Author Topic: GBO Accounts ARE under Attack!!! READ THIS!!! (Read 3528 times)

quickdtoo · « **Reply #30 on:** February 03, 2011, 01:31:32 PM »

Quote from: carbineman on February 03, 2011, 01:18:30 PM

Tried changing mine, and now it won't take my new or old password to make changes. I'm now out of ideas. I should have just left it alone! Well if I can't get back on it was nice while it lasted.

Check your email.

Tim

Quote from: Matt on February 02, 2011, 08:37:43 PM

I have added new security features that will allow 3 login attempts then lock the account. After that you should get a link that will allow you to override it if you are a real person and have proper user name and password using SSL (secure login.)
I have also added a feature that will allow you to lock your account to your IP if you have a static or persistent IP and you can add multiple IP's if you like. it also has a method for you the user to get around if need be.
more to come...

Matt

kid_couteau · « **Reply #31 on:** February 03, 2011, 01:32:54 PM »

Here is a tracert on it.

Tracing route to 95.143.193.145 over a maximum of 30 hops

1 4 ms <1 ms <1 ms 192.168.200.100
2 22 ms 10 ms 9 ms 10.96.192.1
3 12 ms 19 ms 32 ms g5-2-17.prismedr-rtr001.ne.northeast.rr.com [24.
31.155.150]
4 27 ms 19 ms 15 ms rdc-204-210-71-18.ne.northeast.rr.com [204.210.7
1.18]
5 15 ms 28 ms 14 ms rdc-204-210-69-144.ne.northeast.rr.com [204.210.
69.144]
6 27 ms 28 ms 22 ms g10-7-1-0.ptldmehx-rtr001.ne.northeast.rr.com [2
04.210.69.202]
7 34 ms 38 ms 28 ms rdc-204-210-69-49.ne.northeast.rr.com [204.210.6
9.49]
8 51 ms 63 ms 71 ms ae-5-0.cr0.nyc30.tbone.rr.com [66.109.6.74]
9 43 ms 38 ms 39 ms ae-1-0.pr0.nyc20.tbone.rr.com [66.109.6.163]
10 39 ms 41 ms 41 ms Te7-4.ar1.NYC8.gblx.net [208.48.23.1]
11 136 ms 141 ms 134 ms po1-40G.ar1.ARN3.gblx.net [67.17.109.213]
12 163 ms 152 ms 159 ms IP-ONLY-TELECOMMUNICATION.Te7-3.ar1.ARN3.gblx.ne
t [64.215.28.18]
13 132 ms 133 ms 132 ms sesto0001-rc3.ip-only.net [82.99.32.121]
14 147 ms 144 ms 145 ms 213.132.98.114
15 151 ms 152 ms 161 ms 95.143.207.242
16 159 ms 172 ms 165 ms 95.143.193.145

Trace complete.

Might help
Kid

gunther66 · « **Reply #32 on:** February 03, 2011, 01:39:10 PM »

I saw a carbineman on the hack list.Does this mean anything?

quickdtoo · « **Reply #33 on:** February 03, 2011, 01:42:49 PM »

That's just one IP, there were 60 pages of different IPs making the attack last night, those I checked were Germany, Chicago IL, France, Russia, and Canada.

Tim

bikerbeans · « **Reply #34 on:** February 03, 2011, 02:06:35 PM »

Matt,

We have the option of logging into GBO, checking a box, and staying logged in if we want to. In light of these attacks should we log out at the end of each session and then login again later?

BB

Matt · « **Reply #35 on:** February 03, 2011, 03:59:59 PM »

Quote from: bikerbeans on February 03, 2011, 02:06:35 PM

Matt,

We have the option of logging into GBO, checking a box, and staying logged in if we want to. In light of these attacks should we log out at the end of each session and then login again later?

BB

that is just a cookie on your computer and only opens you up if your computer is exposed to someone you dont want on your account.
Matt

mauser98us · « **Reply #36 on:** February 03, 2011, 05:20:28 PM »

Graybeard · « **Reply #37 on:** February 03, 2011, 05:49:16 PM »

Quote from: Lon371 on February 03, 2011, 12:32:53 PM

According to Google the attack is coming from Sweden. Do we have a member from sweden? Someone who can go give them a boat oar upside the head?

Lonny

Yes I think we have at least three GBO members from Sweden who post fairly regularly here.

billy_56081 · « **Reply #38 on:** February 03, 2011, 06:23:15 PM »

Thanks Matt, done!

trotterlg · « **Reply #39 on:** February 03, 2011, 07:48:00 PM »

Quote

that is just a cookie on your computer and only opens you up if your computer is exposed to someone you dont want on your account.
Matt

Then why do you put the cookie on our machines if it only is used by someone you don't want on our accounts? Larry

P.A. Myers · « **Reply #40 on:** February 03, 2011, 10:15:43 PM »

EZ strong password:

1- Start with a word or phrase that you can connect to its use [ gboforum ]
2- Upper case some letters [ gBOForUm ]
3- Add some numbers [ g2BOFor57Um4 ]
4- Add some characters [ ;g2//BOF?or57,Um=4 ]
5- Learn to cut and paste so you dont have to type this mess.

You can still identify its use and is quite secure.
Your user name for login can be different from your forum handle, mine is.

Too bad we cant feedback high voltage, 30kAC should do.

P.A.

Matt · « **Reply #41 on:** February 04, 2011, 04:10:12 AM »

Quote from: trotterlg on February 03, 2011, 07:48:00 PM

Quote
that is just a cookie on your computer and only opens you up if your computer is exposed to someone you dont want on your account.
Matt

Then why do you put the cookie on our machines if it only is used by someone you don't want on our accounts? Larry

Larry, I will say this once and that is it. I have way to much stuff to be worrying about to waste my time with you so if you want to be a pain in the ass go do it somewhere else.

Now if you will read what you quoted again maybe you can understand it better.

I said that the "Keep Me Logged in" feature is just a cookie that is placed on your system so that you don't have to log in every time from that system. The only way it is a security risk is if YOU let someone on YOUR computer that YOU don't want using YOUR GBO account.

So now , I don't know what your problem is with GBO and at this point really don't give a damn so either get over it or get off here your choice...
Matt

Big Blue · « **Reply #42 on:** February 04, 2011, 05:25:55 AM »

Matt,
We all understand that your busy and sure appreciate all your doing, but I'm sure Larry just didn't understand and meant no offense.
Don

skarke · « **Reply #43 on:** February 04, 2011, 05:45:32 AM »

Changed mine to.........something else

Matt · « **Reply #44 on:** February 04, 2011, 05:56:01 AM »

Quote from: Big Blue on February 04, 2011, 05:25:55 AM

Matt,
We all understand that your busy and sure appreciate all your doing, but I'm sure Larry just didn't understand and meant no offense.
Don

and if that is the case then my apologies for snapping, but if not...

Jimbo47 · « **Reply #45 on:** February 04, 2011, 06:19:43 AM »

I changed mine and everything worked fine yesterday, and then it logged me out.

When I tried to log back in this morning it wouldn't let me. I tried several times and I know I had the right password and even tried the "forget your password" route.

Re tried the whole rigamaroll again and somehow it finally let me log in so here I am.

I'm kind of afraid to log out now fearing it won't recognize me again, and when it does that you can't log in or even ask for assistance.

I'm hoping it's resolved or I might slip off into that black hole again!....Panic!!!

Matt · « **Reply #46 on:** February 04, 2011, 06:41:33 AM »

IP's now listed in Server Black List:
41.204.167.5,
65.183.151.13,
66.230.230.230,
68.8.221.219,
78.47.244.106,
80.62.217.18,
83.142.228.14,
89.253.105.39,
95.143.193.145,
114.32.122.58,
173.193.221.28,
188.72.132.2,
192.251.226.206,
199.48.147.41,
209.159.143.130
These IP's have been added to DENY on the servers IPtables and are blocked from accessing the server. There are still more that I will be adding in an attempt to slow the attack but again the best thing to do is set a strong password.

Quote from: Jimbo47 on February 04, 2011, 06:19:43 AM

I changed mine and everything worked fine yesterday, and then it logged me out.

When I tried to log back in this morning it wouldn't let me. I tried several times and I know I had the right password and even tried the "forget your password" route.

Re tried the whole rigamaroll again and somehow it finally let me log in so here I am.

I'm kind of afraid to log out now fearing it won't recognize me again, and when it does that you can't log in or even ask for assistance.

I'm hoping it's resolved or I might slip off into that black hole again!....Panic!!!

Dont feel bad it done the same thing to me this morning, not sure what the problem was but on my third try it let me in.

Matt

Dinny · « **Reply #47 on:** February 04, 2011, 10:25:14 AM »

Too easy, mine's changed!

Thanks, Dinny

Graybeard · « **Reply #48 on:** February 04, 2011, 12:43:31 PM »

Quote from: Big Blue on February 04, 2011, 05:25:55 AM

Matt,
We all understand that your busy and sure appreciate all your doing, but I'm sure Larry just didn't understand and meant no offense.
Don

Considering Larry's history of challenging every single thing we do I kinda doubt it was a lack of understanding on his part. He seems to me at least to have a deep seated discontent with the way we run this site but wishes to remain here for his personal benefit and to challenge us. It's really getting old.

frgerald · « **Reply #49 on:** February 04, 2011, 02:09:15 PM »

Bill,
You run a GREAT site, and the information found here is invaluable. Thank you for all your very obvious hard work!!

Matt,
I changed my PW as instructed, it went smooth as silk and has never given any trouble on subsequent log-ins.

Thx,
Fr. Gerald

gendoc · « **Reply #50 on:** February 04, 2011, 02:16:29 PM »

gotter dun... so easy an ol'cajun can doit

for all yall do, thank ya !!!!

bigbird09 · « **Reply #51 on:** February 04, 2011, 04:44:32 PM »

Quote from: trotterlg on February 02, 2011, 07:33:28 PM

Guess I will just have to see what I loose on this one. Sorry we are all under attack, but I am also sorry that I may have placed myself in the postion of having personal information on a site that was not properly secured. The internet is very much like a border town, hope you learn something from this, I have. Larry

Doesn't matter how secure it is, if someone want to hack it they can. Sites get hacked everyday, most of the time they don't tell ya, it was nice of Matt to let us know to better protect us. Even the Pentagon has been hacked a few time, but they also see hundreds of threats a day. The only way to protect your self on the internet is to make sure that your passwords are strong, random, and perferably don't use the same password more than once.

carbineman · « **Reply #52 on:** February 04, 2011, 05:15:57 PM »

Matt, Tim, and slowhandd, Thanks for your assistance, I appreciate it.......carbineman

quickdtoo · « **Reply #53 on:** February 04, 2011, 08:15:09 PM »

Just glad you're back!!

Tim

Harker · « **Reply #54 on:** February 20, 2011, 09:16:56 PM »

Hi all.

I found your forum when I noticed my own forum was under attack and used Google to see if anybody had an answer to the problem. I've blocked dozens of these ip addresses so far, and I've advised my members to change their username (different from their display name), but that can only be done through admins. That way the bots don't even have a place to start, because the username (display name) they try to use doesn't exist.

I think they started because there was a vulnerability in SMF the hackers were trying to exploit. The patch was released on 11th Feb.

Have your attacks stopped yet, or are they still going on? Just wondering how long I have to put up with it before they give up and go away.

dw06 · « **Reply #55 on:** February 21, 2011, 02:31:24 AM »

Thanks for the heads up. Password change is done!

oldsoldja · « **Reply #56 on:** February 21, 2011, 10:23:21 AM »

i always use 12345678 as my password for everything, no hacker has ever thought that simply.

doh. j/k

Graybeard · « **Reply #57 on:** February 21, 2011, 12:46:10 PM »

I discussed this with Matt today. He says attempts are now down to under 200 per day. At the peak they were around 18,000 per hour. With a site the size of GBO I don't think there will ever be a time when someone isn't trying to hack us it's just that the vast majority can't do it. I dunno what your site is or how large but if it's a big site you likely will never see a complete end to hack attacks same as us.

Quote from: Harker on February 20, 2011, 09:16:56 PM

Hi all.

I found your forum when I noticed my own forum was under attack and used Google to see if anybody had an answer to the problem. I've blocked dozens of these ip addresses so far, and I've advised my members to change their username (different from their display name), but that can only be done through admins. That way the bots don't even have a place to start, because the username (display name) they try to use doesn't exist.

I think they started because there was a vulnerability in SMF the hackers were trying to exploit. The patch was released on 11th Feb.

Have your attacks stopped yet, or are they still going on? Just wondering how long I have to put up with it before they give up and go away.

Harker · « **Reply #58 on:** February 21, 2011, 01:17:08 PM »

Quote from: Graybeard on February 21, 2011, 12:46:10 PM

I discussed this with Matt today. He says attempts are now down to under 200 per day. At the peak they were around 18,000 per hour. With a site the size of GBO I don't think there will ever be a time when someone isn't trying to hack us it's just that the vast majority can't do it. I dunno what your site is or how large but if it's a big site you likely will never see a complete end to hack attacks same as us.

Quote from: Harker on February 20, 2011, 09:16:56 PM
Hi all.

I found your forum when I noticed my own forum was under attack and used Google to see if anybody had an answer to the problem. I've blocked dozens of these ip addresses so far, and I've advised my members to change their username (different from their display name), but that can only be done through admins. That way the bots don't even have a place to start, because the username (display name) they try to use doesn't exist.

I think they started because there was a vulnerability in SMF the hackers were trying to exploit. The patch was released on 11th Feb.

Have your attacks stopped yet, or are they still going on? Just wondering how long I have to put up with it before they give up and go away.

18,000 per hour??? That's incredible. Mine is only a small site, and the problem is a relatively small one compared to the numbers you're talking about. We've had several of the same ip addresses you've had, though, which makes me think it will probably get worse yet. It was starting to slow down.

Thanks for the info.