<a href="/link-to-us" title="Link To Us" rel="nofollow">Link To Us</a>
<javascript>
super_scary_exploit_code_that_tells_your_webbrowser_to_download_and_install_a_tr
jan_backdoor
</javascript>[/code]


But yeah, Ive been holding off on commenting on this because I was hoping overlords.lu would provide more info.. right now the most interesting thing about this to me is that they found logs of access from Czech ip space. The fact that the attackers didnt or couldnt sanitize the logs is somehow reassuring.

What I was commenting on at Boris re: IPS was the need to look beyond "oh we need to patch this" and address preventing issues that might come up in the future by crippling the entire attack vector (exploiting the relationship between the face-forward application and the database). An IPS is a good first step there; it examines all the transactions between the DB and the Forum (or what have you) and anything that looks potentially hostile gets censored.

But yeah without some logs and shit, who knows what went down.