Catching the members in the act...
 

I have a hack that monitors the logins for mods and admins and in case of a login failure it sends me an Email notice on the name of the moderator, the password used, the IP address of the person and the time stamp. :D

I posted a thread about it on my board just to get a laugh out of it. The funny thing is that only 2 people on the board tried it and they obviously admitted defeat. :D

http://www.ls1.com/forums/showthread...hreadid=397373

Pretty funny. I have something similar @ my forum, but haven't busted anyone... yet. :D

Is this hack for public use?

LMAO!:p

I tried a few passwords, you might find them funny;)

Satan

well that's a nice method, i also did myself, just i stored the tries in the db and not as mail ;)

but you know, it could be a way for you to gain pw's, too as a little spelling error can show you the pw of your mods....

Any hack that allows you to see a users password shows poor character on the admins part. It's thieft and invasion of privacy. If you put up a sign that said your password is not private and may be collected by the admin of this site I'm sure your site would be dead. Collecting passwords from failed mod/admin login attempts is the same. You do not need the password tried to complete your investigation. In the context that xenon put it - "but you know, it could be a way for you to gain pw's, too as a little spelling error can show you the pw of your mods" - it's purely thieft.

I'm shocked at these actions!

well you're not 100% right here.
If you make it so, that not the admin sees all false attempts, but every mod can see the attempts on THEIR OWN account, it's also no problem to show the pw.

It can be useful for investigation if you see someone tries a PW you use on another site. In that way you know the other site's admin is a problem...

You always have to look at both sides of a medall, not just one :)

Now that idea seems fair. I'm paranoid about spying I guess. The read PM's hack or idea of it never really sat well with me either.

if this is for public use i would like to know the location of this hack because it could come in handy

:)
i know what you mean, as i'm paranoid, too ;)

it always depends on the admin.
The PM read hack could be a useful thing, if you have to check a special users because you got complaints about him.
But of course you can also use it to read private discussions at all.
Admins can be good, but can also be bad, you have to know how far you can trust one...

As said i don't like them either, but i also know about the usefullness of these things, too...

@blakkboy: nope, hasn't been released AFAIK

As long as it's stated in the privacy policy the admin can do what they want with the users information. Besides the ethics of it it's legal to have users passwords etc.

Thank you Xenon and Mist for your replies.

nooppid, as I stated, I get an Email notice for all failed attempts. If the moderator/admin login succeeds there there is no need to take any action or send any notices.

blakkboy, I have not released this hack. :(

We have had a lot of break ins into our private forums via compromised passwords of our moderators. The discussions in our moderator forum were being broadcast to other boards. I have incorporated additional security layers on top of the existing VB security. I have made a hack that logs all access to the private forums, I made a hack that does an IP ban for my private forms, and I have made a trusted host list hack per moderator for additional authentication of every moderator in my forums. I have been locked out on several occasions because I was logged into my forums from an IP address that was not listed in the trusted host list. And in such a case I also disable access to the admin and the mod CP's aswell and I also disable a lot of the moderation functions when somsone is logged in from an "un-trusted" host. ;)

nfortunately none of these hacks are published, and I have my personal reasons for my hesitation to publish them. :(

a hack I'd really like to find is simultaneous logins by the same user from different IP addresses. I believe a few people on my forum are sharing logins but need something to confirm my suspicions - any ideas on how to do this?

thanks

I think I understand your reasoning.... the code you used could perhaps be used against you if a member were to see it posted on vb.org. Perhaps the code you're using isn't all that secure itself ;)

I would love to have a hack like that though. Perhaps one day you could show me?

MGM out

I posted my Admin password in my forum last friday and invited people to login as me. I know what I did is quite insane, but every single one of those people were stopped in their tracks. They came back to that thread and whined about it too. :D

There were about 145 login attempts, and all of them did log in as me. But the trusted hosts hack gave all of them an error screen that they were illegally logged in as a moderator or administrator of the board. ;)

does that work for the forums too or just the admincp?

Because it'd be quite a big problem if they logged in as you in the forums as well

But then, what would you do if someone was hacking your board and you were at a friends house. You can't do anything about it but watch!

MGM out

Personally, i know that the AdminCP doesn't offer any protection from hackers but turning the board off, and if you don't have your admincp htaccessed, you should.

But if someone was hacking my board, i know i wouldn't use the admincp to stop it. I would use the control panel software on the server to htaccess everything down until i could get the issue resolved.

It works for both Admin CP and the forums. ;)

But I never said I didn't have ways to take over my own board. ;):D

Want to see something funny as well as pitiful?

Run a query that lists all users where password = md5( yoursitename)... Had a site where over 5% of the users had the site name as their password.