The forum of the forums
Welcome to the Official Support Forum of Forumotion!

To take full advantage of everything offered by our forum, please log in if you are already a member, or join our community if you've not yet.



Create a free forum like this one.

Am I getting hacked?

View previous topic View next topic Go down

Solved Am I getting hacked?

Post by acteeno on May 21st 2011, 5:17 pm

Hi,

There is a problem in my forum.

First of all, only registered users can even see the board, while guests only face login window and no further. Registration is via my confirmation only.

Everyday in admin panel in the list of connected users I see one or two guests with almost the same IP addresses. Almost is only the last 2-3 digits are different. Their actions are searching within the board, looking up user list and other, that should not be available for guests. IP tools found those IP are have same ISP. If I ban those IP's, next day (but not the same) other IP from Trend Micro would apper an do the same.

What is that? How do they get to the users area?


Last edited by acteeno on May 21st 2011, 9:22 pm; edited 1 time in total

acteeno
New Member

Male Posts : 15
Reputation : 0
Language : Lithuanian, English, Russian

Back to top Go down

Solved Re: Am I getting hacked?

Post by DarkGlow on May 21st 2011, 5:49 pm

Hi,

I don't actually have a solution to your problem... But, you'd get some assistance by setting the security for your forum via this link:


http://help.forumotion.com/t75418-my-forum-was-hacked

Smile


Last edited by DarkGlow on May 21st 2011, 7:10 pm; edited 1 time in total

DarkGlow
Forumember

Male Posts : 629
Reputation : 92
Language : English | Hebrew | Arabic
Location : Israel

Back to top Go down

Solved Re: Am I getting hacked?

Post by acteeno on May 21st 2011, 5:55 pm

@DarkGlow wrote:Hi,

I don't actually have a solution to your problem... But, you'd get sone assistance by setting the security for your forum via this link:


http://help.forumotion.com/t75418-my-forum-was-hacked

Smile

Thanks, but everything is already done before. Maximum security too. I have read lots of topics before registering.

____________________

Ohhhh, my big headache turned out to be the range of IP's of known spammers... Ok, IP ban and (hope so) at least temporary solved.

acteeno
New Member

Male Posts : 15
Reputation : 0
Language : Lithuanian, English, Russian

Back to top Go down

Solved Re: Am I getting hacked?

Post by DarkGlow on May 21st 2011, 7:12 pm

Maybe you should have another look at the permissions...

May I have a link to your forum?

DarkGlow
Forumember

Male Posts : 629
Reputation : 92
Language : English | Hebrew | Arabic
Location : Israel

Back to top Go down

Solved Re: Am I getting hacked?

Post by MrMario on May 21st 2011, 7:20 pm

If you have all your permissions right guest can't see anything, but the login page. Even if it says members list or a post. They can't. I wouldn't worry about it. There will be times that IP's are the same because they are using the same network or in the same house.

MrMario
Helper
Helper

Male Posts : 22186
Reputation : 1830
Language : test

http://test.com

Back to top Go down

Solved Re: Am I getting hacked?

Post by DarkGlow on May 21st 2011, 7:25 pm

Look... You can't just disable the guests' ability from looking at the board (memberlist, login, register, calendar ...) that isn't possible.
You'd ensure that I'm right by going to:

1. ACP.
2. Advanced mode.
3. Users and Groups tab.
4. Special rights.

Take a look and you'll notice that you can not prohibit guests from seeing the board. Smile

DarkGlow
Forumember

Male Posts : 629
Reputation : 92
Language : English | Hebrew | Arabic
Location : Israel

Back to top Go down

Solved Re: Am I getting hacked?

Post by acteeno on May 21st 2011, 8:12 pm

OK, the forum is at www.tkk.mums.lt (this will lead to http://bakin.findtalk.biz/login)

@DarkGlow wrote:Look... You can't just disable the guests' ability from looking at the board (memberlist, login, register, calendar ...) that isn't possible.
You'd ensure that I'm right by going to:

1. ACP.
2. Advanced mode.
3. Users and Groups tab.
4. Special rights.

Take a look and you'll notice that you can not prohibit guests from seeing the board. Smile

That's right, everything is set to Members or above.

The forum is of very narrow profile, only 52 registered users and I know almost all the IP's. The ones I was talking about in my very first post belong to known spammers as google says.


Last edited by acteeno on May 21st 2011, 8:20 pm; edited 2 times in total

acteeno
New Member

Male Posts : 15
Reputation : 0
Language : Lithuanian, English, Russian

Back to top Go down

Solved Re: Am I getting hacked?

Post by Maikeru Shinigami on May 21st 2011, 8:17 pm

This isn't much of a problem. Just fix the problem on the Administrator panel. As for users having the same IP address. By using one or more different browsers, you can be on multiple accounts at the same time. As long as nothing major happens on your forum. There shouldn't be much of a problem.

Also, you can go check your forum security if anything has happened. First, you go to your Administrator Panel. Next, you click on Advance Mode, if it is already in advance mode. You do not have to do this. Then, you click on the category ''General''. Finally, you look on the next set of category called ''Forum''. Look for the word security. Click on it, and scroll down to the bottom.

After you perform these steps. You can see which specific member has done anything on the Administrator Panel. So you can tell if a hacker did it or not. Hope this helped!

Maikeru Shinigami
Forumember

Male Posts : 120
Reputation : 10
Language : English
Location : Location Location Awesome Level: 9,001

Back to top Go down

Solved Re: Am I getting hacked?

Post by acteeno on May 21st 2011, 8:27 pm

Sunagakure wrote:This isn't much of a problem. Just fix the problem on the Administrator panel. As for users having the same IP address. By using one or more different browsers, you can be on multiple accounts at the same time. As long as nothing major happens on your forum. There shouldn't be much of a problem.

Also, you can go check your forum security if anything has happened. First, you go to your Administrator Panel. Next, you click on Advance Mode, if it is already in advance mode. You do not have to do this. Then, you click on the category ''General''. Finally, you look on the next set of category called ''Forum''. Look for the word security. Click on it, and scroll down to the bottom.

After you perform these steps. You can see which specific member has done anything on the Administrator Panel. So you can tell if a hacker did it or not. Hope this helped!

Thanks, but I am the only one administration member...

The thing is On-Line list sometimes but everyday shows one or two guests searching the forum or looking at the members list. Their IPs are listed on certain websites found on google as belonging to known spammers. I have no idea how could guest do this without an attack on the forum.

Everything, absolutely everything is set to zero permissions to guests, but they still do that. Few IP's from Japan, and few from US. All have Trend Micro as their ISP.

I have no ideas. The forum is almost one year old, I would like this ununderstandable thing not to affect it.

acteeno
New Member

Male Posts : 15
Reputation : 0
Language : Lithuanian, English, Russian

Back to top Go down

Solved Re: Am I getting hacked?

Post by Maikeru Shinigami on May 21st 2011, 8:40 pm

I know you are the only Administrator user, but by checking the category security. You can see which specific IP hacked your account, affecting the forums Administrator Panel. Though, to be honest. I do not quite understand your question.

But from the looks of it. I think it has something to do with this: http://www.free-hideip.com/products/free-hide-ip.html. If it has nothing to do with the link I provided. I have no idea on how to help you out, unless you make things a bit more clearer for me. Thanks.

Maikeru Shinigami
Forumember

Male Posts : 120
Reputation : 10
Language : English
Location : Location Location Awesome Level: 9,001

Back to top Go down

Solved Re: Am I getting hacked?

Post by acteeno on May 21st 2011, 8:56 pm

Sunagakure wrote:I do not quite understand your question.

That is because of my English, probably.

Well, I' will try somehow. There are some guests with specific IPs:

150.70.97.37
150.70.75.37
150.70.172.108
150.70.64.197
216.104.15.130
216.104.15.134

Those IPs belong to spammers, I found it out today.

Normally in the administration panel you can see the on-line list, where you can see what a certain user is currently doing in the forum, right?

So those guests with the IPs listed above are reading the forum - guest are reading my forum, which is not alowed them to do by current forum settings. Even more, sometimes they are reading the memberlist. Meanwhile nothing is allowed for guests to do in my forum.

So the question is, how do they read forum and memberlist without permission?

Nothing else has happened to my forum yet, but may this be a beginning of hacking it?


Last edited by acteeno on May 21st 2011, 9:05 pm; edited 1 time in total

acteeno
New Member

Male Posts : 15
Reputation : 0
Language : Lithuanian, English, Russian

Back to top Go down

Solved Re: Am I getting hacked?

Post by SLGray on May 21st 2011, 9:03 pm

It does not mean that guest are exactly seeing what they are looking at. They are probably getting a page that says, "You do not have permission to access this page."


When your topic has been solved, ensure you mark the topic solved.
Never post your email in public.


SLGray
Administrator
Administrator

Male Posts : 35624
Reputation : 2372
Language : English
Location : United States

http://fmthemes.forumotion.com/

Back to top Go down

Solved Re: Am I getting hacked?

Post by Maikeru Shinigami on May 21st 2011, 9:06 pm

Oh, now I understand it! I think I know whats the problem.

There can only be two reasons, to why a guest has the ability to view such content, that can only be viewed by certain types of users. Either the user is a hacker. Which is very, very common. Or the user has clicked a link that seems like it's real. For example, lets say I gave you a link to my site. But you cannot view it as a guest. Well, you clicked on the link.

By clicking on it, the Administration Panel can probably sense that it's viewing something when it really isn't. If you still do not understand, I will try to make this as more clearer as possible. Alright, let's say I gave you a link to my forums rules. You then click on the link, oh wait you cannot view it. Yes, guest CANNOT view it, but by clicking on the link. You redirect to the forum rules. So yes, the Administrator Panel can sense that a guest is viewing it, even though the guest cannot actually view it. The guest clicked on the link.

Which will make it feel like they really are viewing. If you do not understand this, than I am sorry. I have no other way to explain this. Though this many not be true. This is just a theory.

Edit: What slg said. They probably clicked on the link but they cannot actually, literally view it.

Maikeru Shinigami
Forumember

Male Posts : 120
Reputation : 10
Language : English
Location : Location Location Awesome Level: 9,001

Back to top Go down

Solved Re: Am I getting hacked?

Post by acteeno on May 21st 2011, 9:20 pm

slg wrote:It does not mean that guest are exactly seeing what they are looking at. They are probably getting a page that says, "You do not have permission to access this page."

Sunagakure wrote:Oh, now I understand it! I think I know whats the problem.

There can only be two reasons, to why a guest has the ability to view such content, that can only be viewed by certain types of users. Either the user is a hacker. Which is very, very common. Or the user has clicked a link that seems like it's real. For example, lets say I gave you a link to my site. But you cannot view it as a guest. Well, you clicked on the link.

By clicking on it, the Administration Panel can probably sense that it's viewing something when it really isn't. If you still do not understand, I will try to make this as more clearer as possible. Alright, let's say I gave you a link to my forums rules. You then click on the link, oh wait you cannot view it. Yes, guest CANNOT view it, but by clicking on the link. You redirect to the forum rules. So yes, the Administrator Panel can sense that a guest is viewing it, even though the guest cannot actually view it. The guest clicked on the link.

Which will make it feel like they really are viewing. If you do not understand this, than I am sorry. I have no other way to explain this. Though this many not be true. This is just a theory.

Edit: What slg said. They probably clicked on the link but they cannot actually, literally view it.


Many thanks to both of you.

I understood that. My understanding is better than my expression:) The case may really be an attempt to hack and that is exactly what I'm afraiding of. Of course, it also could be like you say, that the Administrator Panel can sense that a guest is viewing it, even though the guest cannot actually view it. Knowing, that the above listed IPs are already banned by me in my forum AND there will be another IPs next day just like everyday and they will be trying to view the same, I see the only solution - to ban the whole range 150.70.*.* and 216.104.*.*

Thanks again and have a good day.

acteeno
New Member

Male Posts : 15
Reputation : 0
Language : Lithuanian, English, Russian

Back to top Go down

Solved Re: Am I getting hacked?

Post by Maikeru Shinigami on May 21st 2011, 9:27 pm

This is what I said before:
Spoiler:
Sunagakure wrote:This isn't much of a problem. Just fix the problem on the Administrator panel. As for users having the same IP address. By using one or more different browsers, you can be on multiple accounts at the same time. As long as nothing major happens on your forum. There shouldn't be much of a problem.

Also, you can go check your forum security if anything has happened. First, you go to your Administrator Panel. Next, you click on Advance Mode, if it is already in advance mode. You do not have to do this. Then, you click on the category ''General''. Finally, you look on the next set of category called ''Forum''. Look for the word security. Click on it, and scroll down to the bottom.

After you perform these steps. You can see which specific member has done anything on the Administrator Panel. So you can tell if a hacker did it or not. Hope this helped!

Check your security for any attacks that has happen. So you can view & figure out which IP actually hacked your account, & had access to your forumotion forum.

Maikeru Shinigami
Forumember

Male Posts : 120
Reputation : 10
Language : English
Location : Location Location Awesome Level: 9,001

Back to top Go down

Solved Re: Am I getting hacked?

Post by DarkGlow on May 21st 2011, 9:29 pm

Glad we'd helped you!

DarkGlow
Forumember

Male Posts : 629
Reputation : 92
Language : English | Hebrew | Arabic
Location : Israel

Back to top Go down

Solved Re: Am I getting hacked?

Post by acteeno on May 21st 2011, 9:32 pm

Sunagakure wrote:This is what I said before:
Spoiler:
Sunagakure wrote:This isn't much of a problem. Just fix the problem on the Administrator panel. As for users having the same IP address. By using one or more different browsers, you can be on multiple accounts at the same time. As long as nothing major happens on your forum. There shouldn't be much of a problem.

Also, you can go check your forum security if anything has happened. First, you go to your Administrator Panel. Next, you click on Advance Mode, if it is already in advance mode. You do not have to do this. Then, you click on the category ''General''. Finally, you look on the next set of category called ''Forum''. Look for the word security. Click on it, and scroll down to the bottom.

After you perform these steps. You can see which specific member has done anything on the Administrator Panel. So you can tell if a hacker did it or not. Hope this helped!

Check your security for any attacks that has happen. So you can view & figure out which IP actually hacked your account, & had access to your forumotion forum.

I did that right after you posted this. The forum looks like not hacked at the moment neither before. But someone is trying, probably.

Thanks again Wink

acteeno
New Member

Male Posts : 15
Reputation : 0
Language : Lithuanian, English, Russian

Back to top Go down

Solved Re: Am I getting hacked?

Post by MrMario on May 21st 2011, 11:45 pm

Solved => Locked

MrMario
Helper
Helper

Male Posts : 22186
Reputation : 1830
Language : test

http://test.com

Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum