Am I getting hacked?

Hi,

There is a problem in my forum.

First of all, only registered users can even see the board, while guests only face login window and no further. Registration is via my confirmation only.

Everyday in admin panel in the list of connected users I see one or two guests with almost the same IP addresses. Almost is only the last 2-3 digits are different. Their actions are searching within the board, looking up user list and other, that should not be available for guests. IP tools found those IP are have same ISP. If I ban those IP's, next day (but not the same) other IP from Trend Micro would apper an do the same.

What is that? How do they get to the users area?

Hi,

I don't actually have a solution to your problem... But, you'd get some assistance by setting the security for your forum via this link:


https://help.forumotion.com/t75418-my-forum-was-hacked

DarkGlow wrote:Hi,

I don't actually have a solution to your problem... But, you'd get sone assistance by setting the security for your forum via this link:


https://help.forumotion.com/t75418-my-forum-was-hacked

Thanks, but everything is already done before. Maximum security too. I have read lots of topics before registering.

____________________

Ohhhh, my big headache turned out to be the range of IP's of known spammers... Ok, IP ban and (hope so) at least temporary solved.

Maybe you should have another look at the permissions...

May I have a link to your forum?

If you have all your permissions right guest can't see anything, but the login page. Even if it says members list or a post. They can't. I wouldn't worry about it. There will be times that IP's are the same because they are using the same network or in the same house.

Look... You can't just disable the guests' ability from looking at the board (memberlist, login, register, calendar ...) that isn't possible.
You'd ensure that I'm right by going to:

1. ACP.
2. Advanced mode.
3. Users and Groups tab.
4. Special rights.

Take a look and you'll notice that you can not prohibit guests from seeing the board.

OK, the forum is at www.tkk.mums.lt (this will lead to http://bakin.findtalk.biz/login)

DarkGlow wrote:Look... You can't just disable the guests' ability from looking at the board (memberlist, login, register, calendar ...) that isn't possible.
You'd ensure that I'm right by going to:

1. ACP.
2. Advanced mode.
3. Users and Groups tab.
4. Special rights.

Take a look and you'll notice that you can not prohibit guests from seeing the board.

That's right, everything is set to Members or above.

The forum is of very narrow profile, only 52 registered users and I know almost all the IP's. The ones I was talking about in my very first post belong to known spammers as google says.

This isn't much of a problem. Just fix the problem on the Administrator panel. As for users having the same IP address. By using one or more different browsers, you can be on multiple accounts at the same time. As long as nothing major happens on your forum. There shouldn't be much of a problem.

Also, you can go check your forum security if anything has happened. First, you go to your Administrator Panel. Next, you click on Advance Mode, if it is already in advance mode. You do not have to do this. Then, you click on the category ''General''. Finally, you look on the next set of category called ''Forum''. Look for the word security. Click on it, and scroll down to the bottom.

After you perform these steps. You can see which specific member has done anything on the Administrator Panel. So you can tell if a hacker did it or not. Hope this helped!

Sunagakure wrote:This isn't much of a problem. Just fix the problem on the Administrator panel. As for users having the same IP address. By using one or more different browsers, you can be on multiple accounts at the same time. As long as nothing major happens on your forum. There shouldn't be much of a problem.

Also, you can go check your forum security if anything has happened. First, you go to your Administrator Panel. Next, you click on Advance Mode, if it is already in advance mode. You do not have to do this. Then, you click on the category ''General''. Finally, you look on the next set of category called ''Forum''. Look for the word security. Click on it, and scroll down to the bottom.

After you perform these steps. You can see which specific member has done anything on the Administrator Panel. So you can tell if a hacker did it or not. Hope this helped!

Thanks, but I am the only one administration member...

The thing is On-Line list sometimes but everyday shows one or two guests searching the forum or looking at the members list. Their IPs are listed on certain websites found on google as belonging to known spammers. I have no idea how could guest do this without an attack on the forum.

Everything, absolutely everything is set to zero permissions to guests, but they still do that. Few IP's from Japan, and few from US. All have Trend Micro as their ISP.

I have no ideas. The forum is almost one year old, I would like this ununderstandable thing not to affect it.

I know you are the only Administrator user, but by checking the category security. You can see which specific IP hacked your account, affecting the forums Administrator Panel. Though, to be honest. I do not quite understand your question.

But from the looks of it. I think it has something to do with this: http://www.free-hideip.com/products/free-hide-ip.html. If it has nothing to do with the link I provided. I have no idea on how to help you out, unless you make things a bit more clearer for me. Thanks.

Sunagakure wrote:I do not quite understand your question.

That is because of my English, probably.

Well, I' will try somehow. There are some guests with specific IPs:

150.70.97.37
150.70.75.37
150.70.172.108
150.70.64.197
216.104.15.130
216.104.15.134

Those IPs belong to spammers, I found it out today.

Normally in the administration panel you can see the on-line list, where you can see what a certain user is currently doing in the forum, right?

So those guests with the IPs listed above are reading the forum - guest are reading my forum, which is not alowed them to do by current forum settings. Even more, sometimes they are reading the memberlist. Meanwhile nothing is allowed for guests to do in my forum.

So the question is, how do they read forum and memberlist without permission?

Nothing else has happened to my forum yet, but may this be a beginning of hacking it?

It does not mean that guest are exactly seeing what they are looking at. They are probably getting a page that says, "You do not have permission to access this page."

Oh, now I understand it! I think I know whats the problem.

There can only be two reasons, to why a guest has the ability to view such content, that can only be viewed by certain types of users. Either the user is a hacker. Which is very, very common. Or the user has clicked a link that seems like it's real. For example, lets say I gave you a link to my site. But you cannot view it as a guest. Well, you clicked on the link.

By clicking on it, the Administration Panel can probably sense that it's viewing something when it really isn't. If you still do not understand, I will try to make this as more clearer as possible. Alright, let's say I gave you a link to my forums rules. You then click on the link, oh wait you cannot view it. Yes, guest CANNOT view it, but by clicking on the link. You redirect to the forum rules. So yes, the Administrator Panel can sense that a guest is viewing it, even though the guest cannot actually view it. The guest clicked on the link.

Which will make it feel like they really are viewing. If you do not understand this, than I am sorry. I have no other way to explain this. Though this many not be true. This is just a theory.

Edit: What slg said. They probably clicked on the link but they cannot actually, literally view it.

slg wrote:It does not mean that guest are exactly seeing what they are looking at. They are probably getting a page that says, "You do not have permission to access this page."

Sunagakure wrote:Oh, now I understand it! I think I know whats the problem.

There can only be two reasons, to why a guest has the ability to view such content, that can only be viewed by certain types of users. Either the user is a hacker. Which is very, very common. Or the user has clicked a link that seems like it's real. For example, lets say I gave you a link to my site. But you cannot view it as a guest. Well, you clicked on the link.

By clicking on it, the Administration Panel can probably sense that it's viewing something when it really isn't. If you still do not understand, I will try to make this as more clearer as possible. Alright, let's say I gave you a link to my forums rules. You then click on the link, oh wait you cannot view it. Yes, guest CANNOT view it, but by clicking on the link. You redirect to the forum rules. So yes, the Administrator Panel can sense that a guest is viewing it, even though the guest cannot actually view it. The guest clicked on the link.

Which will make it feel like they really are viewing. If you do not understand this, than I am sorry. I have no other way to explain this. Though this many not be true. This is just a theory.

Edit: What slg said. They probably clicked on the link but they cannot actually, literally view it.

Many thanks to both of you.

I understood that. My understanding is better than my expression:) The case may really be an attempt to hack and that is exactly what I'm afraiding of. Of course, it also could be like you say, that the Administrator Panel can sense that a guest is viewing it, even though the guest cannot actually view it. Knowing, that the above listed IPs are already banned by me in my forum AND there will be another IPs next day just like everyday and they will be trying to view the same, I see the only solution - to ban the whole range 150.70.*.* and 216.104.*.*

Thanks again and have a good day.

This is what I said before:

Spoiler:

Check your security for any attacks that has happen. So you can view & figure out which IP actually hacked your account, & had access to your forumotion forum.

Glad we'd helped you!

Sunagakure wrote:This is what I said before:

Spoiler:

Check your security for any attacks that has happen. So you can view & figure out which IP actually hacked your account, & had access to your forumotion forum.

I did that right after you posted this. The forum looks like not hacked at the moment neither before. But someone is trying, probably.

Thanks again

Solved => Locked