Status
Not open for further replies.
I think your security mod would be even better if you could have it run checks of active files against versions stored off site for unauthorized changes. Here is a blog discussing it: Protect your web pages – automagically with perl | Grey Fuzz

Then, if an unauthorized change occurs the file is replaced and an email or text message alert can be sent out warning admins of an attack.

Speaking of email alerts, is that part of vbsecurity already?

By the way, thanks for making this for vb3!
 
Upvote 0
This suggestion has been closed. Votes are no longer accepted.
There's no way to do any of that except for relying on the vBulletin "md5 checksums" file that we quick link to in the Recommendations panel.

Repairing it would be quite impossible, as PHP does not have write permissions for every file (and indeed, that would be a giant security risk in and of itself).

I think the reason why vB simply has a page for it is that fetching MD5 checksums of every file is a server intensive process.

We'll look into it, though :)
 
Maybe just a cron like the link I provided that has some admin panel setup would be nice. Run the script and in the panel key in the offsite location of the check file.

Just kicking around ideas... :)
 
There are no offsite repositories for checking files (and it would be 100% impossible for us to set one up, because each vBulletin installation has a different checksum for each file), plus all it would do is be able to send you back a report, it would not be able to fix the files.
 
One file...the index would be a big help. I have been hacked a couple times...they always have gone for the index file. As far as off site repositories, I would say that would be up to the owner to have another site to house the file. Or possibly a write protected directory on the same server.
 
It's not possible to check any index file either, not only because the index file can be changed "legitimately" (i.e. you rename your forum index to forum.php via vBOptions and put a custom index.php there) but also because your index file is still unique to your vBulletin installation.

Every vBulletin file has the licence number and date downloaded embedded in it, which means that if you re-download the same version you are currently running, even if you have not modified any files, the file will still be different. Your checksums would have been changed.
 
I guess I have the custom index.php. I have been able to simply replace this file with one on my computer when I have been hacked.
 
Status
Not open for further replies.
Back
Top