Author Topic: SMF Security  (Read 12344 times)

0 Members and 1 Guest are viewing this topic.

Offline Chavo

  • x86
  • Hero Member
  • *****
  • Posts: 2219
  • no u
    • View Profile
    • Chavoland
SMF Security
« on: January 19, 2007, 05:54:41 pm »
A friend of mine was having problems with someone hacking his IPB installation for an online community with a large user base.  He didn't have the money to upgrade to the newest version of IPB so I suggested SMF.

Any SMF veterans have any tips for securing SMF for a large user base?  I'm looking at you iago and Sidoh.

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: SMF Security
« Reply #1 on: January 19, 2007, 05:55:12 pm »
:(.
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: SMF Security
« Reply #2 on: January 19, 2007, 08:15:06 pm »
SMF, like most other stuff, is secure as long as you stay at the latest version. 

There are no major known security vulnerabilities in SMF.

Offline Chavo

  • x86
  • Hero Member
  • *****
  • Posts: 2219
  • no u
    • View Profile
    • Chavoland
Re: SMF Security
« Reply #3 on: January 19, 2007, 09:04:38 pm »
thanks, no general advice like disabling offsite avatars to avoid script injection or that sort of thing?

some things tend to be less secure than others in larger user bases

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: SMF Security
« Reply #4 on: January 20, 2007, 01:33:13 am »
Well, unless they've fixed it karma was traditionally vulnerable to a CSRF attack, which is sort of why it got turned off on vL.  I have no idea if that's been fixed, but I generally just turn off karma.  It's easier than letting people abuse it. 

Off-site avatars can cause minor privacy issues, like user-tracking, but I don't know of any real danger. 

I can't really think of anything serious. 

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: SMF Security
« Reply #5 on: January 23, 2007, 06:32:26 pm »
Ironically, somebody posted a XSS flaw recently that affects all current versions.  There's a workaround on Bugtraq, but it's so minor I'll wait for a patch.

Offline Chavo

  • x86
  • Hero Member
  • *****
  • Posts: 2219
  • no u
    • View Profile
    • Chavoland
Re: SMF Security
« Reply #6 on: January 24, 2007, 10:39:41 am »
Ok, the guy that hacked the previous boards (before I convinced them to install SMF instead of an old version of IPB) posted on our boards yesterday.  I banned him of course, but I think he was using a proxy to post.  Do you have any recommendation for banning all proxies, other methods of keeping them out, etc?

Offline Sidoh

  • x86
  • Hero Member
  • *****
  • Posts: 17634
  • MHNATY ~~~~~
    • View Profile
    • sidoh
Re: SMF Security
« Reply #7 on: January 24, 2007, 11:36:42 am »
I don't think that it's possible, though I'm definitely no expert with proxies.  You could just turn on account verification for a few weeks until he finds something better to do.

Offline Chavo

  • x86
  • Hero Member
  • *****
  • Posts: 2219
  • no u
    • View Profile
    • Chavoland
Re: SMF Security
« Reply #8 on: January 24, 2007, 12:05:15 pm »
He isn't posing a threat right now.  He apparently tried to crack my and a few other admins passwords last night, failed, and moved on to another dota site (which he did crack actually).

Is there a list of publicly known proxies that I can ban? I'd rather people didn't use proxies at all for this forum (its important on this particular forum to avoid duplicate accounts, etc).

Offline Sidoh

  • x86
  • Hero Member
  • *****
  • Posts: 17634
  • MHNATY ~~~~~
    • View Profile
    • sidoh
Re: SMF Security
« Reply #9 on: January 24, 2007, 12:18:33 pm »
He isn't posing a threat right now.  He apparently tried to crack my and a few other admins passwords last night, failed, and moved on to another dota site (which he did crack actually).

Is there a list of publicly known proxies that I can ban? I'd rather people didn't use proxies at all for this forum (its important on this particular forum to avoid duplicate accounts, etc).

Some of these look pretty promising.

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: SMF Security
« Reply #10 on: January 24, 2007, 05:30:57 pm »
He isn't posing a threat right now.  He apparently tried to crack my and a few other admins passwords last night, failed, and moved on to another dota site (which he did crack actually).

He's a bitch. I bet he sits on efnet with a 3-bot botnet and talks shit.
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: SMF Security
« Reply #11 on: January 24, 2007, 06:34:23 pm »
Why would he have bots? 

Anyways, the only thing you can do is require admin approval for new members, and to require an account to view anything.  But that's not practical on most boards, so just back up your DB every night (to either a write-once media or to a remote server) or deal with it. 

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: SMF Security
« Reply #12 on: January 24, 2007, 06:36:33 pm »
If he actually tries bruteforcing with one active attempt at a time, he's a damn fool.
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: SMF Security
« Reply #13 on: January 24, 2007, 08:48:55 pm »
Assuming it takes 100 bytes to do an attempt, a low-end 768kbit connection can do 123 attempts/second.  I don't think that's an unreasonable number.  You aren't going to get a significant improvement if you have 3 bots. 

Plus, not every hacker has bots.  In fact, most don't.  Bots are typically just used for spamming (using them to attack or DDoS is significantly less common this year, and spam is more common). 

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: SMF Security
« Reply #14 on: January 24, 2007, 10:03:49 pm »
123*4 = 492 attempts/second. That's a pretty significant improvement.
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT.