A:M/C - Have I been hacked somehow?

[Equality 7-2521]

Forum URL: rbuhsd.proboards51.com
(Please do not join)

I'm running a school forum, exclusivly for the other students of my school.
A very interesting problem has arisen: I believe my forum has some how been hacked twice in the last 12 hours.

Since the forum is primarily used for a school setting, most users are on during school hours using the school internet server, which provides one IP for internet connection. Ergo, most members have the same IP.

A well implemented feature of Proboards is to ban IP addresses. I believe this has been the case. When anyone tries to access the forum from a school computer, they recieve a message stating that their IP has been banned until "x" time. ("x" has asofar ben 9:03 and 10:44). I have had to resort to using an anonamizer to get into the forum main board directory, and from there I was able to log on. I accessed the Admin CP and unbanned the school's IP, and then proceded to ceck the activity log. Nothing appeared out of the norm, but I found nothing referencing that anyone had banned the school IP.

Not every IP has been banned, mind you. The only banned IP was that of the school. Can someone help me either find the "hacker", or explain what this strange phenomnium means?

Added-
I have questioned my moderating team, none of them know about this situation either. The only person with the ability to ban is the root admin.

[Ms PiXie]

equality said:

Forum URL: rbuhsd.proboards.proboards51.com
(Please do not join)

I'm running a school forum, exclusivly for the other students of my school.
A very interesting problem has arisen: I believe my forum has some how been hacked twice in the last 12 hours.

Since the forum is primarily used for a school setting, most users are on during school hours using the school internet server, which provides one IP for internet connection. Ergo, most members have the same IP.

A well implemented feature of Proboards is to ban IP addresses. I believe this has been the case. When anyone tries to access the forum from a school computer, they recieve a message stating that their IP has been banned until "x" time. ("x" has asofar ben 9:03 and 10:44). I have had to resort to using an anonamizer to get into the forum main board directory, and from there I was able to log on. I accessed the Admin CP and unbanned the school's IP, and then proceded to ceck the activity log. Nothing appeared out of the norm, but I found nothing referencing that anyone had banned the school IP.

Not every IP has been banned, mind you. The only banned IP was that of the school. Can someone help me either find the "hacker", or explain what this strange phenomnium means?

Added-
I have questioned my moderating team, none of them know about this situation either. The only person with the ability to ban is the root admin.

proboards can't be hack only passwords "cracked" are you sure thats the correct url to your board? the reason I asked is that url is taking me to the proboards.com home page.

[Equality 7-2521]

Do'h... no. That's my bad, it's without the double proboards. Allow me fix that...
And wouldn't there be something in the activity log if someone banned an IP, even if it were the root admin?

[Ms PiXie]

equality said:

Do'h... no. That's my bad, it's without the double proboards. Allow me fix that...
And wouldn't there be something in the activity log if someone banned an IP, even if it were the root admin?

look in the security log, it shows the last 1000 security related issues for you board.

[Equality 7-2521]

Today at 10:28am Equality 7-2521 Banned s7astrac
Today at 10:28am Equality 7-2521 Updated the ban list.
Today at 8:46am neuroticgrim Modified the post Avatars posted by s7jlee.
Today at 8:43am neuroticgrim Updated the avatars list.
Today at 8:43am neuroticgrim Modified the avatars for the forum.
Today at 8:31am neuroticgrim Updated the avatars list.
Today at 8:31am neuroticgrim Modified the avatars for the forum.
Today at 8:19am The Furry Moomba Updated the news fader.
Today at 8:11am Equality 7-2521 Updated the ban list.
Today at 8:09am Equality 7-2521 Updated the ban list.

The IP banning has only started today. I see nothing too odd. I can vouch for the Updated the ban list entires; those were me unbanning the school's IP address. The latest entry, about me banning that s7 fellow was done by me, yes. But I did not ban his IP.

[Ms PiXie]

equality said:

Today at 10:28am Equality 7-2521 Banned s7astrac
Today at 10:28am Equality 7-2521 Updated the ban list.
Today at 8:46am neuroticgrim Modified the post Avatars posted by s7jlee.
Today at 8:43am neuroticgrim Updated the avatars list.
Today at 8:43am neuroticgrim Modified the avatars for the forum.
Today at 8:31am neuroticgrim Updated the avatars list.
Today at 8:31am neuroticgrim Modified the avatars for the forum.
Today at 8:19am The Furry Moomba Updated the news fader.
Today at 8:11am Equality 7-2521 Updated the ban list.
Today at 8:09am Equality 7-2521 Updated the ban list.

The IP banning has only started today. I see nothing too odd. I can vouch for the Updated the ban list entires; those were me unbanning the school's IP address.

sounds like what took place someone either forgot their password or someone from scholl was trying to crack someone else account password, anytime this happens the person gets 10 trys at the password then their ip address is banned for 1 hour, this will not show in the security log.

[Equality 7-2521]

Omagosh, that makes perfect sence... thank you sooo very much. The first time was until 9:03, which is an hour after 8:03, two minutes before first period. So someone tried to crack someone's password a few too many times, and it blocked his (or her) IP, which happens to be the entire school's IP. You are a big help, thank you so much!!

[Ms PiXie]

you are welcome.