The Incorrect Login Counter does not protect...

[Hot Tomale']

that message which locks you out after incorrect attempts does NOT protect a vbulletin forum from remote bruteforce attacks. I know because I have tried online tools and while it does take a long time to actually get a password, if you do, this still does not protect a vbulletin. A feedback of mine would be to upgrade that to actually work.

[Shamil.]

Hello, I believe the system was not designed to protect the board from brute force attempts.

[Mark.B]

That's interesting. I am being brute forced at the moment. Several long-abandoned accounts with stupidly easy passwords have been accessed, but nothing done with them.

[Mark.B]

Hello, I believe the system was not designed to protect the board from brute force attempts.

I rather thought it WAS...otherwise, what's the point?

[Ryan Ashbrook]

I rather thought it WAS...otherwise, what's the point?

It's not designed for brute force, it's just a simple login lock out system to prevent account hacking.

[Zachery]

After 5 bad logins, no furture logins will be taken until the 15 min expire, regardless of what is sent to the login script.

[Mark.B]

Thanks Zachery.

I seem to have been getting attacked for about two days now, first time this has happened to this extent. About half a dozen very old abandoned accounts got logged in, though they didn't do anything. Examination of Who's Online shows about half a dozen failed log in attempts every ten to fifteen minutes, and one of my test accounts received the "failed login" email.

Hopefully they'll get bored soon. the admin passwords a pretty strong.

[MRGTB]

That's interesting. I am being brute forced at the moment. Several long-abandoned accounts with stupidly easy passwords have been accessed, but nothing done with them.

How do you know they had stupid easy passwords? How can you know what your old members password used are? I always thought vBulletin encrypted them so there no way you could know that information, not even as admin.

[feldon23]

After 5 bad logins, no furture logins will be taken until the 15 min expire, regardless of what is sent to the login script.

It sets a cookie and session right? Or is it by IP address? If it's by cookie and session, then someone could simply delete those and try again. If it's by IP then that's harder and they would have to release/renew with their ISP, or rotate IPs on their proxy/vpn.

[we_are_borg]

How do you know they had stupid easy passwords? How can you know what your old members password used are? I always thought vBulletin encrypted them so there no way you could know that information, not even as admin.

You know the build up how its coded with current GPU's you can brute force a password in matter of seconds. After you know the build up you can also make a rainbow table of the most used combinations.

[stifler's mom]

I seem to have been getting attacked for about two days now, first time this has happened to this extent. About half a dozen very old abandoned accounts got logged in, though they didn't do anything. Examination of Who's Online shows about half a dozen failed log in attempts every ten to fifteen minutes, and one of my test accounts received the "failed login" email.

Is their a reason that you can not simply ban the IP address ?

[Zachery]

It sets a cookie and session right? Or is it by IP address? If it's by cookie and session, then someone could simply delete those and try again. If it's by IP then that's harder and they would have to release/renew with their ISP, or rotate IPs on their proxy/vpn.

It should be based on a session/ip. Its not based on cookies.

[Shamil.]

Yep, it's IP based. Have a look at the strikes table.

[we_are_borg]

Yep, it's IP based. Have a look at the strikes table.

Is the username not part of the three strike system because with only IP protection you can brute force it.

[Shamil.]

Is the username not part of the three strike system because with only IP protection you can brute force it.

The username, IP and time of ban start are logged in the table.