Invision Board 2.1.3 CARE !

[skyagh]

This is quite serious such that alot of people using IPB 2.1.3 got hacked. When I was reading on the information, I felt serious about it. So I shall extract the info from the board to here.

Case 1
My board was hacked into again today by the same person that hacked into it two weeks ago. The first time it was hacked, I was running v2.0.x, since then, I had my board upgraded to v2.1.3.

I have 3 admins including myself, and we all changed our passwords after the first hacking.

Somehow he was able to login as an admin, delete all other admins, break the board, and forward the homepage to his InvisionBoard which is a XXX password site...not a good thing, since most of my board users are young girls. I was able to get his IP address during the first hacking, and I notified his hosting company, ISP and InvisionPower. 

What can I do to make this stop? Are there any security issues that anyone is aware of? I saw mention of a way to steal an admin's cookie? Is this possible?

Thanks in advance...

Case 2
I submitted a ticket yesterday ---- he's been hacking my site all morning. All passwords have been changed. this whole morning I've been banning all the IP's and email addresses, and he continues to get in. I even disabled registration. see my site here: 

www.synchroboards.com/board

He's even going for extortion now (PM he sent me):

DONT BANN ME BRO

WELLL

I AM STOPING TO ######YOU UNTIL YOUR TEAM GIVE ME MONEY

IF YOU DONT SEND MONEY IN A FEW HOURS WE WILL ###### AGAIN YOUR FORUM BRO


I AM A REAL HACKER AND I KNOW HOW TO ###### Invision Power Board v2.1.3 © 2005 IPS, Inc.

WE REQUEST MONEY TO OUR PAYPAL ADDRESS AND WE WILL STOP ###### YOU WE PROMISE THAT

THE MONEY SHOULD BE MAXIMUN IN FIVE HOURS

THANKS
ANYQUESTION EMAIL ME AT cdgirls _ webmaster at yahoo.com
or PM BRO

I AM WAITING...

I'm guessing I'm the one who had his site shut down (I emailed everyone and their mother --- his host, his ISP, Invision, even PayPal). Probably why he's so mad now, but it doesn't fix my problem.

Moreover, this guy had hacked countless IPB sites. I guessed there is still more pro hackers of IPB
Take care for all IPB 2.1.3 users =D

[dojo]

This is serious news indeed. I hope people will find the exploit code and fix the IPB script ... I have edited the email address for security reasons

[gamesandmore]

Very strange, I can't see why someone would want to do what this hacker is trying to acheive anyway! Fingers crossed it will get fixed soon!

[skyagh]

Yes. I do hope so too. Even one IPB forum that host music also got hacked. Hope the IPS Staff do something about it. But somehow, the admins doesn't reply to the thread. Only the members.

[compfreak986]

he's a scriptkiddie.

real hackers don't hack forums without a good reason.
Most of the times, they only hack PC's.