Hacked and Locked Out

[BrianC]

Your phpBB Version: 2.21.
phpBB Type: Integramod 141
MODs: Yes
Your knowledge: Beginner
Board URL: http://standontherock.com

PHP Version:
MySQL Version:


What was done before the problem appeared?
Site was basically inactive


What was done to try to solve the problem?
nothing yet



De.scription and Message

Hi,

I have a site with integramod on it that was basically almost completely inactive. It is a Christian youth forum.
Last week some winner went on and posted some porn as the admin account. I deleted the stuff and changed my password.

I have some of the cback stuff disabled because of alot of problems and only allowed registration by admin appoval so I thought it would be safe.

I got hacked again yesterday and now I am locked out because he changed the password and took the site offline. It says site is being upgrade. I think I discovered this is progress and moved the forum a different directory to try and stop him. So now I have the site under a different address but can't access anything to get back in.

In there a way I can get access to this again or am I just shafted.

If I was a hacker I guess I could get in the way he did.

Thanks,
Brian

[BitingMonkey]

It sounds like you may have opened the door for them then.

One thing I do is use Cpanel to put a password protection on the /admin portion of the integramod install. It is another step but could help and it was super easy to do.

cback may be overprotective in some areas or just unwilling to play nice, but it does protect you and there are some updates that people here have made for it to allow it to work with more of the mods. And you can get it to work with with other mods fairly quickly manually. Good luck rebuilding.

[BrianC]

Thanks BM I will do that but at this point I can't even access the admin panel...

[CaNNon]

I can have a look if wish, have you checked to see if your db is still there?

[DjPorkchop]

Im sure he can get back in via php myadmin and change the password back from there? the smae thing happened to me, WITHOUT cback being disabled, and I went into my database and got right in.

That was a nice site too. Im the one that installed the blog mod I think it was, on that site.

[CaNNon]

yep if the db is there, I wonder though as normally they just want to load a spam screen for some lame credits.

[BrianC]

Thanks for the reply guys...

If that's you Ray you were a giant help with that site and did a great job....

I checked the database and the winner deleted the several admin accounts that I had and unfortunately seems to have created another account with the user name of my password.

Not sure how he went about all this but it is serious...

I will have to check my other computer and see if I have a backup of the site from like a year ago. Maybe I can insert the admin user and get back in.

Any ideas?????

Thanx

[DjPorkchop]

Yeah it is Ray <img> I know it can be done, but Im not so slick with db work. I wish I was I would jump right to it for you. I hope you get it solved.

If you do, drop us a note and let us know how you got it fixed.

[Helter]

you cannt change the password from phpmyadmin. It is encrypted. You can however, change your email address and with your browser, request the forum send you a new password.

[DjPorkchop]

Proves I dont know db's at all. <img> That is a good idea Helter. Ill have to remember that one "Just in case"

[Helter]

you can also set the board to active, register a new account and edit the new account to be user #2

[BrianC]

I was able to restore the board from a backup I had made a while back. Lost some data but not really a big deal.

I had changed something in a file that pretty much took cback offline. I thought since I was creating accounts by admin only I was safe but I was wrong.

How can I ensure that all the saftey features are enabled?

Are we at risk because phpBB2 is no longer being developed?

What is the best way for me to safeguard the board from hackers?

I'm not a big fan of porno on a youth site.

Thanks all,
Brian <img>

[CaNNon]

In the security forum find the tutorial on ".htaccess and chmod 777 folders".

Do you have a .htaccess file your using in the home folder or are you still running on the default one?

Check admin security, and also the cracktracker settings make you you have everything set to active. Capita is a small problem you'll need to tweak the settings down a bit so it's easy to use. and debug is a pain if you have nonstandard mods. but thats because you can add it but you need to teach it the mods.

you can also use crawltracker it has some really nice security that updates from the authors site being up to date really helps.

[BrianC]

Thanks everyone!!!

I have done a fresh install of integramod from the latest files from this site because I don't know what was hacked and what older files existed.

Ray had done a great job with a blog mod on the original install . Is there a way to restore that blog as it was or do I need to go though a new install of the blog system?

Also how can I test the security of the site? I added the .htaccess recommended and the cracker tracker should be better than the way it was but I would like to test if the site is secure. I have a feeling my hacker will be trying my site again.

Thanks ALL <img>

[DjPorkchop]

If your database was good, you could pull all the info out of it for the blogs, BUT if not, then a complete reinstall is in order.

However, the download on this site for the blog mod works, but not properly. I have JUST gotten ahold of Dragonsys and aquired the original Blog Mod install for PCP. I am testing it as we speak and it installs MUCH easier and correct then the current one here. As soon as I get it in order today, I will try to contact helterskelter to get the correct files on site for download.