Add Login To HVM Config Options

[woodmj]

Hi, Is there anyway I can add login to the list of configurable Human Verification options in VB4.2.2? I'd just like to put a dent in the mass brute force login attempts happening on my forum. Banning IP blocks and proxies doesn't seem to work. Maybe hackers are using fake IPs.

[kh99]

Of course it can be done, but there is no simple way like setting an option or editing a template. It would take some coding and possibly some file changes. You could post a request in Modification Requests/Questions (Unpaid), or in Requests for Paid Services if you want to pay someone to do it.

[bridge2heyday]

Vbulletin has Strikes system and it is very effective against brute force attacks

[kh99]

That's a good point. I was thinking woodmj wanted additional security, but it could be that some people don't know about that.

[woodmj]

My thinking is I'm getting waves of brute force attacks against member accounts that still persist past the VB strikes system, after blocking China etc in Apache and installing an anti-proxy mod. I'm guessing the hacking programs are just passing random values directly to login.php so I wondered if popping in some form of Captcha that needed to be satisfied before you could talk to login.php might slow the attacks down. For instance I use Q&A HVM on my registrations that has worked well for much time but it would be nice to apply that to accessing login.php as well.

[kh99]

OK, I think that does make sense, because probably any change in the login process will be enough to stop the attacks. Maybe if I have time later I'll look to see how hard that would be. One thing I can see right away is that the main login above the navbar will have to go to another page to do the HV.

[woodmj]

Ok. Any help/thoughts would be greatly appreciated.

[kh99]

And I'll say this before someone else does: some people will find it annoying to have anything extra to do when logging in. But I have an idea to reduce that. One is to make an option only to show it after one or two failures, so that it isn't there at first but kicks in before the strikes. Another would be to monitor any "strike outs" on any user name, and start showing the HV only if the lockouts hit a certain rate (like X in the past hour or whatever).

[woodmj]

One thing I have noticed is I don't seem to be able to collate the attacks effectively with VBSecurity as far as IPs go as the IPs just seem to be random or faked to look like a member one which just leads to member's getting locked out and the hackers carrying on hacking.

[kh99]

Yeah, I'm curious about that. As someone on vbulletin.com mentioned, I guess there's been a new wave of attacks because there's a new database of usernames and passwords going around. So I suppose it could include ip addresses as well. I also don't know how it could be faked, but if that's what you're seeing then there must be a way.