VB Member's Area NOT secure

[cbeliveau]

Hi,

Our account was just hacked. Lucky for us, he didn't changed emails and such: only the URL.

The name of the site is www.q8iz.com/vb.

Please do something.

Thank you.

[Floris]

* Close your forum

* Change your admin accounts password (temporary change them to normal users)

* Make a mysql dump for backup

* Upgrade your forum to version 2.3.4 to fix any known security bug.

* Change your password again to be absolutly sure, and also change the pass to all the other staff members.

* Add a .htaccess / .htpasswd to your admin/ and mod/ directories and give on a per user basis username/password combinations that are different then the staff username/passes to add extra security layer.
If they then hack vb, then have to hack apache too.

* Gather the syslog details and report the user to their internet service provider for hacking and issue a report with their local authoraties for unauthorized access to your system.

[cbeliveau]

VB Member's Area to download the licenses; not my forum

[Floris]

You gave the URL to your site, I thought you meant the member area > admin control panel. Sometimes users confuse those.

Anyway,
How is it insecure?
They brute forced the combination? Jelsoft would have noticed.
They got into your email account? Then the security breach is at your system.
Someone recently contacted you to give them your details? The breach is at you.

I need more details in order to find out what might be wrong.
And how did you find out it was hacked?

[cbeliveau]

Hi,

I just visited this morning the member's area to download RC4 to find out that my Website details has been changed. My email is still the same. They seems to have edited the license. I can't change my password so I guess I'm not in a good position right now.

The name of the site is www.q8iz.com/vb.

This is the name that appeared in my member's area instead of mine.

[Wayne Luke]

You need to open a support ticket. We don't handle these issues in the forums. Include your customer number and password, license number, contact name, address of purchase and approximate date of purchase.

[Steve Machol]

Since both the customer number and password are both 12 characters and randomly generated, it's unlikely it was 'hacked'. Someone got ahold of your license details. Also I notice you sent in a ticket without the info Wayne requested. Update that ticket with this info so we can verify this reuest. Then ask Wayne to generate a new customer number and password for you.

[Scott MacVicar]

Brute forcing is also impossible since we had mod_dosevasive running which serves up 403 requests if someone was to attempt to brute force us.

[Joe Gronlund]

Sounds like someone got ahold of your customer name and password...

[XYPHEN]

Sounds like someone got ahold of your customer name and password...

Most definitely, it is quite impossible to break through vB's security system in the members area.

[filburt1]

Most definitely, it is quite impossible to break through vB's security system in the members area.

There is no such thing as an unbreakable security system. For example, the password is sent in clear text. Somebody could have intercepted it.

[Reverend]

Have you given out your customer details by replying to any emails that claim to be from vBulletin?

[cbeliveau]

I didn't replied to anything. Only 2 persons have access to my emails and they are bot secured by VERY though passwords.

This can't be the thing.

[Guest]

Have you been browsing through proxys or anything like that?

[Steve Machol]

I looked at your license and it shows that there was never any change to the forum URL (all URL changes are logged.) It never had the URL http://www.q8iz.com/vb on this license.