Forum gehackt nu geen gasten meer.........

Dave · Bericht door **Dave** » 15 nov 2002, 15:54

Hallo allemaal, ik hoop dat iemand me kan helpen, ik weet het echt niet meer nu........

Mijn forum http://www.teamibiza.nl/forum draait nu iets van bijna 2 maanden zonder problemen, maar nu heeft afgelopen woensdag een of andere lolbroek het forum gehackt, en na een en ander veranderd....

Nu heb ik eigenlijk alles hersteld, op een ding na:

Ik kan niet meer zien of er gasten online zijn op de forumindex, wil het het beheerdergedeelte??

Hoe kan ik dit weer oplossen???

Verder is er een mogelijkheid om het forum beter te beveiligen......

Alvast bedankt,

Dave
Webmaster Team Ibiza
http://www.teamibiza.nl
http://www.teamibiza.nl/forum

BartVB · Bericht door **BartVB** » 15 nov 2002, 16:11

In 2.0.3 zitten geen (bekende) beveiligings problemen. Zorg dus iig dat je altijd de nieuwste versie draait. Ik heb zo'n vaag vermoeden dat je op een shared host zit. Op die machines kan iedereen jouw config.php lezen die op die server kan komen. Op die manier kunnen ze dus ook erg eenvoudig je database aanpassen en zichzelf admin maken. Hiertegen is op het grootste deel van de shared hosts niets te doen :\

Wat is er veranderd aan je forum? Dat bekijken van het aantal gasten (op de index pagina) gebeurt in /includes/page_header.php is die veranderd?

Dave · Bericht door **Dave** » 15 nov 2002, 16:19

Er is niets gebeurd, tenminste ik heb niets gedaan.....
alleen die hack

Maar waar kan het aan liggen???

trinitron · Bericht door **trinitron** » 17 nov 2002, 12:17

Dave schreef:Er is niets gebeurd, tenminste ik heb niets gedaan.....
alleen die hack

Maar waar kan het aan liggen???

Heb je install.php wel verwijderd van je forum? Ook nog ander probleem kan hier om de hoek schuilen. Namelijk dat je wachtwoord te gemakkelijk is om te kraken. Zoek een passwords uit die niet gemakkelijk te kraken is.

Trinitron

trinitron · Bericht door **trinitron** » 18 nov 2002, 10:02

Dave schreef:Er is niets gebeurd, tenminste ik heb niets gedaan.....
alleen die hack

Maar waar kan het aan liggen???

Bekijk dit ook eens:

Code: Selecteer alles

phpBB and Hacking Attempts ... by psoTFX
 17 Nov 2002 
Over the past couple of weeks we've been emailed, PM'd and had people posting about hacking attempts on their boards.

While we will often try and help repair damage inflicted by those persons who simply "read and repeat" the work of others YOU can do an awful lot to prevent it happening in the first place.

Firstly UPGRADE to the latest available version of phpBB 2.0.x! We realise that many people modify their boards ... however we supply three different methods of upgrading from one version to the next. An upgrade need not mean starting from scratch, investigate both the changed files and patch methods ... one or other may suit your needs better than a full install. If you refuse to upgrade then I'm afraid there is nothing we can do to help ... you have been warned!

Secondly ENSURE you read ALL the documentation we provide with phpBB 2.0.x! Time and effort went into writing those documents and many basic questions on installation, security, etc. are answered within them. If AFTER reading these docs you are still having problems feel free to search and then post on our support board (in the correct forum!)

Thirdly ENSURE you select only responsible people to act as administrators and moderators! We not infrequently get told "An administrator on my board did x, y and z!". It is entirely your responsibility to maintain and operate your forums ... do so wisely.

Fourthly CHOOSE PASSWORDS CAREFULLY! Try and use different passwords for different parts of your site or account, e.g. don't use the same password to access your account, the database, any web control panel, your administrator account on phpBB, etc.! Doing so leaves you WIDE OPEN to potential problems. NEVER give out your passwords on this or any other forum ... no one on any official phpBB board will ask you to reveal your password in public and is extremely unlikely to ask for it even privately (few problems need direct intervention on an admin or account level). If you do reveal your password (for whatever reason) ENSURE you change it as soon as the task at hand is complete.

Fifthly REMEMBER that should you use a shared host, and that host offers shell access that your configuration file may well be readable by anyone on the same server. There is nothing much we (phpBB) can do about that ... it's a "limitation" of the operating system and server environments. However, should you have a cooperative host they may be able to alter ownership and permissions to reduce the chances of this being an issue (although such hosting providers are likely to actively monitor shell access and thus problems are typically reduced).

Sixthly, if you SUSPECT you've been hacked please don't post anywhere and everywhere blaming phpBB. While we cannot rule out it as a potential source of trouble there are many possible reasons beyond this software. Before posting anywhere you should check the above five points and try and discover if you've overlooked one of those issues. If you have not then feel free to post HERE with an appropriate topic, i.e. something other than "My phpBB has been hacked!" ... it tends to give rather the wrong impression to users!

Thanks

psoTFX (phpBB Group)

Dit artikel heb ik van de volgende link:
http://www.phpbb.com/news.php?id=7