Not actually my forum but a user on a server I have did not upgrade their forum for about 7 versions. When phpbb .17 came out they were still running .10. Basically they completely compromised the server and caused a huge amount of headache.

Also I run a phpBB host which was ddos'd twice on a different server. Not got a clue what sparked it off but lasted for over a week (even when the forums were made not accessible they continued attepmting the attck. The log file of individual ip's got too big and caused the server to have further problems (I presume they were faking their ip).

I've never had a forum hacked, but I've had a form exploited. This actually happened Friday night. Somebody figured out how to use a contact us type of form on one of my sites to spam people. I caught it after about 10 minutes of them spamming, but I have literally 100's of bounce back messages, so they probably sent out just as many emails. All scripts have a potential of being exploited not just forums.

well my forum was attacked and only once. a moderators account was taken over and the person pruned 2 major sections on my site. i have secured the site with several updates and hacks that add security.


what i learned? do not give everyone the power to mass prune any sections.
and to be careful who we hire.

__________________
WebMaster & PC Forum
NewJersey State Forum

yeah i made it so my mods cannot do those kind of things, i dont think its really necseecary for mods to do that. if i wanted it do be done, i will it myself.

i havnt had my forum/site attacked and i plan to keep it that way

__________________
Metaltera.com :: Breed the Metal
Myspace Profile :: My profile!

Well, if the only problem was that somebody took over an account - it doesn't really matter who can do what and whose account it is...The hackers should be able to take any account they wish (including an admin's)....this has actually happened to myself and LarryB before. We were on IPB, I think it was 2.0, but I'm not certain. The hackers managed to gain control of one of the admin accounts and created quite a bit of havoc before we found out...

Not only be careful who you hire, but be careful to remain up to date and back up regularly...in the case of overtaking accounts, there is not enough trust or limited permissions to stop hacking.

__________________
...some super-sweet signature