyA=?= <you@youremail.com>

Message-Id: <E1QRcbF-0008H6-Rc@>

Date: Wed, 01 Jun 2011 00:00:05 -0400

<html><head></head><body style="font: 12px Verdana; color:#000000"> <p><b>Hello angelasmile</b>,</p>

<p>We are glad to inform you that a profile was added or modified at http://yoursitename.comthat matches yours.</p>

<p>Match profile:<span style="color:#FF6633"><a href="http:/yoursitename.com/bella487">http://yoursitename.com/bella487</a></span></p>

<p>Your Member ID:<span style="color:#FF6633">500</span></p>

<p>--</p>

<p style="font: bold 10px Verdana; color:red">Your Site Title Here  mail delivery system!!!

<br />Auto-generated e-mail, please, do not reply!!!</p></body></html>

DosDawg, they are completely blank.    I will get the alert that chron has been set off, and is sending messages.  Then in my spam folder I will find the bounces.   They will have the correct "from" - "California International Business Community" and my return email address, but the rest of the message, including the subject line will be blank. 

Thankfully, Alex is looking at this again as well.  I get a little freaked out when my site is spamming - it is much different from things just not working. 

 You was right, some template was missing on the database.

 AlexT,

can you provide us with a list of what templates were missing? and what steps you took to rectify the situation? 

Ok, I only posted on this issue multiple times over the last few months. My site still does it. How was it resolved?

Just got back from work.  I checked the templates from the control panel before and everything looked to be in order - I'll will review the instructions Alex sent me and report back.  It will be a big relief if this is finally resolved because it was a huge disincentive to even work on my site.  Who wants to work on something if the result is more spam?

@SkyForum - I remember you saying you had this problem as well.  What is weird about it, is how intermittent it is.  I'm still not clear why blank messages would cause this - or how they got there in the first place, but a fix is a fix.

This site still has issues with cookies. LOL Had to click on my "account" link here to refresh the cookie so i could continue to post here. New look, same problems I guess.

I checked the sys_email_templates table in my database. All i found was a duplicate entry.

t_sbsWallUpdates... They are identical except for the ID #'s, 150 and 151. I am wondering if it would be safe to delete one of them. I found no other empty ones or any that appeared to be out of place outside of those two.

Ok, I'm back.    Alex says: "Templates with id=9 is missing this is the reason it sends empty emails".   So where do I find this - and more important, how do I correct?  

As I mentioned, I looked at the settings/email templates and everything seems to be in order.   So I looked at the database as SkyForum did.   Alex is correct - there is no template 9.  Does this mean I need the sql code to put template 9 back and everything will be fine?   I don't understand the theory as to why an missing template would cause this behavior, but if this fixes it I will be much relieved.   Could someone advise me how to put that back in.  

The 9th email template concerns cupid mails (according to my demo database). I grabbed this from the v70.sql file:

INSERT INTO `sys_email_templates` VALUES(9, 't_CupidMail', 'Match Notification', '<html><head></head><body style="font: 12px Verdana; color:#000000">\r\n<p><b>Hello <RealName></b>,</p>\r\n\r\n<p>We are glad to inform you that a profile was added or modified at <Domain> that matches yours.</p>\r\n\r\n<p>Match profile:<span style="color:#FF6633"><a href="<MatchProfileLink>"><MatchProfileLink></a></span></p>\r\n\r\n<p>Your Member ID:<span style="color:#FF6633"><StrID></span></p>\r\n\r\n<p>--</p>\r\n<p style="font: bold 10px Verdana; color:red"><SiteName> mail delivery system!!!\r\n<br />Auto-generated e-mail, please, do not reply!!!</p></body></html>', 'Cupid mail template', 0);

Thanks for digging that up - makes sense, because I probably removed that template - eons ago during D7.0 - so it would stop sending cupid emails.   As I now recall, that was the advice giving at that time to get the site to stop sending them.   So if I put that back in, how do I keep it from sending the cupids again?   Have better controls for that been put in yet?

At least this means there is sort-of a theory of why this is may be happening.  Those blank messages were maybe the cupids, but with no content?  Not sure, because it would send out hundreds every time it went off.  Also doesn't explain why my being in the control panel seems to set it off. 

Administration > Settings > Advanced Settings > Matches

You should uncheck all options under that category. I recall having to set the percentage to an outrageous amount on the last option, but this is based on ancient information from when these forums ran on vinyl.

I think I remember unchecking all that stuff, then either setting the percent to something outrageous or tying to (it may have forced me to accept a 99 percent number) - that that it would send out those matching emails right and left everywhere anyway.  All we were trying to do at the time was find an "off switch" - did they put one in yet? 

Ok gentlemen, do we have a final frikkin solution for this most annoying of problems?

The way I see it, it has to be some weird structure that still tries to make a match even with that service turned off. Of course, with it off, there is no information to put in the email but it sends it anyway! God damned computers,.(excuse my vernacular in that last line but crap this is exasperating!)

Now let me add some stuff to the pot. I had one member that this always seemed to happen too. She has been on sabbatical for the last few months and during that time, we have had NO utf8bcrap emails. She just came back a few days ago and logged back in. GUESS WHAT! everyone is getting these things again.

I have gone in and set the match strength to 100%. We'll see if that has any effect. They were at the default 85% because I didn't think it mattered BECAUSE I TURNED THE STUPID THING OFF!!!

Hope its all sorted Rob... I like your sites... I know, dolphin makes me wana cry too.... often...

Put it this way... I'm a lot greyer than I was when I started this lol.

Nathan

I never removed my cupid email tables... I just checked and they are still there. I am also still experiencing the same problem. I also turned off matchmaking some time ago (in fact, I've never had it on in the first place)

I do not see the fix. I still have the emails. I have checked my database and all seems ok.

Does Member Expiration ring a bell?

It's the only email template with no content by default. Could it be sending an email with no subject because there is no subject because it is disabled? Also, there would be no content if you don't create the content right?

I'm at a loss. Going to put some content in that template and see what happens.

Ok, let me ask a question. I did go through each one of these email templates some time back and customize them to meet the needs of my site. Is it possible that an error (a typo) in one of them can cause the email template to fail?

I think I found it.

'Friend Request Accepted', ID-55 is missing from sys_email_templates

I've got 2 mods I use to solve the problem of no one being able to make friends when they join a Boonex Dolphin site. I'm not sure why this would be removed though. I never removed it intentionally. Could that be it?

F***ng A, that's gotta be it@!

When someone joins my site, they can select to be auto friended with a bunch of people that allowed it in their profile.

Or they come to the front page and click on my 'make friends' link and become a bunch of peoples friends all at the same time!

That means, all those people are going to get a freind request accepted email! BUT THEY CANT because the template is missing!

Csampson, are you using the auto friend mod from anya kates?

@ SKY .....................dang it man I am not...................................

Well, for me I think this is my problem. I went through all the install files for all the mods I have on my site and I cannot explain why this table is missing. All I can think is someone manually removed it. Maybe it was a conversation with Anya about how to stop the emails to my members because of the mod and that was the reason she removed it. I'm just not sure. All I know is it's missing.

The concept makes total sense. If there is no template, a blank email with the UTF8 subject line will go out to whomever the mod sends it to anyway.

If I were you, i would download a copy of the install file, open up the sql install file and compare the sys_email_templates table list to the one installed in your database. I'll bet you find a missing one.

Now, for the coders, I need help. I am not a brain surgeon when it comes to databases. I got this from the original sql install file, can I just run this as a query in my database to replace the table?

INSERT INTO `sys_email_templates` VALUES(55, 't_FriendRequestAccepted', 'Friend request was accepted', '<html>\r\n<body style="font: 12px Verdana; color:#000000">\r\n    <p><b>Dear <Recipient></b>,</p>\r\n    <br />\r\n    <p><a href="<SenderLink>"><Sender></a> accepted your friend request.</p>\r\n    <br /> \r\n    <p><b>Thank you for using our services!</b></p> \r\n    <p>--</p>\r\n    <p style="font: bold 10px Verdana; color:red"><SiteName> mail delivery system!!! \r\n    <br />Auto-generated e-mail, please, do not reply!!!</p>\r\n</html>', 'Friend accepted request message', 0);

phpMyAdmin -> Database -> SQL (tab at the top of the page)

Enter the full query into the box and run it.

Thank you

YES! It absolutely fixed it.

My members still receive an email but now they get the one telling them that their friends request has been accepted, lol.

On my site, I have an auto friend mod. Most people that join automatically become friends with everyone else. That's why the problem was so pronounced for me. I was sending a LOT of these empty emails. I think that most everyone else that uses Dolphin has this problem but because their sites are small and the friendships are not automatic, their system is not sending out these emails at a level that makes it really noticeable. Most people just ignore this kind of email and even in my case, only about 10 members out of 600 were really ever complaining about it. Most people accept is as just a random blank email, they delete it and forget about it.

Everyone needs to check their database, even if they haven't heard of this problem on their site yet. If you aren't savvy enough to mess with your database, you can just check to see if you have the following email template in Administration/Settings/Email Templates = "Friend accepted request message ". If the email template isn't there, then it's missing and you need to add it back into your database.

The real question remains though. How does it get deleted in the first place??

 Gremlin's