talkmagic.co.uk

Ben&Ben wrote:

dat8962 wrote:The hackers are a bunch of W@*&ers and I am not sure if they will ever be stopped, we can only try our best to use the best preventative measures!

I hope that by 'the hackers' you were referring to only the destructive ones who targetted this forum. Hackers tend to get an awfully bad press from those who arn't in the IT world.

I hold my hand up the above comment that was credited to Dat8962, was in fact me......

I WAS refering to the hackers that have targetted this forum......but just for your info, I have been involved with the IT industry for many years, a lot of that time was spent working for a major blue chip company.........I don't want to cause any bad feeling but I am aware of what hackers do and you must admit the very nature of the name "Hackers" gives them a bad press on its own without any help from anyone...... so if you consider yourself a friendly hacker, maybe its a good idea to invent a new name for yourself......

But I do take on board the comments by Wolflock....and I know he is right.........

Sorry dat8962, I managed to quote your name instead of jbmagic as jbmagic quoted you in the post that I quoted. I think that makes sense...

Anyway, didn't mean to cause offence was just my two cents, I also agree with Wolflock and can't stand pathetic script kiddies.

vbulletin is the best because they make a lot of money so can afford to have professionals keep it up to date and secure. Obviously though they make money by charging for their forum Its not too expensive though. Also it wouldnt be possible to migrate this forum into another forum because its a different database design. I suppose if someone was really smart and designed a query to handle the transactions but I think they would have to be a bit of a miracle worker never mind magician

btw I'm sure I'm not the only computer science or computer related student here but if you let me know what these "hackers" did and how they did it I may be able to give a bit of a helping hand in giving you some tips on how to stop them doing it in the future. Such as making sure only the local server can access your database so nobody can access it directly and also making sure it can only read and write to the database or even read parts, with the correct username and password. May sound silly but not all servers/databases are set up like that.

also stick -securing phpbb- into google and it will give tons of advice on securing the forum.

Also if you know when it happened and check the server logs from that time you can most likely get an ip address. It's likely a proxy address if the kid has any sense so you can then scan the common proxy ports to find out. If you dont get an answer its likely offline so it is likely a real person. Then you can e-mail their isp and show them logs of what happened and tell them about how your website was vandalized by this person. The isp will then be forced to terminate the internet connection and if it can be shown that the person was trying to insite fear, you can even have it classed as an act of terrorism! under the new 2000(I think) act. I actually wrote an article on it for pc pro magazine(by their request) when I was into this stuff

Anyway i know im explaining this pretty terribly but it can be easy to trace them. Like very easy if you are lucky. Even if they used a proxy server you can e-mail the owner of that and ask what the ip address was of the computer that accessed your ip through them. Then you have them I really enjoy the internet detective stuff and i've helped a large gaming website track people down to their addresses in the past. when they were spoiling MY, and others gaming experience.

End of ranting!

The isp will then be forced to terminate the internet connection and if it can be shown that the person was trying to insite fear, you can even have it classed as an act of terrorism! under the new 2000(I think) act. I actually wrote an article on it for pc pro magazine(by their request) when I was into this stuff

While it is possible that the owner of the machine the attack was launched from was actually the attacker, it is also possible that his machine was just one link in the chain.

With most machines running Windows and Internet Explorer, the percentage of machines with Trojan Horses and other Malware is estimated to be 80-90%. This means that an attacker can quite easily use random machines connected to the internet and install and execute the necessary code from there. There won't be any ISP logs or trace files which could be used to track him down.

Then you have them I really enjoy the internet detective stuff and i've helped a large gaming website track people down to their addresses in the past. when they were spoiling MY, and others gaming experience.

Cheaters in games are a different issue since you may actually need to run the game to benefit from it. Attacks through peers may be possible if you disassembled the game's protocol but this is probably so tedious that it would never be worth the effort.

In short, while it may be possible to track down the hacker, it is unlikely that it is worthwhile or even possible.

You could argue that people running Windows and Internet Explorer are at fault. If you handed out your ID card to a stranger on the street and he used it as a fake ID for boarding a plane and executed a terror attack you would be held responsible. Unfortunately, the same does not hold for people supporting internet hackers by their carelessness.

The security hole was identified and fixed in about the most effective way possible as I understand it. We should hopefully be moving to a more up to date version of phpBB soon when all the mods that have been made are consolidated.

You can always track people down. It's almost impossible to not leave some tracks... As you said in the case of this forum and gaming sites its just not worth the hassle so police wouldnt get involved and you would possibly need police to order people to show logs or examine peoples computers. Chances are though in a forum hack like this, it would not have been done through another computer and it was likely just some kid testing out a script he found on a website who most likely didnt go through all the steps to ensure he was anonymous I mean what intelligent "hacker" would plan a proper attack on a forum like this? There is nothing to gain and its highly likely its just some kid fooling around. You sound like you think these "hackers" are really good or something and its impossible to track them down. The fact is if a hacker does something worth the authorities time. They always lose

pritch wrote: Chances are though in a forum hack like this, it would not have been done through another computer and it was likely just some kid testing out a script he found on a website who most likely didnt go through all the steps to ensure he was anonymous I mean what intelligent "hacker" would plan a proper attack on a forum like this? There is nothing to gain and its highly likely its just some kid fooling around.

I agree with you 100%. A proper hacker will not cause malicious damage either. They will try to be undetectable as possible, which means no damaging, leaving messages or anything of that nature.

Regards
Wolflock