Advanced search  

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Pages: [1]   Go Down

Author Topic: Hacking attempts - should I be worried?  (Read 4473 times)

0 Members and 1 Guest are viewing this topic.

Theli

  • Coppermine newbie
  • Offline Offline
  • Posts: 18
    • Fractal art.se
Hacking attempts - should I be worried?
« on: January 23, 2004, 11:03:43 am »
Hi just checked the visitor log on my website and the login page of my gallery was accessed 17462 times during one hour (compared to the normal 150). Wich has led me to believe that someone is using a program like Accessdiver to find the login and password. And this is not the first time it's happened.

The question is, is there a threat to the security of my site?
Has this happened to anyone else here?
Logged
M

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Hacking attempts - should I be worried?
« Reply #1 on: January 23, 2004, 11:16:50 am »
I don't know of any special vulnerability of coppermine related to logins (although it'd be a nice feature for a future version of coppermine to allow only X failed logins within Y seconds). You should check that you have a strong password (8 characters, letters and numbers, some capitalized, no dictionary word, no names, no keyboard pattern). A good idea to come up with a strong password that's easy to remember, but hard to break is memorizing a sentence that makes sense for you and use the first letters of each word.

Example: the sentence
Quote
I absolutely love Mashed Potatoes with 3 Beers
would result in the password
Quote
IalMPw3B


GauGau
Logged

Theli

  • Coppermine newbie
  • Offline Offline
  • Posts: 18
    • Fractal art.se
Hacking attempts - should I be worried?
« Reply #2 on: January 23, 2004, 11:33:09 am »
I don't think my login/password is that obscure, it includes a spinoff of my name and the password is a dictionaryword (uncommon, but still).

Can I change the password without re-installing the entire gallery?
Logged
M

Casper

  • VIP
  • Coppermine addict
  • ***
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 5231
Hacking attempts - should I be worried?
« Reply #3 on: January 23, 2004, 11:54:35 am »
You can change your coppermine password.  there are a couple of ways to do it.  As you cannot edit your own details in the usermgr, I find the easiest way is to create a new admin user for yourself, log on as that user, then edit your original user details.

Or you could do it using your database tool.

You can edit your database password using your db tool, but you then have to edit your include/config.inc.php on the server, to your new password.
Logged
It has been a long time now since I did my little bit here, and have done no coding or any other such stuff since. I'm back to being a noob here

Theli

  • Coppermine newbie
  • Offline Offline
  • Posts: 18
    • Fractal art.se
Hacking attempts - should I be worried?
« Reply #4 on: January 23, 2004, 12:54:59 pm »
Ok, I've created a new user in the Administrator group with a more cryptic username and password (no actual words).
Can I delete the original administrator (being logged in as the new) without causing problems?
Logged
M

Theli

  • Coppermine newbie
  • Offline Offline
  • Posts: 18
    • Fractal art.se
Hacking attempts - should I be worried?
« Reply #5 on: January 23, 2004, 03:53:38 pm »
A few smaller attempts has been made to hack into my gallery with a total of 30000 visits. I've changed the login (made it longer and less comprehensible) aswell as the password (alot longer).

Have you heard on anyone successfully managed to get the password to a coppermine gallery through this kind of hacking?
Logged
M

Theli

  • Coppermine newbie
  • Offline Offline
  • Posts: 18
    • Fractal art.se
Hacking attempts - should I be worried?
« Reply #6 on: January 23, 2004, 03:59:38 pm »
It swallowed alot of bandwith, so I deleted "login.php". I'm always logged in anyway...
Logged
M

Casper

  • VIP
  • Coppermine addict
  • ***
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 5231
Hacking attempts - should I be worried?
« Reply #7 on: January 23, 2004, 04:44:55 pm »
So how are your members going to log i?  :?
Logged
It has been a long time now since I did my little bit here, and have done no coding or any other such stuff since. I'm back to being a noob here

Theli

  • Coppermine newbie
  • Offline Offline
  • Posts: 18
    • Fractal art.se
Hacking attempts - should I be worried?
« Reply #8 on: January 23, 2004, 06:53:45 pm »
I have no members...  :wink: :)

Here's my gallery, BTW.
http://gallery.theli.net
I've been using the coppermine gallery for a few months now, and it beats the hell out of uploading over FTP and setting up HTML based galleries.
Logged
M

LiX

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 27
Hacking attempts - should I be worried?
« Reply #9 on: January 30, 2004, 11:29:02 pm »
This could also be an attempt to eat your bandwidth...
Logged

DJMaze

  • VIP
  • Coppermine addict
  • ***
  • Offline Offline
  • Posts: 831
    • Dragonfly CMS
Hacking attempts - should I be worried?
« Reply #10 on: January 31, 2004, 02:52:37 am »
I made some code to use in PHP-Nuke to get around this problem.
If someone has time he could modify it to use in the standalone Coppermine, and place in the end of the init.inc file.

If i have the time i can do, but that could take about 4 weeks.

Code: [Select]
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (!ereg("(http://$_SERVER[HTTP_HOST])", $_SERVER["HTTP_REFERER"])) {
        $errorpage = '<html><body><center><h1>ERROR</h1>';
        $the_error = "Someone with IP $_SERVER[REMOTE_ADDR]<br>"
                    ."tried to send information thru a POST from the following url: $_SERVER[HTTP_REFERER]<br>"
                    ."to the following page of yours: $_SERVER[REQUEST_URI]<br>";
        $the_error = $errorpage . "<form><textarea rows=\"8\" cols=\"60\">" . htmlspecialchars($the_error) . "</textarea></form></body></html>";
        if (is_admin($admin)) {
            die($the_error);
        } else if ($adminmail && $adminmail != '') {
            $subject = "POST Error on $sitename";
            $xheaders = "From: $sitename <" . $adminmail . ">\n";
            $xheaders .= "X-Sender: <" . $adminmail . ">\n";
            $xheaders .= "X-Mailer: Mozilla\n"; // mailer
            $xheaders .= "X-Priority: 1\n"; // Urgent message!
            $xheaders .= "Content-Type: text/html; charset=iso-8859-1\n"; // Mime type
            mail($adminmail, $subject, $the_error, $xheaders);
        }
        die('Posting from other server not allowed!');
    }
}

It would be even better to create a IP blocker sql table, and then compare the "user" IP to the SQL table if a compare is made the "user" will be blocked.
Logged
There are 2 kinds of users in this world: satisfied and complainers.
Why do we never hear something from the satisfied users?
http://coppermine-gallery.net/forum/index.php?topic=24315.0
Pages: [1]   Go Up
« previous next »
 

Page created in 0.017 seconds with 15 queries.