HELP!! Hacker keeps hacking site

[Jeff G]

Don't know how he is doing this & would like help if possible.

Hacker is from Hanoi, Vietnam got me twice so far, used different IP's

He creates a screen name & then he is able to log onto my admincp? How? All permissions are set for new users & the have no admincp access, but he does & give himself admin privileges! & then tosses code for streaming ads into my main forum page.

I have change name of admincp directory to a completely obscure name, is there anything else I can do besides that & ban his IP & email addresses?

Any help would be greatly appreciated.

I have checked all files via FTP & none have been changed, so he is doing this straight thru Vbulletin!!

[snakes1100]

Well, if you aren't running the latest version of vb then it's not vb's fault, i would suggest you upgrade it and any installed hacks on your site.

Then you need to upgrade your server's backend programs, sql, apache, php etc...

Next on the list would be to remove any other custom scripts mainly php based that you have added to your site, even if they arent vb related.

You should also check your server logs and see if there is any indication that he is doing a db injection.

Install some security while your at it, suhosin/apf etc.

[Lynne]

Along with making sure vBulletin is up-to-date, make sure all your modifications are up-to-date and don't run any modifications that have been graveyarded (they could have a security flaw in them).

[iHatton]

Read this, https://vborg.vbsupport.ru/showthread.php?t=220914

[motowebmaster]

If the respective server has been compromised, it would be easy to "cover your tracks". An FTP program is not going to give you conclusive info.

Share you site's URL with some folks you trust, without that info it's anyone's guess as to what the issue is.

[Medtech]

There are many ways to secure your forum, renaming the admincp is the first and easiest, i like to have a dummy admincp folder with an index.html file in it with a redirect to a really nasty site or the 404 page.

[Carnage]

put a .htaccess file into the admin cp directory and setup password protected access.

See this: http://davidwalsh.name/password-prot...using-htaccess

[Black Tiger]

And be sure to use a good host. Not some kid or man who started a hosting company without any experience.
If the hacker keeps coming back, even when you change the admincp directoryname, they can read your config file. Some hosts have not provided decent protection on their servers, and if you know the location of the config file (which is always in /forums/includes with vBulletin) you can read it out via ssh or via a self made php file.
All the hacker needs is an account on the same server.

[daveaite]

Originally Posted by Medtech

There are many ways to secure your forum, renaming the admincp is the first and easiest, i like to have a dummy admincp folder with an index.html file in it with a redirect to a really nasty site or the 404 page.

Haha, this is good stuff

[Princeton]

if this continues, I suggest hiring someone with a good reputation to check your site