My Board was HACKED Twice today!!

[tpearl5]

To my surprise at about 5:30 today someone gained access to one of my admin's accounts. They edited my account so I wasn't an admin anymore. I quickly edited the database and made myself an admin again. I changed some things back that the hacker messed with. (my advertising banners, and site name) At this point I had to go to work.

When I got home from work at about 1am my other admin's name was taken, and the same was done as before. He put 'their' banner on the top of the page both times and said "LHK Ownz" or something. I changed everything back again and added some heavier security this time. Also got some IP's of the names. One looks like a proxy and the other is an AOL IP.

This was the banner he displayed on my site:
http://www.angelfire.com/ca6/monkeeyz/lhk.jpg

So how could two seperate accounts be compromised? I'm running v 2.2.8 so all passwords are encrypted. They did not gain access to the backend of the site or the database itself. Just the vB control panel.

:ermm:

Can anyone offer a little insite as to where the security breech could be?

[majin gotenks]

maybe bruteforce? or do you have another admin or two? they may know one of their passwords.
BTW what a lame name leet hackers krew :|

[Talisman]

But...

If they knew the password for a third admin's account and they used that to gain access to the ACP, this still wouldn't let them get the password to tpearl5's primary and backup admin accounts.

I gather he's already checked the adminlog, so he knows which admin accounts the hacker[s] used to log in.

[Chris M]

Not to sound off my own hacks, but I have a few vB security hacks you could install, to try and prevent this

Satan

[Erwin]

Very odd. Make sure you disable all other admin accounts, and that getadmin.php is not anywhere on your server.

[Tony G]

Best thing to do is maybe keep yourself an admin only, as you can just re-admin yourself via the database. This can limit the access if they've cracked one of your admins accounts passwords?

That probably didn't make sense. =/

[Bison]

Passwords are a killer ... sometimes member join other forums and use the same passwords from another. This looks like the case with your forum. If remembering passwords are a pain in the butt for some of you, here's a free program that I reccommnd to all of my members (RoBo Form): http://fileforum.betanews.com/detail...fid=1014298205

Also, one of the guys in the Full Release Section created a very nice password changer hack that requires all members to change their passwords after a period you can define. You don't have to have all members change then, but you can make it a requrement for your staff to change their passwords.

For added saftey, it would be best to make it so that each password contains numbers and letters, and require that they are at least 6 characters.

[filburt1]

Yet another fact to enforce the rule that you should never have another administrator

[Chris M]

Indeed

Chris

[Tigga]

Today at 10:44 AM filburt1 said this in Post #8
Yet another fact to enforce the rule that you should never have another administrator

Agreed. I have 2 other admins on my site, but once vB3 is out, they will be cut down to mods.