locked out of my forum again!

Technical Details

Forum version : #phpBB
Position : Founder
Concerned browser(s) : Other
Who the problem concerns : Yourself
Forum link : highmercenaries.forumotion.com

Description of problem

hello, I linked people to my forum last night...

and once again, someone has changed my password and disabled the setting to reset admin password via email.

this has happened many times to me when using forumotion forums, can you please help me to get back into the forum and please fix this to stop it from happening?

There is clearly some kind of vulnerability in the forum that people can take advantage of.

hi

log in to your Forum Utilities and try to backup your forum
https://www.forumotion.com/utils
you can still have use of that tool so try to log in to your admin panel and fix the problem

that does not work...

someone, has logged into my forum via a hack, changed my password, and changed the setting to disallow admin password reset via email...

this has happened before, the person who helped me here said there was no log or sign of it happening in the log... but the person who did it made a post to gloat about it...

check my PMs

this page you linked does not work!

the guy who does this, I know him irl,

I have 2 forums with forumotion and he has always done this on both of them, he thinks it is funny.

he has always been able to do it... I don't know how he does it, but every time he feels like it - he locks me out of the forums.

He is probably not the only person who knows how to do this... and he is not online so I can't ask him if it was him on this occasion.

Please don't double post. Your posts need to be separated by 24 hours before bumping. Please use the edit button, instead!

Follow this tutorial https://help.forumotion.com/t127211-password-problems-or-lost-your-founder-s-password

Could you please post the URL of the forum in order for us to check through our internal tool?

Best regards

skouliki wrote:Please don't double post. Your posts need to be separated by 24 hours before bumping. Please use the edit button, instead!

Follow this tutorial https://help.forumotion.com/t127211-password-problems-or-lost-your-founder-s-password

/facepalm there is no point in me editing a post if you are currently reading it... "no double posting" honestly...

he has changed the password, this does not work, as I already said!

read all the thread and do the last step

mpelmmc wrote:Could you please post the URL of the forum in order for us to check through our internal tool?

Best regards

the url is in the first post here... highmercenaries.forumotion.com

The link @skouliki has given to you its for when you lost or forgotten your forum password. Please read it.

mpelmmc wrote:The link @skouliki has given to you its for when you lost or forgotten your forum password. Please read it.

then perhaps he could try to read slower, because it clearly says " someone has changed my password and disabled the setting to reset admin password via email." in the first post.

If you send me a PM with the information requiered I might be able to send you a new password if the data you provide is correct

mpelmmc wrote:If you send me a PM with the information requiered I might be able to send you a new password if the data you provide is correct

I have sent PMs to 3 admins, including you now, but they do not get sent... they get held up in the "out" box.

thank you for the new password, now how do I stop this from happening again in the future?

1.- Skouliki is a woman and you treated her as "he". Perhaps you could try to read slower the others members profiles so you know how to mention them.

Do you see how this feels? You treated us like such. We are here to HELP you. Trust us, we will help you better if you treat us respectfully. As we do with you .

2.- In the topic you've just read, it says clearly that you have to send the information to just 1 member. You have sent the data to 4 people according to your post and that's not something you can do. Please read carefully the post we give to you to read.

3.- I have sent a new password to the email.

Please don't double post. Your posts need to be separated by 24 hours before bumping. Please use the edit button, instead! Please read our forum rules:  ESF General Rules

this is now your 1 warning

he/she, do you expect people to read the profiles of everyone before posting a message in reply to them?

it is not clear by reading the name. Never seen this name before and it looks masculine to an English speaker.
Are you telling me to apologise? ok, sorry it looks like a masculine name to an English speaker. Easy assumption to make, ok, sorry for assuming... why would anyone get offended by this?

Do I see how what feels? I haven't treated you like anything!

The forum treats me (and everyone else) as a spammer by default, and blocks our PMs from going to the admins. Unless we make a thread first, then you do not even look at our outbox message. I did not know this until I sent 3 messages, tried to make a topic, which did not work, no matter how much I hit the post topic button... so I had to use a different web-browser to even create this topic. I normally use internet explorer but had to use edge to make the topic.

So, what do you expect? For people in my situation to be a mind reader, or to have magical powers?

I think you should come up with a better way for people to get support than expecting them to post a topic before someone will reply to their PM. If you treat people like spammers by default, then expect them to spam!

I said thanks for the new password, so how do I stop this hacker or these hackers from changing my password in the future? Because it seems that the only way I could prevent this from happening would be to delete the forums I have.

skouliki wrote:

Please don't double post. Your posts need to be separated by 24 hours before bumping. Please use the edit button, instead! Please read our forum rules: ESF General Rules

this is now your 1 warning

O and your forum police treat people like criminals over an absolutely pathetic rule... get a grip on your life and stop giving people infractions over this. it happens! find something better to do with your time.

Honestly, giving me a warning for thanking someone... I clearly was not "bumping" the topic.

"Bumping" is attention seeking, I was not seeking attention, I don't even want this attention, - I was forced to seek some attention by a hacker. Then I was forced to make a topic by your insufficient and extremely odd support system.

Now how do I stop this person from hacking my forum and changing my password - each time they want to laugh?

these are the rules try to follow them please 
we are here to help you ..let us do our job

skouliki wrote:these are the rules try to follow them please 
we are here to help you ..let us do our job

The rules tell you to treat me like a spamming attention seeker by default? nice rules, try spending your time to think of a better set of rules that wastes less of your time.


I still don't see anyone helping me to secure my forum to prevent reoccurrences of this same issue.

This has happened before.

It seems easier for me to contact the guy who hacks the forum and get him to let me back in?

You have to be patient , we all work voluntarily here 
We are not going to discuss about the forum rules, these are the rules

skouliki wrote:You have to be patient , we all work voluntarily here 
We are not going to discuss about the forum rules, these are the rules

I didn't ask you to discuss the rules, I asked you to think about making some better rules, that waste less of your time. In every single forum in the world, people sometimes double post... so what? get over it already. Obviously if someone is spamming then ban them, but if not then what is the point in upholding this - to a point where it vilifies people for no reason? I am sure you are not a bunch of jobsworths' if you do it for free?

I am being patient, I have been using the forumotion forums since 2008, and this hack or security vulnerability has been used by people since 2008. So how can I prevent people from locking me out of the forum, by changing my password and the forum's security settings?

ronjambo wrote:

skouliki wrote:You have to be patient , we all work voluntarily here 
We are not going to discuss about the forum rules, these are the rules

I didn't ask you to discuss the rules, I asked you to think about making some better rules, that waste less of your time. In every single forum in the world, people sometimes double post... so what? get over it already. Obviously if someone is spamming then ban them, but if not then what is the point in upholding this - to a point where it vilifies people for no reason? I am sure you are not a bunch of jobsworths' if you do it for free?

I am being patient, I have been using the forumotion forums since 2008, and this hack or security vulnerability has been used by people since 2008. So how can I prevent people from locking me out of the forum, by changing my password and the forum's security settings?

For preventing something like this here are a few things you can do, don't share passwords with other people, don't use the same password across multiple websites, and if you get back into your account don't change the password right back. Completely make a new password. If you feel you were hacked, run any sort of anti-malware software you may have to clean up any unneeded or malicious files on your computer that may be the root of this issue.

Forumotion appreciates your time and loyalty you have shown being a valued user since 2008 and I myself and sorry you are dealing with this. I hope that some of my tips help with this as I have had issues like this on a different forum software in the past and those are the steps that helped me fix this issue for myself.

Cheers,
James

it isn't my password that causes the issue... or due to malware...

he knows how to break in to the forum undetected. Admins here can see my PMs to confirm this.

ronjambo wrote:

skouliki wrote:You have to be patient , we all work voluntarily here 
We are not going to discuss about the forum rules, these are the rules

I didn't ask you to discuss the rules, I asked you to think about making some better rules, that waste less of your time. In every single forum in the world, people sometimes double post... so what? get over it already. Obviously if someone is spamming then ban them, but if not then what is the point in upholding this - to a point where it vilifies people for no reason? I am sure you are not a bunch of jobsworths' if you do it for free?

I am being patient, I have been using the forumotion forums since 2008, and this hack or security vulnerability has been used by people since 2008. So how can I prevent people from locking me out of the forum, by changing my password and the forum's security settings?

Please don't attack or question a staff member publicly. If you disagree with a decision we make, feel free to pm us and politely discuss it. We don't make the rules, we just enforce them. Dis respecting or attacking staff is a very serious offense and one we do not take lightly. We are volunteers who are here to help, we do not appreciate being dis respected when we are only try to help you. Consider this your one and only break from me, next time it will be a warning, please do not do it again.

Now on to your issue, as I stated in my pm to you, when people hack into your forum it is usually because they are guessing your paasword. Not breaching our servers (I have yet to hear of a case of this happening in the entire 3 years I been staff). As Jadster said, once I send you a new password, you should create a completely new password that is both unique and secure (with capital letters, symbols and numbers).

I understand your frustation at being hacked repeatedly, however, I can assure you there are no breaches to our service, our servers or our database.

I didn't attack or disrespect, I said "I am sure you are not..." The sad thing about this is that if you ban me from here - I would not be able to get support for my forums. So this support system does not make much sense at all.

As I said, it is not due to my password. This guy gets straight in to the admin panel and I do not know how he does it.

I don't even know if it was him on this occasion.

It came across like it was though. Be mindful, all of us (against the godfather) are volunteers here and we come on to help people in our free time. Please be mindful of that and be patient (as I said we are volunteers, who have real jobs, lives and families outside of here to attend to).

Anyway, I have been on staff a little over 3 years now, I have handled hundreds of password resets and over a dozen hacking situations over the course of that time, out of every case I have ever treated, its ALWAYS been a case of someone guessing their password. After I send them a new password, the problem never happens again.

So far, you are the only one to report anything like this, if there was a breach like you claim, don't think there would be dozens of reports like yours? Furthermore, why does this 'guy' only seem to target your forum?

I am not trying dismiss your claim in anyway, I am just simply pointing out that if there was indeed a breach, other people would almost certainly be effected and report such to us. So far you are the only one.

Our systems are monitored and maintained24/7 by a major datacenter (who I am sure uses some sort of breach detection software to detect any holes or breaches). If there were any breaches, they would have been spotted and dealt with almost immediately. Certainly wouldn't have been able to go on 10 years (you claim this same breach has been effecting you since 2008) without being spotted and fixed.

I would encourage to try a strong password that is atleast 10 to 12 digits, with capital letters, numbers and symbols in them and that is unique to just your forum. Every case I have ever treated, after a strong password put in place, the problem never happens again.

You should also change the utilities password (it doesn't auto change when you change the forum password) and change your password as well. If the hacker is able to guess any of those 3 passwords (forum, utilities, or email) they can gain access to your admin panel and cause these problems.

Hello can we all calm down here

I will personally take over the support on this BY PM.
If that is ok with you @ronjambo

I will talk you over some steps to stop this from going on again.

you will get a NEW PM from me really soon.

APE

@brandon_g, he used to do it on my forum(s) = he does it as a joke, and since he does no damage other than locking out admins, I have never had a need to report it to you. The last time he did it, I came here for help.

I can assure you that he does not know my passwords.

I believe he does it from his own account(s). The most he would say is that he can do it on this phpbb version.

@APE ok, thanks.

Please Read These:

https://help.forumotion.com/t11386-forumotion-maximum-security-for-your-forums

https://help.forumotion.com/t51-internet-security-on-your-forum-habits-to-be-avoided

https://help.forumotion.com/t75418-my-forum-was-hacked

https://help.forumotion.com/t60088-i-ve-received-a-message-from-forumotion-is-it-true

https://help.forumotion.com/t145847-help-keeping-your-forum-account-safe-from-hackers#999631

I am helping the member BY PM to stop he's problems.

my other advice is to ban this members own account's and IP ban him and Email address.