new user signed up as Admin

[mrfarb]

I had a user sign up with no email and no IP address - was also listed as an Admin! I immediatly deleted the user account. Username was TeamPS. My question is, how did he sign up? Was this breach through the host or from a VB exploit? I was running 4.1.7 which I have now upgraded to 4.1.9 - with the holidays and work I was behind on my update.

Any ideas on what I should do to secure the forum? I had no ill effects from the breach....luckily.

[Max Taxable]

My first suspicion is, another of your admins might have created the account?

[TheLastSuperman]

Originally Posted by mrfarb

I had a user sign up with no email and no IP address - was also listed as an Admin! I immediatly deleted the user account. Username was TeamPS. My question is, how did he sign up? Was this breach through the host or from a VB exploit? I was running 4.1.7 which I have now upgraded to 4.1.9 - with the holidays and work I was behind on my update.

Any ideas on what I should do to secure the forum? I had no ill effects from the breach....luckily.

Ahh one of those p0wersurge members... Well you did the right thing by removing then immediately updating.

I would also:
1) Change database passwords *Don't forget to update the config.php files for vBulletin and any other software running on your site.
2) Change FTP account passwords.
3) .htaccess protect your admincp and modcp here are some useful links;
.htaccess authentication generator:
http://www.htaccesstools.com/htaccess-authentication/
.htaccess password generator:
http://www.htaccesstools.com/htpasswd-generator/
4) Check to see if they added any admin accounts, on one site they changed the primary admin account name to what they desired and went so far as to re-create the admin accounts w/ the same details but no admin permissions to throw the site owners off for a little bit.

I know adding in .htaccess will help, what they seem to be exploiting on most sites is the admin account name and password (therefor the changing of db and ftp passwords is more precautionary at the moment, the most important thing is to add .htaccess protection to your admincp and modcp folders) however if they don't have access to the server there's no way they can bypass the .htaccess protection and yes that means use a entirely different username and complex password when creating the .htaccess and .htpasswd files. Also on that note, be sure the .htpasswd is stored above public_html i.e. in /home/accountnamehere/.htpasswds

[mrfarb]

Thanks. I temporarily suspended new registrations- would that even help?

[TheLastSuperman]

Originally Posted by mrfarb

Thanks. I temporarily suspended new registrations- would that even help?

Yes and no, change your admin account password too I forgot to mention that and add in the .htaccess protection - do that now!

[mrfarb]

Thanks. I am doing it at this moment! You are the last Superman....

[TheLastSuperman]

^ Now remember, this will help drastically however they can still do anything you normally can outside the admin control panel if they obtain your credentials.