message board/forum back door access

Watchman · 28-04-2005, 15:32

yet again i'm only here for a bit advice, long time member slow time poster

I'm an admin bod on a music based Runboard forum. Nothing serious, more of a social one than alot.

After many changes of provider and name etc to get rid of abusive and bullying posters we settled down, and the rest went else where, both becoming members only by invite. Sound familiar?

What's happening is, that a couple of the more savvy people on the other site are getting on to our board and able to read it, then doing the very sad thing and copying and pasting messages and using that to abuse members.

Now, I'm thick skinned and don't give a monkey's but some of members are getting really upset.

The only thing I know is that using some search on google, they are able to get round the membership thingy rather than using somebodies login.

Any suggestions on how this works and how to close down the loophole would be very appreciated.

If need be I'll post the URL either here or by PM

Thanks in advance

Chris W · 28-04-2005, 15:33

Could they be reading the posts on cached pages on google?

bmxbandit · 28-04-2005, 15:37

you can stop google indexing your site by putting a file called robots.txt in the root...not sure exactly what you need to have in the file though.
__________________

some useful urls:
http://www.searchengineworld.com/rob...s_tutorial.htm
http://www.robotstxt.org/wc/robots.html

Chris W · 28-04-2005, 15:38

Quote:

Originally Posted by bmxbandit

you can stop google indexing your site by putting a file called robots.txt in the root...not sure exactly what you need to have in the file though.

User-agent: googlebot/1.0
Disallow: /

should do it

bmxbandit · 28-04-2005, 15:39

or this will make one for you

Watchman · 28-04-2005, 16:10

ok thanks for you suggestions

I'm not really sure where to put the little script

I did consider the pages being cached but I couldn't work out how to find them without logging in. Every time I managed to find it, I was asked for my password and user name.

the URL is:

http://com1.runboard.com/bsolidbond

If anybody manages to read any of it, could you let me know how.

cheers again!

Watchman · 28-04-2005, 22:27

sorry but I'm going to be cheeky and bump this

Runboard have told the forum owner it is impossible, but even with my limited abilities, I know nothing is impossible when it comes to things like this, you just need to know the "work around" or find it

any other suggestions?

Raistlin · 28-04-2005, 22:31

What's the actual name/title of the forum?
__________________

Oh, and are you sure you haven't got a mole?

Watchman · 28-04-2005, 22:34

the url is

http://com1.runboard.com/bsolidbond

the name is solid bond
__________________

Quote:

Originally Posted by Raistlin

What's the actual name/title of the forum?
__________________

Oh, and are you sure you haven't got a mole?

as for a mole, we have a suspicion or two so we are narrowing that bit down.

we are trying to cover all bases, the person taunting us is trying to make out they are doing it through google

Raistlin · 28-04-2005, 22:40

The only page that comes up (after a fairly exhaustive Google) is the main page.

Unless there's some way to bypass the login I can't see how they can be getting the pages any other way than by actually being able to log into the site.

Where are they reposting them? Can you give me a link to one of the reposts?

Watchman · 29-04-2005, 06:41

Thanks for your efforts Raistlin.

The copy and pasting is done on another members only Runboard forum.

The staff at Runboard assure us that there isn't a back door and it't not possible to access without a password.

We're now going to have to work out a way of trying to catch the mole out if that is what there is

SMHarman · 29-04-2005, 08:27

Sounds like a mole.

Are you friendly with the other forum? You could ask one of its mods for the IPs of the offending posts and match them with IPs of your members.

zoombini · 29-04-2005, 08:42

Is it possible to log who actually views the posts?

I recall that on PhpBB there was a mod that allowed you to log who looked at a thread & when.

This helped me find out who it was that did the same sort of thing by comparing the time it was viewed & the time a message was posted.

Watchman · 29-04-2005, 09:36

Quote:

Originally Posted by SMHarman

Sounds like a mole.

Are you friendly with the other forum? You could ask one of its mods for the IPs of the offending posts and match them with IPs of your members.

part of the problem is a rivalry between the boards, its actually the listowner/moderator who is taunting saying a backdoor has been left open and that the right sort of "googling" anybody could do it.

we have suspected a mole and have asked the said person many times.

anybody got any suggestions on the way to catch them out?

SMHarman · 29-04-2005, 09:45

Quote:

Originally Posted by Watchman

anybody got any suggestions on the way to catch them out?

Zoom seems to have got the solution there, if you can see who is viewing threads at the time they are posted on the other forum then you have your man.

In most security breaches, like medical diagnosis, it is usually the simple and obvious option. If the software developers are saying there is no backdoor, then chances are it is one of your members who is accessing the forum.