Password brute force attacks

Hello,

Within the last week, it has come to our attention that phpBB.com was unsuccessfully attacked by a malicious party attempting to brute-force account login credentials. This attack was facilitated by a query for "powered by phpbb" on a search engine. Though this attack was not successful as phpBB includes several features to ensure it is not vulnerable to such attacks, users should take measures to ensure that their forums are properly protected.

Attack anatomy
To perform the attack, the attacker registers an account on the forum and tests that the memberlist is available for them to obtain lists of users. The attacker then uses an automated process to login and download thousands of user names from the memberlist, the attacker here grabbed a little over 5000 user names. After collecting this data the attacker attempts to brute-force account credentials by repeatedly sending login requests to the forum. As the attack does not attempt to solve the invalid login attempts CAPTCHA, it is limited to the amount of attempts specified in the "Maximum number of login attempts" configuration option.

Signs
Visible signs of this attack include:

• Users being required to enter a CAPTCHA after an initial login attempt.
• Increased server load.
• Repeated POST requests to ucp.php?mode=login from the same IP address.

Prevention
phpBB provides several tools that enable users to mitigate these efforts.

• To prevent successful brute-forcing, an administrator may ensure that "Maximum number of login attempts" (accessible via the Administration Control Panel under "Security settings") to a small number (the default of 3), ensuring that a CAPTCHA will be required if an excessive number of failed login attempts occur.
  
• Furthermore, an administrator may wish to prevent Newly Registered Users from viewing the memberlist. To do this, ensure that the Newly Registered Users group is enabled (accessible via "User registration settings"; ensure that the "New member post limit" is greater than 0), then navigate to Permissions -> User roles -> "Newly registered user" -> Profile -> set "Can view profiles, memberlist and online list" to Never.
  
• Additionally, this attack may be mitigated by proper password selection. Ensure that your password (and the passwords of your users) contain letters and numbers and are not common words, phrases, combinations (password, 1234, etc.). Requirements for password complexity for your forum may be set on the "User registration settings" page of the Administration Control Panel.

While it should again be stressed that this attack was not successful, administrators should take the above measures to ensure the safety of their forum and their users.

If you have any questions regarding these implementation of these processes, please create a new topic in the Support Forum.