Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - Forum HACKED by account Guests
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Forum HACKED by account Guests

 Post Reply Post Reply Page  12>
Author
jwmagno View Drop Down
Groupie
Groupie


Joined: 11 October 2008
Status: Offline
Points: 33
Post Options Post Options   Thanks (0) Thanks(0)   Quote jwmagno Quote  Post ReplyReply Direct Link To This Post Topic: Forum HACKED by account Guests
    Posted: 25 November 2010 at 2:34pm

Last night a user hacked our forum using the account "Guests". They posted many messages and I'm not sure how they did that. What should I do? I have about 20 posts under this account.

We require registration for all posts so how did they use this account?
 
We are freaking out here we have used this forum for years and have paid for upgrades to stay current.
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 25 November 2010 at 3:17pm
I very much doubt the issue is due to the Guest account being hacked. Anyone not registered or logged in runs under the Guest Account so everyone has access to this account. 

Guests or in other words the Guests Account then has the same permissions placed on it any other account would, but with a few extra restrictions added such as not being able to send PM's and having to use CAPTCHA to post.

Guests can only post if the permission system allows Guest posting. Check both Group and Member permissions that some one has not mistakenly allowed Guests to post.

You may also be mistaken that a Guest has posted. If you delete a member from the admin area, so that topics do not get 'disjointed' with missing posts and posts created under the account would be shown as being posted by a 'Guests' once the member is deleted.

If you are not running the latest release you should also upgrade your forum as allot of work was done to protect the forum from cross form forgery requests where hidden links, images, forms, etc, can be used to trick a registered user in to submitting content of changing admin settings without them knowing.


Edited by WebWiz-Bruce - 25 November 2010 at 3:51pm
Back to Top
jwmagno View Drop Down
Groupie
Groupie


Joined: 11 October 2008
Status: Offline
Points: 33
Post Options Post Options   Thanks (0) Thanks(0)   Quote jwmagno Quote  Post ReplyReply Direct Link To This Post Posted: 25 November 2010 at 3:31pm
They used the account named "Guests". Yes that is plural. Trouble is I cannot delete this member. There is no Guest account when I search the member directory.
 
I just went in and changed the password for that account.
 
How do you explain the over 25 posts to that account? We are running 9.61.
 
Thanks for your help.
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 25 November 2010 at 3:50pm
Unfortunately without access to your forum, database, and log files I can not tell you what the issue might be.

As long as you keep Web Wiz Forums up to date there are no vulnerabilities that would cause this. Most of the time when people have these issues it's due to lack of security such as easy to guess passwords, giving admin access to other accounts, or bad security on the server.

If you have renewed your upgrade protection then you would have support as well and you should fill in a support ticket from your Client Area account so that we can go in and have a look at your forum and find what the issue is.
Back to Top
jwmagno View Drop Down
Groupie
Groupie


Joined: 11 October 2008
Status: Offline
Points: 33
Post Options Post Options   Thanks (0) Thanks(0)   Quote jwmagno Quote  Post ReplyReply Direct Link To This Post Posted: 25 November 2010 at 3:55pm
Can you at least tell me if "Guests" is a valid account? It's part of the Guest group.
 
 
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 25 November 2010 at 3:58pm
The built in 'Guests' account can not be deleted as all unregistered user run under this account. Without this account your forum would not run hence why you can not delete this account.

The only way for someone to have posts under the 'Guests' account is either a member was deleted and their posts have been updated to show as being posted under the 'Guests' account, or the Guest account was given 'Create New Topic' or 'Post Reply' permissions.
Back to Top
jwmagno View Drop Down
Groupie
Groupie


Joined: 11 October 2008
Status: Offline
Points: 33
Post Options Post Options   Thanks (0) Thanks(0)   Quote jwmagno Quote  Post ReplyReply Direct Link To This Post Posted: 25 November 2010 at 4:02pm
I think I know what happened now.
 
We had a spammer register in the forum under "course555". They then added a bunch of posts.
I went in and deleted the member since that would be easier than removing each one individually.
That explains how they all ended up in the "Guests" account.
 
Going forward what is the easiest way to batch delete spammer posts like this without deleting the member? Basically I want a batch way to delete all of a members posts.
 
Thanks for the assistance.
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 25 November 2010 at 4:15pm
The best thing to do is to suspend the account, that way when using email activation of new members that person can not register again under the same email address.

The only way to delete the posts at present is to go through and delete each post that they made. You can use the search by member option in the forums search to locate the posts made by that member more easily.
Back to Top
 Post Reply Post Reply Page  12>

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.