The Risk of Forum Hacking

[CountryBoy]

I was flitting around my bookmarked sites and found that one of the forums I'm a member of, Intellect Today, had been hacked. The hacker had left a message in place of the forum.

I don't know much about this sort of thing. How much of a risk is hacking to the average forum owner and what can you do to decrease the risk?

[grim]

Keep your software up to date, both the forum software and your operating system, control panel, etc.

Use hard to guess passwords. Have a firewall with mod_security installed, try to clamp down your server as much as possible for starters.

[Hurley4540]

Having a strong password would stop them from cracking your user..

[benjaminp]

Having a strong password would stop them from cracking your user..

Not really, you also need to think about cookie stealing. I'm no expert in the matter to be honest but there are more ways to get a password the bruteforcing.

CountryBoy I would listen to all of grim's advice but also try not to make enemies online, although there are just skiddies who go around looking for vunerable versions of scripts.

[CountryBoy]

CountryBoy I would listen to all of grim's advice but also try not to make enemies online, although there are just skiddies who go around looking for vunerable versions of scripts.

I'm just talking hypothetically here guys. It's never happened to me.
Me... make enemies? Never!

[benjaminp]

I'm just talking hypothetically here guys. It's never happened to me.
Me... make enemies? Never!

Oh I wasn't suggesting you had, I was just suggesting you don't

[Hurley4540]

Oh true, never thought about cookie stealing..

[Colleen]

That site is running, vBulletin 3.7.0 Release Candidate 4, I guess anything is hackable.

Kalina added 1 Minutes and 40 Seconds later...

They more than likely injected the style via the database, how, I don't know.

[sparks man]

he not hack all the site
he change the first page only

this by putting (index.html )
in the public_html

so the index.php will never appear

or

change the index.php file itself

this as i thought through the forumhome temp.

to remove hack page

revert the forumhome templates to the defult
reupgrade the forum to same version in order to remove the injected style and recover the defult one


if he couldn't inter in his site
the hacking is through the spacer_open templates

and there is another way to resolve it

[Colleen]

^ as I said

[webster13045]

there is not a site on the net that is not hackable if they want in they will find a way no matter how tight your server is

[Colleen]

Yep, agreed, that's why keeping backups is so important, for many reasons actually.

[sparks man]

^ as I said

yes ,


exactly every site was hackable from the script or from the server
but we should increase our security as we could by
keeping updating and learning the hacker to defends our sites

[Pureblood]

I am a mod on this one forum (thetechguide) And my cookies were stolen. I don't think there was anything i could do to prevent that. IT just happens.

[Noobeedoo]

I am a mod on this one forum (thetechguide) And my cookies were stolen. I don't think there was anything i could do to prevent that. IT just happens.

Maybe you left the cookies on the table... or the cookie jar open.. and some kids ate them all away

Just kidding.

[Colleen]

I am a mod on this one forum (thetechguide) And my cookies were stolen. I don't think there was anything i could do to prevent that. IT just happens.

I don't understand. Even if say, I had your "cookie" how would I gain access as you to a forum? Wouldn't I need the password to log in?

BTW, this happened to a member here, but it was cause someone got into their email account and got their password, it could be as simple as that, so I'd also change your email passwords if I were you.

[Zap]

Cookies store passwords within them.

[Colleen]

I'm going to go rip one open then and read my fortune!

[Zap]

I'm going to go rip one!

I thought that was Tim's job. :P

[Colleen]

I thought that was Tim's job. :P

I think it's officially mine, I can stink up the place pretty bad, wanna come over? :sick:mg:

[Zap]

I think it's officially mine, I can stink up the place pretty bad, wanna come over? :sick:mg:

Let me get my nose plugs first. :P

[Colleen]

We can have a contest!

[Zap]

In that case, I'll bring an extra set of nose plugs for you.
Let's invite Timmy over. No plugs for him. :eek:

[Steve]

make long and hard to crack passwords.

[Hurley4540]

Dude i already said that... and they can also cookie steal

[benjaminp]

It doesn't mean that long jibberish passwords aren't extremely helpful. Long passwords will make bruteforcing or guessing passwords difficult.

[Hurley4540]

Obviously, as i said earlier.........

Having a strong password would stop them from cracking your user..

[grim]

Brute Force protection of course is a good thing

[Bogart]

USe WPA encryption if you will be logging on from wifi networks.

[benjaminp]

USe WPA encryption if you will be logging on from wifi networks.

Yeah that would reduce the risk of packet stealing but really it is just good practice to secrue your wireless network in all situations.

I use WPA2, MAC filtering and I don't boradcast the SSID

[Noobeedoo]

Every PC connected to the internet is vulnerable

I'm sure my computer is also a sitting duck for anyone who would target me (just to see my saved naked videos in the shower) LOL

If ever anything in the PC application is acting suspiciously strange, just go ahead and FDISK it.. reformat and reinstall.. LOL

It's true for most PC but not for all.


For cookies (if you mean cookies that are stored in one's own personal PC), I recommend (IMHO) setting up your Firefox browser to the settings shown below:

in Firefox Window : Tools -> Options -> Privacy



The image on the right appears when you click on "Settings" button.

IMHO, that way cookies are automatically erased whenever you close ALL Firefox browser.

[sparks man]

EVEY DAY WE SEE SOME FORUM WAS HACKED
I VISIT H-ZONE.COM
TO SEE THE HACKED SITE AND THE NUMBER IS LARGE

[Hurley4540]

EVEY DAY WE SEE SOME FORUM WAS HACKED
I VISIT H-ZONE.COM
TO SEE THE HACKED SITE AND THE NUMBER IS LARGE

Huh? What do you mean?

[sparks man]

i meant that the hacking site is increase so we should take more careful about our sits'

[WikicyloN]

Brute Force protection of course is a good thing

I hardly ever use protection.

[silverwebworks]

USe WPA encryption if you will be logging on from wifi networks.

Its the worst thing lol

[Garcia Coder]

The only way you can protect form hacking is kep your softwares uptodate.

[Dr Teeth]

I have had enough experiences with these f***ing hackers, my forum was hacked during the initial days on phpbb platform. Later when i upgraded to vB they struck twice and since then i learnt a lot and keep my forums up to date with any new patches released.

On the whole, its very disappointing to see a site/forum hacked and to restore is the biggest challenge lest your host support you.

[Cocoras]

when u use third-party-plugins, make sure that they don't have any bugs

[Ardit]

I say you put a rubber on your forum. That should do the trick lol

But uhh, I learned alot from this, what about key logging viruses, can they steal information like passwords that way?