vBulletin 3.8.3 exploit?

[musado1961]

Hi

Yesterday my hosting company [servage.net] suspended my account due to the forum/misc.php taking over 2.5 million hits and putting undue load on the shared server.

It's a small forum [under 70 members], and pretty quiet, and ONY visible to the to Registered Members. Registration is closed, so all anyone will see is the login page.

I have the CYB Advanced Statistics installed which refreshes every 30 secs, but surely that wouldn't generate over 2.5 million hits?

From talking to some other vBulletin users I've been informed that this may be some form of attack called "teardropping"?

Now, the hosting company are being a real PITA & refuse to re-instate my account till I take the necessary action [according to them change the problem with the misc.php script!]

However, I cant do anything because they've locked out my ftp access as well!

Anyone got any ideas/suggestions as to what may have caused the HUGE amount of hits on the misc.php & how to solve it?

TIA

[Oblivion Knight]

You'd probably be better asking at vbulletin.com, sounds like some kind of attack..

Do you have any other modifications installed that use misc.php?

[musado1961]

Just CYB - Advanced Forum Rules and CYB - Chatbox..but I've never had a problem like this in the 2 months I've been using the CYB mods

[BlueNinjaGo]

My suggestion: change hosts.

[Oblivion Knight]

Any form of shoutbox / chatbox is notoriously bad for server resources..

A few hosts that I know of have effectively banned their use.

[Carnage]

Can you get the apache logs from the host?

Might be helpful to see what was being requested -> ips could be matched to forum users in your db; see if it was regular usage or some form of attack.

[musado1961]

Originally Posted by Oblivion Knight

Any form of shoutbox / chatbox is notoriously bad for server resources..

A few hosts that I know of have effectively banned their use.

Till yesterday I'd never had any issues with the CYB mods & dont believe they are at fault. The chatbox in particular has never caused any issues whatsoever before.

The sudden jump to over 2.5 million hits seems like some form of exploit against my forum

Thanks for the replies so far guys

--------------- Added [DATE]1245764474[/DATE] at [TIME]1245764474[/TIME] ---------------

Originally Posted by Carnage-

Can you get the apache logs from the host?

Might be helpful to see what was being requested -> ips could be matched to forum users in your db; see if it was regular usage or some form of attack.

I wish!

That's the 1st thing I requested from Servage & got fobbed off with allsorts of ridiculous excuses

[TNCclubman]

r u on a dedicated server? If you're on a shared server, thats probably why they dont want to give you the logs.

Unfortunately, unless you're on a dedicated box, you're not considered a priority and you're going to get treated like caca. Change hosts or go dedicated.

[musado1961]

It's a shared server & I fully intend to change hosts if I can find a decent [if there is such a thing] european host.

I've had nothing but problems with Servage from day 1

[TNCclubman]

There are no known exploits for vB 3.8.3... post your problems re: hacing on cyb's mods post. See if anyone can figure it out...