Exploit!!! Someone stole my database and hacke my admin cp

[saint death]

http://marc.info/?l=bugtraq&m=121337711801354&w=4

the hacker sent me an msn message with this link......


IM PANICKING WTF DO I DO

[Dilly]

Upgrade.

[saint death]

I have the latest vb...

[briansol]

if you have pl1, that link you posted has been corrected.

do you have a chatbox/shoutbox? there's been a couple of those hacked over the weekend.

[Alphagamer]

if you have pl1, that link you posted has been corrected.

do you have a chatbox/shoutbox? there's been a couple of those hacked over the weekend.

Well, the same happened to me last Friday night and I had PL1 installed without any hacks. I am checking with my host at this moment but I assume nothing is wrong on that area.

Anyway, I hope you are right about that the issue is fixed. At this moment I have a hard time believing it.....

Is there any way to really guard yourself from these kind of attacks(I have seen the link with points how to make your forum more secure, got it in my favs, so no point in linking it here again). I really would like to know what should be done to make your admincp as secure as it can be

Regards,

A sad hacked admin

[Wayne Luke]

Is there any way to really guard yourself from these kind of attacks(I have seen the link with points how to make your forum more secure, got it in my favs, so no point in linking it here again). I really would like to know what should be done to make your admincp as secure as it can be

Did you follow the steps in the link? Is your admincp folder protected with .htaccess using a different username and password?

Are your password of sufficient strength and include upper and lower case letters, numbers and punctuation? Are they longer than 8 characters? Do you use different passwords on different sites?

Is your local computer secure and free of spyware, trojans and viruses? Is it password protected and include encryption for sensitive information? Is your network secure and wired instead of wireless? Do you refrain from accessing your site from insecure public terminals or over wireless connections? If you do use Wireless networking, is it resticted to specific MAC addresses or just reliant on WPA encryption?

These last ones are the largest security leaks that I come across -

When accessing your site for file uploads do you use FTP or SFTP? Always use SFTP. Your host requires that you use SSH for terminal access so their servers don't get hacked. You should use SFTP so your account doesn't get hacked.

Is your server always updated with the latest stable versions of its software. This not only includes applications like vBulletin but the operating system and all its services as well. It needs to be regularly patched and updated. If you're still running old versions of your OS and all the different software packages that come with it, then you are probably vulnerable. Same with your local computer(s).

Do you access your web hosting control panel through SSL or not? Surprisingly a lot of hosts don't provide access to cPanel under SSL. These hosts are not worth your money.

Same for phpMyAdmin is it under SSL protection?
Any direct database access should be encrypted. Use a self-issued certificate if you don't want to pay the money.

Do you use different passwords for your SFTP, Hosting Control Panel and phpMyAdmin? I can't recount how many times a customer uses the same username and password for all of these and their vBulletin control panel. It is just as good as not having any security at all.

Is your email downloaded via SSL? Most people download their email in an unencrypted format which is readable with anyone using freeware software on the Internet.

Security only goes so far in software. vBulletin is an application level piece of software. Your entire server and network has to be secure for vBulletin to be secure. If they aren't then nothing will stop them from getting access to your site. When you use FTP instead of SFTP, you are transmitting your passwords in plain text over the internet. Same when you do not use SSL for your email. It is not very hard to use a packet sniffer and set up an anonymous looking computer on the internet or to take over an insecure and unpatched server.

There is also a human factor to security. I see a lot of people use the same thing for their admin username and admin password. This is no security at all. Or they use the same password for every site, even ones of questionable security of their own rights. Your habits online are strongly related to the security of your own website. You don't know if the new forum you visited has been hacked to store plaintext passwords or not. You should assume that they have, even if its vBulletin. Always use different passwords for different things. I'll admit that I don't always use the same password but I have a junk password that I use for the random sites that I might have to register on. It is only used on these sites. For other sites, I have different though sometimes similar passwords and all are on a theme that I can easily remember without writing down. All are two words and at least 12 characters long. My database passwords are 40 characters of randomly entered characters.

Security is a lot more than just uploading software and hoping it is secure. For those with hacked forums, open a support ticket and we can help you restore them. However to keep them from being hacked, you need to actually be secure which includes everything listed above.

[saint death]

I've hta protected my admin cp along time ago.. with diff user and pass..

He was showing me my hash .....

The thing is we haven't rly loss anything he just has a copy of my db

[Wayne Luke]

If he has your hash then he has direct access to your database. Password hashes are not displayed anywhere. Your security issue is outside vBulletin and falls into one of the other area in my post above.