MyBB Community Forums

Recently on my forum, we had a troll who caused a lot of trouble. Finally, I and my forum staff decided to ban him permanently, however, this was not an IP ban--we didn't see cause for one.

Mysteriously, right after that, we had many strange and very random word filters appearing. Words like "love" and "RP" were turned to things like "spice" and "fartnoogle." All swear words were blocked too (though personally, I don't mind that, as I don't really like swearing).

As soon as one of my staff found the word filters in the Admin CP, he deleted them and reported what had happened to the members of the forum--more specifcally, the thread that my members created asking about the banned words (which the staff member posted in). Immediately after, the troll that had been banned created a new username. He asked a member who he had not gotten along with--ironically, one who LOVES to swear--and asked if he was having "fun." When one member noted that the translation of the a-word to "milkshake" was funny, he stated "at least someone knows how to lighten up."

It's all far too coincidental. I strongly believe that this person has hacked my forum. What can be done to prevent things like this from happening in the future, for myself and for other users of MyBB?

.htaccess on your Admin directory. Unless he has access to your server in which case you should find the server logs to verify.

Have you checked the Admin Logs too see if one of your staff did this?

I do like how he yelled "HACKED!" before even finding out the problem. LoL.

Thank you very much for your input, KuJoe. It will not be required any further.

According to the Admin log, it was done under one of my administrators' accounts, but he claims not to have done it. I know that I can't always trust people's word, even that of my own administrators, but it's still just far too convenient, the way the troll returned to the forum and what he said when he did. The possibility still very much exists that he hacked into my administrator's account.

SonicHowler Wrote:According to the Admin log, it was done under one of my administrators' accounts, but he claims not to have done it. I know that I can't always trust people's word, even that of my own administrators, but it's still just far too convenient, the way the troll returned to the forum and what he said when he did. The possibility still very much exists that he hacked into my administrator's account.

Have all of your administrators change their passwords and tell them that if any such actions go on like this without good reasoning that they will find their powers removed.

There is not much we can do, it seems more of a people problem than a software one.

Ah, okay. Sorry for the false alarm ^_^"

Again, .htaccess will also prevent hackers from accessing the Admin CP even if they figure out an admin's password (assuming both passwords are different of course).

Well what do I do to make that happen? Heh, sorry, I'm experienced in HTML rather than php.

Are you using cPanel by chance?