XF 1.5 Third time who i 'am hacked ...

[Sc0rps]

Hello all ,

today is the third time who i got hacked .... my forum got hacked every time who i restaure it ...! all my add on is payed ... ma license is 100% authentique and have 7 month more to renew it ...

i really dont know what to do ... i restaured it one week ago and now , i got hackd again ...

here is my forum : https://virtual-gaming.fr/

i afraid to finish to regret that i came to xenforo ..

if someone can help me , thanks alot

 

[Paul B]

I have responded to your ticket.

 

[Sc0rps]

people asked me about X add on , that here have fail ..

 

[Chris D]

If you are claiming that a resource hosted here has vulnerabilities then please follow these guidelines: https://xenforo.com/community/help/resource-vulnerabilities/

 

[Sc0rps]

someone have advice how i can secure my forum for all deface ? ... all my add on and all is authentique ... nothing is nulled ..

 

[whynot]

someone have advice how i can secure my forum for all deface ?

Don't let anyone access your site's or the forum's control panel.
Take care with addons.

 

[tenants]

Uninstall all addons and third parties, and identify the issue

I have seen security issues in addons in the past, I have pointed them out and they have gotten fixed. You need to track down the issue, it does not matter if they are not nulled, authentic addons can/will have security issues, particularly when written by inexperienced devs that are just learning the ropes

xenforo take no responsibility for addons, xenforo do not develop or maintain other peoples addons, you purchase / use these at your own risk

 

[Paul B]

As I said in the ticket, the vast majority of cases we have dealt with have been due to password re-use or insecure servers/other software (e.g. WP) installed on the server.

A competent sysadmin should be able to investigate and discover how they gained access.

 

[Sc0rps]

thanks for the advice bro , but anyone have access and all add on came from xenforo.com ..

 

[Sc0rps]

and can i get help here from someone who is competent ? ... it can be very nice if someone can check for me about faill ..

 

[Robru]

but anyone have access

Who has access to your ACP?
And via (S) FTP?
Make use of strong passwords. Better is 2FA
Which OS software is running on the server and which versions
Also for PHP, Database etc.

 

[Sc0rps]

it was only my best friend (who is like my brother) . but now i changed all but am sure that i will be hacked again ...

here is my forum : www.virtual-gaming.fr

someone can check and see if here a secure problem ...

thanks alot

 

[Optic]

You really need to check logs to find the source of entry and see if your account or your "best friend's" account was compromised.

In XF check admin logs and moderator logs (any suspicious template edits/activity?)
/admin.php?logs/admin
/admin.php?logs/moderator

If that looks OK you also need to check server level logs (if there is SSH/root access - who last logged in? Was it a different IP than what they normally have? When did they log in, what did they change, etc.) Maybe there is a backdoor on your server. If you don't know how to do this you need to escalate to your host / a sysadmin to investigate closely.

 

[Sc0rps]

But the problem is when i got defaced ... i can't access to my panel to check cause all had been hacked ...
so idk how we should check of this ..

i think i have a virus on ftp or on the mysql injected ...

anyone can help me to fix this ? ..

 

[Optic]

Next time if it happens you need to get it investigated by a specialist or your host.

Don't wipe it or restore your backup.

Take it offline, quarantine it and investigate:
https://developers.google.com/webmasters/hacked/docs/quarantine_site
https://developers.google.com/webmasters/hacked/

This is what others have said above, you need to investigate how it happened.

 

[Sc0rps]

When it will happen again , is it possible to get your help to check of it please ? ..

 

[Optic]

Sorry, I'm not a sysadmin.. you are paying your host for support yes? They would be the best ones to ask.

 

[Sc0rps]

my host can't do anything ..

 

[tajhay]

t all add on came from xenforo.com ..

are you sure about that???

the following page would suggest otherwise:
https://virtual-gaming.fr/?_debug=1

btw you might want to turn debugging off...

 

[whynot]

But the problem is when i got defaced ... i can't access to my panel to check cause all had been hacked ...

It means that your hosting account is accessed by someone not only your forum.
How can they do it?
Tayhay gave you the clue: br....