Hacking phpBB

[Hawkstra]

You may here a lot from people saying that phpBB gets hacked more than any other forums or not.

I thought I should tell you all who dont know or heard that, just like *any* software (Windows, Macs, media players, even Linux, etc.), if you don't keep the software up-to-date, then you could be hacked. Whenever a security hole is found in phpBB an update is quickly released. If you update as soon as they come out, you will be very safe from hackers.

Also there are alot of people hosting themselves who do not know how to configure server software securely which also adds to the risk

Besides not being up to date, phpBB got hacked a lot is because of its success.
A lot of script kiddies can play with this gpl code. But, on the other hand, since fixes are released, we end up with a pretty secure script (more than if no one had tested the security that much Wink

The minimal advice is to be up to date since everytimes a security hole is found, the fix suggest where to look for, so it's even easyer to hack old version after an upgrade, but if you keep on being up to date at least you won't be hacked for know issues.

Then .htpasswd is welcome to be in your admin folder (personnaly I also restrict it to only accept my personal ip since it's static).

Best is to add .htaccess with good old "deny from all" in db/ and includes/ folders.

But this only apply to apache servers.

Playing with more personnal redirections can also help out to disallow remote use of php scripts or to use custom error pages that inform eventual testers that you care about security (mine also hadle banned ip so that to many bad tryes lead to a ban, banned ip connection attemps to a message telling next time it will be reported to the ip provider, guess what none came back twice Wink ).

But there is nothing better than regular backups, so that the worst that can happend is to be offline the time to reinstall everything (15 min with good backups) in case of hack.

Ipb, vBulletin, phpBB, and all the others can get hacked. Anything can get hacked.

[Hawkstra]

Adam,

Move this thread into phpBB forum and delete this post.

Thanks,
Hawkstra

[Mike]

wow. thanks for that informative post! I used to use phpbb alot but because of the hacking problems, I finally decided that it wasnt worth the risk anymore. Maybe I will give it a shot again and try what youve suggested here.

[Troy]

I was thinking of trying out the other forum types they got out, aside from my Vbulletin one soon. Thanks for the heads up, Hawk. I will always keep this one up to speed.