How to stop from being hacked??

[Jernet]

I have a phpbb forum that keeps on getting hacked about once a week :angry:

They are hacking via the admin panel of the forum. Ihave changed the password multiple times, but they still get in. I contacted my webhost, and they said about blocking ip addresses, but I don't know what the hacker's ip address is.

Anybody here have any idea how to stop this?

Up until this point, it is only a 'nice' hack, as they are only changing the title, description, email address, and avatar gallery...but they could really hurt the site if they want to.

Apparently it is the owner of ziox.org, which is only a parking page. I don't know how or why they picked me, but I need it to stop.

Any suggestions? :worried:

 

[jdk]

First I would make sure your phpbb is the latest version. 2.0.18. When you login to the admin panel it shows the last ip's to login to the admin panel. You can take these and block them. I am assuming you probably have an old phpbb and they are using an exploit to gain access.

 

[Jernet]

thanks. you are right, I am using 2.0.11.

Brings me to another question. I have had some mod rewrite done to this forum, if I try to upgrade, will it cause a problem?

Also, with the version I now have, is there a way to see the latest ip login in the admin panel, or is that something with the newer version?

 

[Jonathan]

Just upgrade, you won't stop them by banning their ip.

 

[Jernet]

can i upgrade without effecting the mod rewrite?

 

[MrDude]

I know how they are getting in and a patch for you:

* in "includes/sessions.php" replace code:

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

if( $sessiondata['autologinid'] == $auto_login_key )

replace with:

if( $sessiondata['autologinid'] === $auto_login_key )

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

 

[Jernet]

wow. thanks. i will give it a try!

 

[stevey]

you still should upgrade, as there are other issues with older versions of phpbb. if you look on the phpbb forum there are instuctions on how to upgrade manually which you will need to do so not to effect your mods

 

[NetTuner]

What really works, and is the easiest to implement, is to password protect your admin directory using .htaccess. That will stop them dead in their tracks. Since there is no other need for anyone but mods to access the admin area, this will have no negative effect on your forum. Good luck.

 

[MrDude]

When I use phpBB now I setup search engine friendly urls and rename all the core php files and change the files to effect it. Next I rename variables - Its a pain installing a mod but I rest assured any exploit found for another phpBB probably wont work for my versions

PS. If anyone wants a secure premodded phpBB with search engine friendly urls checkout http://extremephpbb.com (not my site, Im a dev over there)

 

[Mr. DeletedMr. Deleted is verified member.]

http://starfoxtj.no-ip.com/phpbb/toolkit/

 

[maroulis]

have you thought of chaning the directory name of your admin panel to something obscure? you also need to add .httaccess file that redirects to main page if directory or file doesn't exist (also a 404 redirect)...

 

[Shark]

Best, stop using phpbb. Its a crappy script. Every version has bugs. Every release is being hacked.

I'd rather recommend you to switch over to SMF, which is free, more secure & feature-rich.