Ensim

[HostUltra]

Originally posted by Jan
Bull! Those defacers do several a minute. Believe me I know

I doubt they got in with brute force

 

[Jan]

They certainly did...I got my host to find the IP address, and then later when I fixed my site I was getting hits from the defacement site, I followed the links from my web tracker and saw how many they had done in the last hour/day.

 

[YUPAPA]

Why would you use brute force for hacking? There is of course a faster and easier way :classic2:

 

[Allowee]

Originally posted by YUPAPA
There is of course a faster and easier way :classic2:

you can just ask for the password....
mail fake a mail from that host and ask for the password, because the passwords database has been lost...

 

[Lapras]

Jan is correct I once knew someone who was very interested in hacking and he told me that it was very important to have long passwords, and that because of IP spoofing someone can bypass security measures that impead a brute force program's ability to access the login page.

And YUPAPA, my main server is fairly secure, and I don't think that the people that are sophisticated enough hackers to use other means would truly be interested in hacking into a website like mine.

 

[CareBear]

Originally posted by Lapras
Jan is correct I once knew someone who was very interested in hacking and he told me that it was very important to have long passwords, and that because of IP spoofing someone can bypass security measures that impead a brute force program's ability to access the login page.

Some of it is rather pointless too though. My host has a secure login for the control panel, secure email but regular FTP, so each time something gets uploaded my password is sent across the internet in nice plain unencrypted text for everyone along the way to sniff. The length of your password isn't going to make much of a difference then.
Also IP spoofing would be virtually useless as an attack. If you spoof the 'from' address, all the packets will never get back to you so I don't see how that's of any use besides for a DOS attack.

 

[Allowee]

talking about DDOS, you can 'ban' those attacks.
you can setup something that will only allow X requests a second.
if there are more then x requests a second you will be banned from the server for X minutes

 

[Lapras]

Isn't there such a thing as encrypted FTP? Good point. I prefer to use FTP for only the larger uploads. There's always the upload via the Control Panel which is located at an SSL enabled address.