Security Issue

[Rickie3]

I'm hoping someone here can give me some advice,ok here goes
I created some private forums on my board that certain usergroups can view only
the usergorups that have access are
V.I.P colour Purple
Moderators colour Blue
Super Moderators Green
Admins Red.

Now my normal registered users are not allowed access to these forums at all unless i give them access

Normal registered usergroup colour is black.

Ok what happened some of the content from the private sections were taken screenshots of and given out to the public,which has made me very upset and very hard to pin point who and what member was responsiable.I have the hack installed that shows what member has viewed the thread.To my surprise a normal registered user was able to view that private thread,i have checked all my logs and that users permissions,and cant see how this member could view that thread,do i have a security issue on my board how could someone access pages without having the right permissions??? i'm at a loss
see my screenshot below the normal registered user who's name is in black and i have circled red should not have been able to access that forum at all,please can someone help.

[Boofo]

Originally Posted by Rickie3

I'm hoping someone here can give me some advice,ok here goes
I created some private forums on my board that certain usergroups can view only
the usergorups that have access are
V.I.P colour Purple
Moderators colour Blue
Super Moderators Green
Admins Red.

Now my normal registered users are not allowed access to these forums at all unless i give them access

Normal registered usergroup colour is black.

Ok what happened some of the content from the private sections were taken screenshots of and given out to the public,which has made me very upset and very hard to pin point who and what member was responsiable.I have the hack installed that shows what member has viewed the thread.To my surprise a normal registered user was able to view that private thread,i have checked all my logs and that users permissions,and cant see how this member could view that thread,do i have a security issue on my board how could someone access pages without having the right permissions??? i'm at a loss
see my screenshot below the normal registered user who's name is in black and i have circled red should not have been able to access that forum at all,please can someone help.

That's really not that hard to do. I'm not sure how the read a thread hack works, but all a user has to do it directly link the thread and it would show them as viewing it even though they can't see it (if the hack works like I think it does).

What is sounds like to me, and bear with me on this, is that you have a Staff member somewhere that has figured this out and has either used the account to do this or is working in cahoots with the said user. Is this a possibility?

[Rickie3]

Hi Bob thanx for replying,i have checked all the admin logs and moderator logs and found nothing out of the ordinary,I also created a dummy registered user and used the thread direct link and it did not show the dummy as viewing that thread,this is why i'm at a loss

[Boofo]

Originally Posted by Rickie3

Hi Bob thanx for replying,i have checked all the admin logs and moderator logs and found nothing out of the ordinary,I also created a dummy registered user and used the thread direct link and it did not show the dummy as viewing that thread,this is why i'm at a loss

Well, then I would think you have a rogue staff member that might have granted the user in question access at one time, long enough to view that thread and then set it back to throw you off. As bad as that sounds, I have seen it done in the past. No other way it can be going down in my book.

And logs are easy to manipulate.

[MrZeropage]

If you are using the latest version of Paul M's Hack "who viewed this thread", it should tell you the exact date+time when the user viewed it while hovering the mouse over the username. Maybe this helps to track down the issue a little, just look who was online in that time ect...

[Rickie3]

@MrZeropage i am running the latest hack and it does give the date and time,,but it still really doesnt norrow who could have been resposiable,I cant going accusing someone when i just dont know who it could be,and in the same time i dont want to punish all the members who have access to the said forums,i guess i'm in a no win situation,so to save face i have locked down those forums so only my admins and mods have access