Railway Preservation News
https://www.rypn.org/forums/

RYPN Login Attempts/Hacking
https://www.rypn.org/forums/viewtopic.php?f=1&t=30866		 Page 1 of 1
Author:  tomgears [ Mon Feb 14, 2011 8:47 pm ]
Post subject:  RYPN Login Attempts/Hacking
Twice in the last couple of days I went to login here and was greeted with a you've reached the maximum number of failed login attempts. I know it wasn't me. I'm thinking it is an attempted hack. Has anyone else had this happen?
Author:  nasaracer32 [ Mon Feb 14, 2011 8:53 pm ]
Post subject:  Re: RYPN Login Attempts/Hacking
Tom,

I just had to reset my password after 3 attempts, but I can't say for sure that it wasn't my error. The first time I tried to log on, I used what I thought (and what I just changed it to) was the password. It didn't work so I tried two others and then was locked out.
Like I mentioned, I could have sworn I had the right one the first time, but can't be sure.
Author:  Bob Davis [ Tue Feb 15, 2011 12:47 am ]
Post subject:  Re: RYPN Login Attempts/Hacking
Happened to me too--took three tries with the code letters and numbers to convince the system that it was really me.
It's probably unrelated, but the Market Street Railway website (streetcar.org) server was hacked about a week ago and has been unavailable. Today, if one tries to log in, a message appears advising that remedial measures are underway, but it's still down.
Author:  DBH [ Tue Feb 15, 2011 12:23 pm ]
Post subject:  Re: RYPN Login Attempts/Hacking
Same thing happened to me. I think it was yesterday or the day before.

DBH
Author:  Bobharbison [ Tue Feb 15, 2011 12:23 pm ]
Post subject:  Re: RYPN Login Attempts/Hacking
This kind of thing is constant these days. Some are hackers, most are spammers looking to insert ads and/or links.

The more active the site, the more of it you'll see. Pulling the log files for one of my large sites indicates daily attempts to hack into the sql database, site admin, etc etc.

I also routinely delete dozens of bogus accounts each day.
Author:  robertmacdowell [ Wed Feb 16, 2011 4:59 pm ]
Post subject:  Re: RYPN Login Attempts/Hacking
And I work in this sort of thing for a living - and these guys aren't some sort of computer geniuses. We call em "script kiddies" - they know just barely enough to use software that somebody else wrote. Software like this http://krebsonsecurity.com/2010/10/spye ... et-merger/

At least the ATM skimmers are in America where they could risk arrest.

In this case you're dealing with a simple Perl script I could write in an afternoon. It uses Google to find the phrase "powered by phpBB" which is at the bottom of every page of most phpBB forums. Then the script automatically attempts attacks which have worked on phpBB boards in the past. It also crawls every page, gathers usernames, and tries to log in as all of them, using the stupidest passwords. password passw0rd rypn <the username> <the username>0 <the username>1 <the username>99 etc. It only works 1 in 1000 times, but on a board with 1000 users, they're in.

Lesson: Meet the admins halfway: use a password a script kiddie couldn't guess.
Author:  MEC_557 [ Wed Feb 16, 2011 10:01 pm ]
Post subject:  Re: RYPN Login Attempts/Hacking
There are also bots that automatically attempt to access sites too. I am a mod on another site that we wound up having to block blocks of IP addresses, mostly Russia and Asia, that's where most of the attacks started from. We have no legit members/posters from those areas and it's basically a New England based robotics site so having those IPs blocked has no effect. The site is also a phpBB based forum. Keeping up with the forum software updates helps too no matter what you're running. I've seen many vBulletian (Jelsoft) forums attacked too. Security measures like the capchas are good at weeding out many bogus account tries.
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/