Getting hacked very badly

[NexDog]

http://nexusportal.net/index.php

Basically, something, someone, somehow has registered 8000 times on our forum. We have 800 online user, showing 9000 online today. MySQL slowed to a crawl. They are also mailbombing us badly.

Looks like they made a script to create users automatically. We are still running 2.3.0 but I've applied all the security fixes that have been released up to 2.3.4. Any defence against this?

[Floris]

I can't check this right now, but does 2.3.x include image verification/ If so, turn this on - that way the bots can't read out and you can just prune users who registered since the attack or match the patern. You could also just close the forum until the attack is over.

This looks like an attack and probably by some member who had issues with the site or staff. It doesn't hurt to log their IP's and report those as either compromised systems to their internet service providers or as an DoS attack against your network. Hopefully those lines will get dropped to.

[NexDog]

I don't thing VB2 has the image verification feature unfortunately. We found the IP and firewalled it. Was coming from Turkey....

Anyway, cleaned out the mail queue and I'm just cleaning out the forum now.

[tamarian]

Image verification for vBulletin 2 is available at vbulletin.org as a hack

[Jimmy Kane]

Image verification for vBulletin 2 is available at vbulletin.org as a hack

It is also a standard feature in vB2.3.3 or 2.3.4.

[Floris]

I just read the announcement from version 2.3.0 and that included a image verification bug fix, so .. it was probably introduced in 2.3.0 earlier test versions

[Matthew Gordon]

It was introduced in 2.3.0 RC2.

[NexDog]

Yep, it's there but not working. Checking to see if we have GD installed onn this server as that is a requirement.....

[Floris]

You could check with phpinfo();

[NexDog]

GD is in there but the image verification doesn't show up. I have the option enabled in the adminCP though. Any ideas?

[Floris]

Did you turn on GD options in the vboptions page? And select the version number? 1.6.x or 2.x ?

[NexDog]

You beauty - that was it. Amazing that you can know software so well and still find more featues after all this time. Kicking myself for not having found it earlier though. This just ate 2 hours of my sunday night.

Thanks all for your help.

[Floris]

I am sorry that vBulletin is such an amazing product!