Someone is attempting to hack into my forum

First topic message reminder :

Hi, my forum link is www.our4tnz.com Someone came onto my forum on a guest board and started insulting us and when I banned his IP he got on on a proxy server and started saying he was going to hack into my forum. Here is the link to the topic where he said he was going to hack.

http://www.our4tnz.com/t4777p30-hi-guests

Here are some of his messages quoted

Toomuch wrote:"Anybody worth banning will evade it."

- z33

Anyways, Brianman is a humorless [Language] who felt like banning me. I'm trying to get Slowloris to work, but it's written in Perl (*gag*). If there's an option to change the HTTP header message, I'll be sure to set it to "Your extra-large Dead [Language] has arrived. That will be $5."

Just for you guys.

Toomuch wrote:Slowloris is the best denial-of-service tool of all time. Back before I left 4chan, I actually managed to convince all of /b/ to use it in place of LOIC and HOIC in Op9gore.

Slowloris is fantastic because as long as the attacking machine is still kicking, it will be holding sockets from valid users. My server can whore about 300 sockets before it runs out of memory. The defending server will put up a fight, but Slowloris will slowly and surely win.

HTTP headers are the head part of an HTTP packet. When Slowloris is stopped, it sends as many 200 OK headers as sockets it has absorbed.

I need to make sure this guys doesn't hack my forum. Can anyone here help me. Also, I have his IP address, the one he originally used, and have his ISP and other stuff from it. Should I report this guy?

Darren1 wrote:TyManGFx, Please stop requesting activation, take it to PM's.
PriincessBrittany, please discuss that in PM's.
Thanks.

Chivas, nothing is not able to be hacked, everything can be hacked (Even red lights on thee roadway!), you just have to find the way. We also have some "seriously tough stuff" to prevent any hacking

As for guests numbers, it is possible, but then again, it could be your promoting work simply paying off. There's no way to tell.

So, just to be clear here. This is what I should do. Ban his IP address if he changes it again. Ban his hostname? How would I find out his hostname? Ban the proxy server if he attempts to use one again. Make sure he can't guess mine or the other admins passwords. And if he does manage to hack the forum use the utilities to do a restore?

May I request that if there is a forum where guests cannot see the topics, that this thread be moved to that forum? In case he's on here too and reading this

Ok I emailed you (:

To ban a host look in there ip address and it should say something like this
Country name: United Kingdom
Area: Kent
City: Royal Tunbridge Wells
latitude: 51.****
longitude: 0.2**3
Host: cpc*-tonb*-*-0-cust1**.croy.cable.virginmedia.com
IP: **.23*8.**.**7

This is a copy of my one but i have X'ed my IP for this forum
see where it says HOST you copy that code and out it in your ban list this will ban the host from your site But NOTE: any member on the same host IE virginmedia.com will also be banned so this should only be done if your 100% sure you want to do so as this may make members leave your site.

I think the best way around this would be to just stop Guests posting right now.

Ape

APE wrote:To ban a host look in there ip address and it should say something like this
Country name: United Kingdom
Area: Kent
City: Royal Tunbridge Wells
latitude: 51.****
longitude: 0.2**3
Host: cpc*-tonb*-*-0-cust1**.croy.cable.virginmedia.com
IP: **.23*8.**.**7

This is a copy of my one but i have X'ed my IP for this forum
see where it says HOST you copy that code and out it in your ban list this will ban the host from your site But NOTE: any member on the same host IE virginmedia.com will also be banned so this should only be done if your 100% sure you want to do so as this may make members leave your site.

I think the best way around this would be to just stop Guests posting right now.

Ape

I did copy that code but it didn't say "member banned successfully" like it usually does and the hostname didn't show up in the ban list.

All I can recommend is making your password as secure as possible. Combination of lower and UPPER case letters, numbers, and Symbols, such as £,^,*,) and so forth.

You don't need to do a restore unless you lose something. Banning a hostname in this case is pointless. (it can be difficult unless you know the right way to do so.) if he has already started the script, it won't run off is PC/Laptop alone, it has a secondary running location.

Disallowing guests will do nothing, as long as he can load your http:// URL he will attempt.

APE, sure you got the right flag?

Darren1 wrote:All I can recommend is making your password as secure as possible. Combination of lower and UPPER case letters, numbers, and Symbols, such as £,^,*,) and so forth.

You don't need to do a restore unless you lose something. Banning a hostname in this case is pointless. (it can be difficult unless you know the right way to do so.) if he has already started the script, it won't run off is PC/Laptop alone, it has a secondary running location.

Disallowing guests will do nothing, as long as he can load your http:// URL he will attempt.

APE, sure you got the right flag?

I still want to ban his hostname cause he changed his ip twice and came back on and posted again.

0h, I also have one more question. Most of my members don't hide their online status so they show up on the "who is online" map. I don't want this guy or any other potentially dangerous person from being able to see where my members are located, even though most of the time the map's inaccurate. How can I disable guests from being able to see this?

Brianman908 wrote:0h, I also have one more question. Most of my members don't hide their online status so they show up on the "who is online" map. I don't want this guy or any other potentially dangerous person from being able to see where my members are located, even though most of the time the map's inaccurate. How can I disable guests from being able to see this?

go to your ACP
on the home tab go right to the bottom and your see who is online
click More information your then see settings to stop anyone seeing this info but admins

APE wrote:

Brianman908 wrote:0h, I also have one more question. Most of my members don't hide their online status so they show up on the "who is online" map. I don't want this guy or any other potentially dangerous person from being able to see where my members are located, even though most of the time the map's inaccurate. How can I disable guests from being able to see this?

go to your ACP
on the home tab go right to the bottom and your see who is online
click More information your then see settings to stop anyone seeing this info but admins

Thank you

Can this topic stay open for a while in case something does happen to my forum?

The staff will not lock the thread unless you ask them to or mark it as solved

APE wrote:The staff will not lock the thread unless you ask them to or mark it as solved

Well I'd just like to be kept up that way if something happens I can come back to this topic instead of having to make a new one

The worst they can do is SQL inject the server

He may e-mail you a keylogger.If you get a random email with a download,dont download it

+Fusion- wrote:

Please don't post randomly

Yea this guy won't go away. He's on right now and he keeps using proxy servers. His latest Ip was this IP Hidden(since it's a proxy I'm guessing there's nothing wrong with posting it) This is the information I could find about it

IP: IP Hidden
Decimal: 2919159877
Hostname: exit-01d.noisetor.net
ISP: OC3 Networks & Web Solutions, LLC
Organization: Noisebridge

Rideem3 wrote:

Brianman908 wrote:Yea this guy won't go away. He's on right now and he keeps using proxy servers. His latest Ip was this IP Hidden(since it's a proxy I'm guessing there's nothing wrong with posting it) This is the information I could find about it

IP: IP Hidden
Decimal: 2919159877
Hostname: exit-01d.noisetor.net
ISP: OC3 Networks & Web Solutions, LLC
Organization: Noisebridge

Please don't post other people's IP Addresses! These are vital, and should remain private (proxy or not).

There is nothing we can do on our end for you. The only thing you can do is be aware. Otherwise, your forum isn't hackable especially with the measurements taken to prevent your own doing.

Is this solved?

It's not a real IP address. It's a proxy.

I probably have over 50 IP addresses banned on my forum

Rideem3 wrote:

Brianman908 wrote:

Rideem3 wrote:

Brianman908 wrote:Yea this guy won't go away. He's on right now and he keeps using proxy servers. His latest Ip was this IP Hidden(since it's a proxy I'm guessing there's nothing wrong with posting it) This is the information I could find about it

IP: IP Hidden
Decimal: 2919159877
Hostname: exit-01d.noisetor.net
ISP: OC3 Networks & Web Solutions, LLC
Organization: Noisebridge

Please don't post other people's IP Addresses! These are vital, and should remain private (proxy or not).

There is nothing we can do on our end for you. The only thing you can do is be aware. Otherwise, your forum isn't hackable especially with the measurements taken to prevent your own doing.

Is this solved?

It's not a real IP address. It's a proxy.

I probably have over 50 IP addresses banned on my forum

Any proxy is a real IP Address. It's just being hosted/served else where.

Now, is this solved because the rest is on your part.

Before you mark it as solved, tell me one thing. How do I ban a hostname?

I recommend you, that to stop worrying about this. Since (s)he is just making you worry and get scare. We have said in the previous messages, if they hack your forum they can automatically change the password. So please don't really about it.

Find more about how to ban a host name, on google mate. A better answer.

Sir Chivas™ wrote:I recommend you, that to stop worrying about this. Since (s)he is just making you worry and get scare. We have said in the previous messages, if they hack your forum they can automatically change the password. So please don't really about it.

Find more about how to ban a host name, on google mate. A better answer.

Google it? Ok

I'd like to share this link on here

http://www.teamavolition.com/topic/10875-kiddie-administrator-rage/page__st__40

Apparently the guy who said he was going to hack was on another forum talking about my site on there getting people to join. I wasn't sure if it was the promotion thread I had made on here or what, so I activated most of the accounts. But now I've deleted all the accounts I know they made and banned the IP addresses they had posted from.

Now my question is about something that the troll had actually said on there

Be sure to use Tor. If you're browsing as an anonymous user, change your ID after every page load so they won't be able to ban you in between.

Does anyone know what Tor is and if we can prevent him from posting on there as a guest with it? I have a board that guests can post on and that is the board he was using to post on. I don't want to prevent guests from posting on there, as that seems to be his goal, but I don't want him on there. I will continue to ban any IP addresses he uses to post from, but I want to know if there's anything forumotion can do on their end to prevent him from using "tor" whatever that is, to access my site

Rideem3 wrote:Have you Googled what Tor is?

You can't do anything to prevent them other than ban their IP's. If you feel so strongly about this, simply prevent guests from posting.

Eventually they will stop. What they are doing is immature and wrong, and all you can do is be patient, do what you can, and wait it out.

However there is nothing we can do on our end.

Is this solved? The most proper answer(s) have already been given.

what about blacklisting though? Can you guys blacklist the proxy they're using?

This is tor

http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29

Hi im just thinking when this member comes on your site and you ban him and he reset's he's ip address do the first numbers stay the same Bit like this
198.454.88.90
198.454.88.34
what i mean is the first 2 or 3 numbers if so you can range ban this number by putting this in the ip ban 198.454.88.* and save
This will ban any ip address that starts with this ip address in red
198.454.88.90
198.454.88.34

~Ape~

APE wrote:Hi im just thinking when this member comes on your site and you ban him and he reset's he's ip address do the first numbers stay the same Bit like this
198.454.88.90
198.454.88.34
what i mean is the first 2 or 3 numbers if so you can range ban this number by putting this in the ip ban 198.454.88.* and save
This will ban any ip address that starts with this ip address in red
198.454.88.90
198.454.88.34

~Ape~

When he was using his real IP it was staying the same. The first two numbers were 71 so I did ban a whole set of IPs with those first two numbers, but when he uses proxies they're always different

I guess I can check the ban list so far though and see what numbers appear the most

Rideem3 wrote:Moved to "Other Problems"

You still haven't answered our question: Is this solved?

We can't do anything else to prevent them from trying to hack your forum. Forumotion has done what they could to ensure the safety of your forum to the extent of not even allowing FTP, or access to your database.

I suppose it's solved