Hacked

[Prince]

Someone keep attacking my forum and he edit all the posts to adult content.

He enter as a any user and do what I said above

How this happen?

what should be done to stop that?

I already restored backup of my database.

 

[Prince]

IPB can take my license down because I'm warez forum you know and this against their TOS.

I added ACP security mod to prevent anyone access my ACP.

He didn't changed FTP and control panel passwords, he was playing on the site itself.

How I prevent anyone from screwing up my database

What needed permissions need to SQL database user, may be I set it have not needed permission.

 

[Ak47]

Check your moderator logs for the posts the hacker edited and block the ip froma accessing your board and server. And never ask IPB, they took down my site for having warez... Just try finding out the IP's and blocking them.

 

[Prince]

Thank you Ak47, I known that IPB take off because I read their TOS carefully.

Does anyone have a firewall script, let you protect your SQL.

 

[Baby Jesus]

I'd add a .htaccess login to your admin folder (I haven't used IPB in a long time but I assume the admin control panel has it's own folder, no?), then you're pretty much safe... Not much they can do unless they have a higher level of access such as ssh, ftp, etc.

 

[Ak47]

What Baby Jesus said is correct, password protect the admin folder directory via cpanel/or whatever control panel you have. The directory will be something like:

http://www.yourdomain.com/admin/

 

[Prince]

Thanks for advices

These people post RapidShare phishers in my forum and it seems banning them pissed them off.

It was a war from two days ago, on taking the control on the forum.

They banned me and I returned myself by playing in mysql and banned them all and their IPs.

Actually they failed to take control, so they played on SQL as I did. :mad:

But Cpanel do daily backups so all they done is undone.

I added tougher protection, I added .htaccess with deny all IP except mine.

Google it for more info on how you do it, added very tough protections on ACP.

Last thing need new Firewall script to prevent SQL injection, it seem IPB latest version don't beat it.

 

[Ak47]

I added .htaccess with deny all IP except mine.

to the admincp or whole site? lol

 

[Prince]

To ACP of course, the attacks is killed away, I guess they do DDos only now.
It seems it was security holes in the php and mysql on the previous host.
I moved to new one and everything is fine so far.

 

[Ak47]

lol ok.

 

[Golden Falcon]

to the admincp or whole site? lol
[/color]

whole site would have been funny..

Member: wtf, no one can see the site
Admin: working fine for me o.O?

 

[Prince]

No need everyone to hijack the topic and transform it to a joke because if you got hacked it never be a joke, who want to reply here with advice is welcome.

For sure ACP only not the whole forum, I talking in whole topic on People access your ACP and try to read whole topic first.

 

[To0]

Thats what I wanted to say lol, just rename your folder to something random, normally he will not be able to see the new folder the admincp is in

If everyone isn't doing this, then they should. It is a very simple and easy thing to do and can slow down the process of your board getting "h4x0r3d".

 

[Whoo]

If everyone isn't doing this, then they should. It is a very simple and easy thing to do and can slow down the process of your board getting "h4x0r3d".

lmao @ "h4x0r3d" :D:delighted:

 

[Prince]

@Prodigy
Even if I renamed ACP folder in previous host, he managed to know the new name of it and he beaten htaccess too, but after I added Deny All IP except the admins IPs, this step stopped him from entering it.

So we dealing here with someone has experience and he was well aware of site flaws and security holes, it has noting to with "h4x0r3d".

When moved, my forum become more safer.

So it has nothing to do with securty setting by us too.

The lesson I learnt from that, is not go to someone sell hosting with very cheap prices and a lot of advantages for low fees.

 

[pimpinjg]

no your dealing with someone that has a shell on your site lol he can easily take the shell download the htacces redo it reupload it :P look for the magical c99 shell!

 

[Prince]

All of that was because some was trying to hack the server, it seems the attacker managed to do it, and he just was playing with me.

I left it at once to another host and all of that gone and the server of old host fully crashed and old host emailed me about coming back the free extra time.

That taught me that not everybody give hosting with small fees is better, experience always needed to secure your hosting very well.

 

[DINDI]

well i m sorry i just read the prob in post 1 and not the solutions provided

Well dat guy can access ur SQL database and therefore he can do all dat u mentioned
u need to add a firewall to ur server

in short it is a SQL attack

** That uer must hav given u a file to upload on ur host and u must hav done it by mistake **

 

[M]

Hey DINDI,

Last post was made on 23rd Jul 2008, you posted Today......I think you know better m8

- Closed.