- This topic is empty.
-
Posts
-
Good news:recent updates to phpBB software have crippled spam bots’ abilities to penetrate boards with new user registrations. After implementing those changes a couple weeks ago, we haven’t had a single bogus attempted registration. We were up to a dozen or more a day before that. Bad news:bot operators and hackers are getting desperate. I’ve been noticing that I have to re-answer the CAPTCHA question when I try to log in to the Administrator Panel lately. It says that I had too many failed attempts. If you get this, it is probably because your username is now in a hacker/bot database. They are trying as often as possible to blunt-force guess your password and login as an admin. SOLUTIONS:
1. I made a small change to the board phpBB code so that only logged-in users can see the user names of other people currently viewing the board, and also see the name of the newest registered user. This prevents bots from sweeping the forum index page for valid user names (especially for admin user names shown in red text).
2. PLEASE PLEASE PLEASE make sure your password is
NOTsomething really easy to guess, like “password,” your user name, or something else like that. As long as it is somewhat personal and random, it should be OK. They are only going to get a couple of tries a day. It locks them out after 3 attempts. Unfortunately, there really isn’t a way I can see so far to stop them from doing this once they have a user name. The best defense is the “mormon” question we use as security because it isn’t worth it for hackers to spend any time trying to look that stuff up. They have to attack thousands of sites a day to make it worth their efforts economically.
Thanks for staying on top of this Brian. ditto I got a message about too many failed login attempts today. I have a pretty good password with letters and numbers. I have a feeling they will try for a short window of time and then give up. They will probably try a couple dozen obviously bad ones like “password” or “admin” or something like that. If it isn’t those, the brute-force dictionary attack simply takes too long to be worth it. mormonheretic wrote:I got a message about too many failed login attempts today. I have a pretty good password with letters and numbers.
My login failed for the same reason today. Hopefully this doesn’t last too long.I got another message saying I had exceeded login attempts. I’ve been on hiatus for a while during my move to Singapore. No problem with login today, but I’ll be on the lookout. It might still happen occasionally as different hackers get a list of sites to attack. Old hackers might also occasionally go back and attempt it again. They should get frustrated quickly and drop our site off their rosters. It really isn’t a profitable use of time unless they succeed immediately within a few attempts guessing dumb boilerplate passwords like “password” or “admin,” etc.
- You must be logged in to reply to this topic.