My board was hacked
 

I think my board was hacked. They didn't destroy anything on the forum - but one of my members posted a snapshot of a private (moderator) forum.
One of my moderators asked where he got the pic from, and his best friend (who is I think is also a vb owner and knows a lot about computers and security) replied:

Is it possible he's found a way to hack into the database?

I'm running 2.2.4

Thats the statement for adding a moderator, but unless he has a way to run queries on your DB its useless.

well you should really upgrade to vb227 there are some security fixes in it...

2.2.4 is not secure. Upgrade to 2.2.7.

I've upgraded now, but I need advice on what to do with such a member? I really have no proof he hacked, but I do know he posted a pic of something he shouldn't have access to.

well i'd show him the yellow card.....

2.2.7 isnt secure. I hacked my 2.2.7 board a few times and got access to the admin area.

i hope you've told this infos to the developers ;)

This is dissapointing to know.
Do you guys have any idea how this hacking on my forum may have happened?? Through admin area? I am led to believe he was able to procure other data from the database including IP addresses.

If it was through the admin area, I've now passworded that directory, hopefully that will stifle attempts, but if he has my admin password, then what's the point anyway

Is there anything I can do about this, like report it to some authority, if I'm able to collect evidence?

If you have evidence of this then please send it to support@vbulletin.com. Include the exact steps you are using to hack your 2.2.7 forum.

Heh sorry I wasnt really clear with that was I?

I have two account with my hosting service and through phpmyadmin I was able to edit my user account so that I was a admin and or mod.

There is nothing VB can really do about that.


So no version is really secure ;)

This is a problem with your phpMyAdmin password and/or hosting service. Of course if anyone gains direct access to the database they can do pretty much anything they want.

Actually I have seen this problem with many hosting companies. Many of them are to lazy to make anything totally secure... like being able to gain root access.

I told them about it but they yelled at me and said I shouldnt be hacking....which makes sence but what is a "real" hacker comes along? o_O

Geez! Find yourself another hosting company fast!

OK I've heard things previously about someone coming to the forum and finding themselves logged in as another member.
Is it possible this person could have turned up to the forum and found himself logged in as a moderator because of his IP at teh time?

HEH this forum was just hacked and I believe it runs 2.2.7

http://www.animehorizons.com/forums/index.php?s=

the site too ^

That entire site was hacked as DrkFusion points out. There is no way vB can protect itself from a hacked server.

... and adding hacks to your forum makes it much less secure. This is something that is overlooked by most. Turning register_globals off helps alot since that will solve most cases of sql injection and always use intval() and addslashes().

Note that if you're on a shared server, you are basically in a lot of trouble. Dedicated servers tend to be more secure, for obvious reasons. Yeah, and do check the code of hacks you install. :) Some of holes larger than the black hole in the centre of this galaxy. I won't mention names... but some of these hacks have been installed by a lot of people.

all you have to do is use htaccess, neo.
all your hacker attempts are history then. so protect your admin and phpmyadmin folders and you wont be able jack hack nothing at all. :)

try it and let me know how unsuccessfull you were, once protected with htaccess. :p ;)

hmm i agree freddie. we need Hack Reviews. definitelly.
some people install hacks and have no idea why or how they are created, but they like the features of it.
they dont ask themself, "ok this hack is it gonna ruin my board?"
no. not at all.

that's why the reviews come handy. people with code experience could drop a line there to guide the novice coders who "attempt" to release a hack just for the fun of it.