Hello,br /br /Within the last week, it has come to our attention that phpBB.com was span style="font-style: italic"unsuccessfully/span attacked by a malicious party attempting to brute-force account login credentials. This attack was facilitated by a query for powered by phpbb on a search engine. Though this attack was not successful as phpBB includes several features to ensure it is not vulnerable to such attacks, users should take measures to ensure that their forums are properly protected.br /br /span style="font-weight: bold"Attack anatomy/spanbr /To perform the attack, the attacker registers an account on the forum and tests that the memberlist is available for them to obtain lists of users. The attacker then uses an automated process to login and download thousands of user names from the memberlist, the attacker here grabbed a little over 5000 user names. After collecting this data the attacker attempts to brute-force account credentials by repeatedly sending login requests to the forum. As the attack does not attempt to solve the invalid login attempts CAPTCHA, it is limited to the amount of attempts specified in the Maximum number of login attempts configuration option.br /br /span style="font-weight: bold"Signs/spanbr /Visible signs of this attack include:br /ulliUsers being required to enter a CAPTCHA after an initial login attempt./liliIncreased server load./liliRepeated POST requests to span style="font-style: italic"ucp.php?mode=login/span from the same IP address./li/ulspan style="font-weight: bold"Prevention/spanbr /phpBB provides several tools that enable users to mitigate these efforts.br /ulliTo prevent successful brute-forcing, an administrator may ensure that Maximum number of login attempts (accessible via the Administration Control Panel under Security settings) to a small number (the default of 3), ensuring that a CAPTCHA will be required if an excessive number of failed login attempts occur.br //liliFurthermore, an administrator may wish to prevent Newly Registered Users from viewing the memberlist. To do this, ensure that the Newly Registered Users group is enabled (accessible via User registration settings; ensure that the New member post limit is greater than 0), then navigate to Permissions - Groups' permissions - Newly registered users - Advanced Permissions - Profile - set Can view profiles, memberlist and online list to Never.br //liliAdditionally, this attack may be mitigated by proper password selection. Ensure that your password (and the passwords of your users) contain letters and numbers and are not common words, phrases, combinations (password, 1234, etc.). Requirements for password complexity for your forum may be set on the User registration settings page of the Administration Control Panel./li/ulWhile it should again be stressed that this attack was not successful, administrators should take the above measures to ensure the safety of their forum and their users.br /br /If you have any questions regarding these implementation of these processes, please create a new topic in the a href="http://www.phpbb.com/community/viewforum.php?f=46" class="postlink"Support Forum/a.

Read more: http://www.phpbb.com/community/viewtopic.php?f=14t=1947925