XF 1.4 IMMDEIATE HELP!

[Rum Runner Entertainment]

Someone was able to get into the admin panel of my forums and now is deleting everything.

Is there a way to protect this from happening andy I've also backed up everything on a hardirve? Please help.

Thank you,
Oren Segal

 

[AndyB]

Log into your Admin CP and change your password.

 

[Paul B]

Demote the administrator responsible.

Ensure all other administrators change their passwords.

 

[Rum Runner Entertainment]

Okay, somehow some of the accounts and the whole node tree was deleted.

Also, user groups were deleted. I've backed up everything lately, so is there a way to regain all of that information back regarding the CP user groups, node tree etc.?

 

[Rum Runner Entertainment]

I've checked, and I found that one of my administrators' accounts got hacked it makes sense now.

 

[imthebest]

If I were you, I'll just restore my most recent backup (both files and DB).

 

[Paul B]

so is there a way to regain all of that information back regarding the CP user groups, node tree etc.?

Not really.

You will need to restore from a recent backup.

 

[Rum Runner Entertainment]

Mhmm alright. Will that bring back deleted nodes and accounts etc.?

 

[Rum Runner Entertainment]

Not really.

You will need to restore from a recent backup.

Mhmm. That will bring back everything that was lost including members user groups etc.?

 

[Paul B]

It will restore the forum to the same state it was at when the backup was taken.

Any threads, posts or other content made since then will be lost.

 

[rdn]

I've checked, and I found that one of my administrators' accounts got hacked it makes sense now.

How?

 

[Rum Runner Entertainment]

How?

One of my administrator's accounts got 'hacked' and so that person immediately had access to the panel. He deleted the complete node tree, a few members, user groups and the moderators. I could clearly see that the person that to into the account didn't know how to use the admin panel, but I found out via the admin logs.

 

[TDUBS]

You can view the IP address and get an idea by checking your Admin logs or any other logs: http://www.forumurl.com/admin.php?logs/admin

Just look at their actions and you will see the IP address of them.

 

[Rum Runner Entertainment]

You can view the IP address and get an idea by checking your Admin logs or any other logs: http://www.forumurl.com/admin.php?logs/admin

Just look at their actions and you will see the IP address of them.

Yes, I know.

 

[Martok]

One of my administrator's accounts got 'hacked' and so that person immediately had access to the panel.

How exactly was it 'hacked'? Are they using a password that is easily guessed? Are they using the same password as they use on other websites?

It's important that you determine exactly how this happened, or it could happen again. If that answer is Yes to either of the two questions above then you need to have serious words with all of your admins about security.

 

[Rum Runner Entertainment]

How exactly was it 'hacked'? Are they using a password that is easily guessed? Are they using the same password as they use on other websites?

It's important that you determine exactly how this happened, or it could happen again. If that answer is Yes to either of the two questions above then you need to have serious words with all of your admins about security.

I'm not 100% sure on how that happened, but he managed to get into an account that had access to the panel, with a very little range of permissions so I'm thankful that no other 'damage' has been done besides what actually happened.

And yes, I agree. I shouldn't have left that account as an administrator because it was unnecessary and was barely being used.

 

[Amaury]

then you need to have serious words with all of your admins about security.

Precisely why I did this at 1:18 AM in March 2013.

 

[Martok]

Precisely why I did this at 1:18 AM in March 2013.

View attachment 84755

I hope you have password protected the ACP too and change the password for this on a regular basis.

 

[Erik P.]

I would suggest you not give public accounts admin access if you can't count on them using security best practices like not reusing passwords or choosing good ones.

Another thing you might want to do is deny access to admin.php to all but localhost/127.0.0.1 (in apache/.htaccess config) and then use an ssh tunnel to access the admin.php page from the server via the tunnel. That will allow you to restrict access to only those with ssh access. Accessing admin.php from the Internet should result in a 403 Forbidden response. You can find specific instructions with google.

 

[Amaury]

I hope you have password protected the ACP too and change the password for this on a regular basis.

I'm not sure, but I don't think so, though we've been fine, so...

I'll have to check with @Nights as that would be his area of expertise.