I haven’t had my phpBB 2.x sites hacked but have had several hacks on VBulletin. They seem to have increased in 2011 with an almost monthly hack on one of my forums. Normally just kids having fun and reading instructions on how to hack using the latest software vulnerability in VBulletin 4.x. But in July 2011, for the first time, I had a hacker use one of my websites as a phishing site.

The phishing hackers exploit a discovered software vulnerability and upload files to your website to replicate other websites. In my case they uploaded folders to replicate the PayPal website. They probably sent out mass emails to innocent random people with links to login to PayPal. The link would take them to my website with a login that looked exactly like PayPal. For someone not internet savvy or a little sleepy – they might input their PayPal login info that the hackers can log.

Fortunately the files were on my server less than two hours before I was notified about it and files removed. Thanks to my host for that. I’m confident that no innocent people were harmed from my website but it was an unsettling event for me. These were not kids having fun. This was malicious and with thought-out bad intentions.

FYI – this did not happen here on my blog website or forum. It was on another unrelated website URL.

I had not taken steps in the past to secure my forums because I didn’t think it was needed. Here is a list of steps you can take to secure your VBulletin 3.x or 4.x forums. Any website can get hacked and this won’t make it into Fort Knox, but I’m told it can help keep the vanilla kid hackers out.

1. Always upgrade to the latest stable version.

2. Do not install any unofficial hacks or plugins as they are not written or reviewed by VBulletin developers.

3. Password protect your Administrator and Moderator Control Panels directories using .htaccess/.htpassword http://www.javascriptkit.com/howto/htaccess3.shtml

4. Make sure the tools.php file is NOWHERE on your website.

5. Although this is only a potential problem if someone gets a hold of your customer number, you should remove the upgrade.php file in your located in the install directory.

6. Remove the ImpEx files if you had used this import system.

7. If you have phpMyAdmin make sure it’s password protected.

8. If you suspect a hacking attempt, ask your host to change the login password for your web account.

9. Make sure all the Admin and Mod passwords are secure. Change them if you have any doubts. And use hard to guess passwords.

10. Enable the ‘strikes’ system which will help thwart brute force password attempts:

Admin CP -> Settings -> Options -> General Settings -> Use Login “Strikes” System -> Yes

11. NEVER allow HTML in posts, PMs or in sigs.

12. Make absolutely sure there are no viruses, trojans or keylogger spyware on your PC. Any of these could steal your password and other personal info.

13. Do NOT upload the directory called do_not_upload/

14. Use a different password for each forum you sign up with. Use a different password for your forum as you do for the .htaccess directory password.

15. Update the config.php file and set yourself as undeletable user so they can’t touch your admin account.

16. If you are on a shared hosting server, make sure all your vBulletin PHP files are chmod 644

17. Every hacker knows the default paths to the vbulletin admincp and modcp control panels. www.yoursite.com/forum/admincp or www.yoursite.com/forum/modcp By knowing these paths, hackers by pass going through the forums first before attempting to hack into your admincp or modcp.

If you rename the admincp and modcp folders, they will have to hack your log in for the forums first before they are able to find these folders. You can rename these folders anything you like. Here are a couple of examples: www.yoursite.com/forum/firstcp and www.yoursite.com/forum/secondcp

Rename these two folders on your ftp site and change your config.php file to match the names of the new folders.

If you rename your admincp and modcp folders, you MUST change the names of the these in the config.php file to match what you renamed them.

18. If you have and the other admins have a unique IP address you can edit the .htaccess file in your admincp directory with:
order allow,deny allow from <your IP>
allow from <admin2’s IP>
deny from all

This way the directory should not load for anyone whose IP doesnt match this list.

19. Pick your staff members wisely. You give them access to more commands which allows them to harm your site. Super Moderators and Moderators have access to the modcp/ directory, but not the admincp/ directory.

Note your forums are only as secure as the passwords you use and the server it is on. If the server is accessed then there’s nothing vB can do to prevent potential security violations.

Merry Christmas Mom! I was trying to think of a unique Christmas present for you this year. So remember when you visited me in China a couple years ago and we made the “Where My Bitches At?” video? (Original video posted above). Well, I decided to do a remix competition and you get to pick the winner!

I posted the competition at RapDogs.com. Rapdogs is a hip hop and rap forum community that I started back around 2000. It’s mainly late teens and twenty-somethings that like to write rap lyrics and record hip hop music. Many of them loved the original video you did for them and many of them said they wished they had a Mom that was cool as you.

The rules of the competition were just that they had to include either a video or audio clip from your original video to create a new original recording. I thought it was very interesting the ideas people came up with.

The winner gets $250 and second place gets $100, so pick your favorite videos carefully! Hip hop artists worked very hard to try and predict what you would pick as the winner. Please pick the first, second and third place winners.

Merry Christmas. Thanks for being supportive of the arts and for encouraging my own path in the arts all these many years. And yes….for driving me to piano lessons.

So with much further ado – here are the entries for the “RapDogs 2010 Admin’s Mom Where My Bitches At Remix Competition”. Entries are posted here in the order they were received.

P.S. – Thank you so much to the artists that entered into the competition. Merry Christmas!
#1 – RapDogs 2010-3 : The Quest(ion) by AlyBlaze

httpv://www.youtube.com/watch?v=pKq5jwGxB2E

_______________________________

#2 – RapDogs 2010-3 “Where My Bitches At” by Sirkle

httpv://www.youtube.com/watch?v=xMBFtzE2uoQ

_______________________________
#3 – “Where my bitches at” by Chim:instinx

httpv://www.youtube.com/watch?v=LwtoRmvYLcM

_______________________________
#4 – Rapdogs 2010-3 oooh miss asklund by Pseudo

httpv://www.youtube.com/watch?v=s9uYQsR1yF8

http://forum.rapdogs.com/showthread.php?74488-2010-3-Admin-s-Mom-YouTube-Remix-Competition-Deadline-12-22-10

This is a YouTube video competition and open to any members of RapDogs.com – Membership on that site is free so it’s open to the public. See details on the video and audio requirements to enter the remix competition.

RD is primarily a rap artist and hip hop website but any styles of music can enter the competition. Remember that YouTube.com entry links have to be posted on that RapDogs thread by December 22, 2010 according to the local website post time. So don’t post late. In past competitions we had some people post after the deadline and were disqualified.

Make money doing your own videos and be creative! Have fun.

1. Change permissions on private forums (Moderators, etc)
2. Check “The Team” link to check admins and update moderators.
3. Create new Maintenance category for moderators and  suggestions forums – put Web Link forum in this category – turn off all for guests and bots, only registered members can view.
4. Check access for forums on new users, registered, admins, etc.
5. Enable avatars – enable remote uploading, increase size limit to 50,000 kb, set images/avatar/upload folder to 0777 permission.
6. Personal profile – allow users to contact via email YES. Notification on PM YES. Check avatar and signature.
7. Upload logo to style imageset folder and select

But, there are moments that make it all worthwhile. I have a small number of strong friendships that have developed from these communities; and no matter the state of my personal life I make sure the best I can that the communities trudge on.

Today someone posted this note from one of my communities that provides free supp0rt for a serious illness. We’ve been running this for about 7 years now and it’s blossomed into a very special place. These members are somedays just fine, and other days can barely sit up to get to their computer. I was very touched by her comments, here it is:

Begin message:

So, as I am experimenting with the new site, fiddling with buttons and clicking on links, I realize that I am excited, happy, and filled with anticipation. So, for several moments of each day, I am discovering something new; both on the site and in myself. What I’ve discovered is that Conrad has not only given us a beautiful new home, but he’s filled it with so many exciting new gadgets, games, buttons, and links. In so doing, we have completely forgotten about our pain, our frustrations, our disappointments…if only for brief moments….as we “ooh” and “aaah” and “oh wow..look at this” while we are navigating our new home.

So, Conrad has given us a tool to allow us to escape from the tedious and unpleasant nature of our disease. We are lost, for hours, playing games in the arcade; or we are roaming about uploading pictures, downloading avatars, posting blogs and generally squealing and laughing as if we were children on Christmas morning.

Now, the newness and excitement may wear down, if our new home remains static. But, I know our Beloved Administrator Conrad and I can almost guarantee that static is something that will NEVER happen!

So, I want to thank Conrad for all that he has given us and also for what he did not realize that he had given us! Sweet moments of wonder, laughter, excitement and anticipation. All of which have provided us with the most wonderful moments of escape!

Thank You Conrad! Family…go out there and explore our new *website* and have lots of fun because there is lots to be had here!!

With Love & Appreciation
*Moderator at website*

It’s against my better judgement to open a forum on a personal website, but I can’t keep up with the number of email questions I’m getting now. Hopefully the forum will allow people to exchange resources. I receive many of the same questions via email – so this is also a way to answer people in detail and en masse.

I run many other online forum communities but have never had one on my own site before. This will also be a test area for me to try new forum functionality before bringing live to other communities.

Roses are #ff0000, Violets are #ooooff, All my base are belong to you.

My geekiest Valentine’s Day ever – upgrading software on 8 community websites. Woohoo! My geeky Valentine’s Day gift to them.

UPDATE: I received an email asking what the first line meant. #ff00oo and #ooooff are HTML color codes, and “all your base belong to me” is a mistranslation that originated from a Japanese video game. You can read more about that translation and phrase here: http://en.wikipedia.org/wiki/All_your_base_are_belong_to_us

Wow, this picture even scares me. Thank you (or curse you!) to my Canadian friend for creating this monstrosity and sending to me.

Yes, that’s me in the crown. And I should explain the octopus but it’s a little confusing. I’m not sure how it started, but my alter ego on many of my websites as admin is a squid. I think it started because I run so many websites but don’t post a lot on them, so people would say I just came up for air every once in a while and then would submerge mysteriously. Over the years it’s progressed to me actually posting squid videos in my profiles. I think it’s fun for members to think a squid runs their website, I don’t know.

I guess that’s how we get some of our strange traditions and cultural memes over generations. Something starts out making sense and then it gets all convoluted.

1. Forum communities updated and relaunched.
2. Front page news articles reinstalled.
3. Integration with social networking software.
4. Integration of e-commerce.

What does this mean? Just that members can do more stuff and have more fun. All communities will still be free, but the addition of ecommerce options should help keep the increased financial overhead more sustainable.