HELP: Pennywize blocked over 45 members today!!!

**JoeMeca** · 11-25-2005, 08:12 AM

damn yes you need some help!

**OneHungLo** · 11-25-2005, 08:28 AM

ahh man thats what a hate about pennywize...

Did you just install it? How long have you been using pennywize? To fix that just bump the subnets up a bit.

**OneHungLo** · 11-25-2005, 08:29 AM

also it's probably aol users... they can go thru 2 -10 subnets in a session.

**Libertine** · 11-25-2005, 08:31 AM

Originally posted by OneHungLo

ahh man thats what a hate about pennywize...

Did you just install it? How long have you been using pennywize? To fix that just bump the subnets up a bit.

It now becomes clear why exploitedteens.com was always a big favourite on password sites

**mrgica** · 11-25-2005, 08:46 AM

Originally posted by OneHungLo

also it's probably aol users... they can go thru 2 -10 subnets in a session.

its not aol users...I have been using pennywize for a couple of months now and it usually blocks 1-2 accounts per day...
besides subnets are completely different and comes from different countries...

**Tanker** · 11-25-2005, 08:48 AM

I set my threshhold to 10 subnets and just watch them very carefully

**Tanker** · 11-25-2005, 08:49 AM

It's pretty easy to tell which ones get out

**mrgica** · 11-25-2005, 08:50 AM

I don't see any solution on this problem, I just have to wait a couple of days or weeks until its over.
And deal with my angry members....

But how can I protect the password file better? To avoid this in the future?

**mrgica** · 11-25-2005, 08:52 AM

Originally posted by Tanker

It's pretty easy to tell which ones get out

all of those accounts logged in with different subnets and from different countries.
The problem here is that someone stole/hacked my password file on the server and past the whole list on some forum or something..

**SmokeyTheBear** · 11-25-2005, 08:54 AM

Originally posted by mrgica

But how can I protect the password file better? To avoid this in the future?

Find out who took it and poke large holes in him with an icepick until he promises never to use a computer again

**mrgica** · 11-25-2005, 08:56 AM

Originally posted by SmokeyTheBear

Find out who took it and poke large holes in him with an icepick until he promises never to use a computer again

**Libertine** · 11-25-2005, 09:04 AM

Originally posted by mrgica

I don't see any solution on this problem, I just have to wait a couple of days or weeks until its over.
And deal with my angry members....

But how can I protect the password file better? To avoid this in the future?

Here's a step by step list of what to do:

1. Make sure your server hasn't been hacked. If it has been, fix the problem.
2. Make sure your password file isn't accessible. Check for (known?) security issues with any scripts you are using, and implement any common sense security measures you haven't implemented yet (e.g. placing your password file in a directory that isn't web-accessible, etc.)
3. Start checking signups and existing username/password combos against common wordlists. Respectively, change them and stop allowing them.
4. If the problem doesn't stop... (this will hurt) get all your members to change their passwords.
5. Try and make unhappy hacked members happy again by giving them a free week of access or whatever.

**mrgica** · 11-25-2005, 09:28 AM

Originally posted by punkworld

Here's a step by step list of what to do:

1. Make sure your server hasn't been hacked. If it has been, fix the problem.
2. Make sure your password file isn't accessible. Check for (known?) security issues with any scripts you are using, and implement any common sense security measures you haven't implemented yet (e.g. placing your password file in a directory that isn't web-accessible, etc.)
3. Start checking signups and existing username/password combos against common wordlists. Respectively, change them and stop allowing them.
4. If the problem doesn't stop... (this will hurt) get all your members to change their passwords.
5. Try and make unhappy hacked members happy again by giving them a free week of access or whatever.

Thanks man, much appreciated.

**onlytease** · 11-25-2005, 11:48 AM

also a good idea to stop letting members chose their own login and password (if you do) and let CCBill generate a random one - presuming you are using ccbill

**Dalai lama** · 11-25-2005, 11:51 AM

get strongboxxx

**John69** · 11-25-2005, 12:05 PM

get strong box

**HairToStay** · 11-25-2005, 01:12 PM

If the password file was stolen -- what processor do you use? Shared or dedicated server? Up-to-date php software? phpBB running on the box?

Check server logs to see specifically what files were accessed, and how.

HELP: Pennywize blocked over 45 members today!!!

HELP: Pennywize blocked over 45 members today!!!

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment