HELP! Noob Admin cant find IP addresses HELP!

[hollyinalbury]

OK so I am a mod at a forum using Vbulletin and we have had a security breach in a private section within the forum.

How do I check thru the logs to see who accessed individual threads?
I know there is a way to see IP addresses and times that they visited each thread, but i dont know how to get there.

Does anyone know what i mean?

HELP x x x x


Love Holly x x

[bigH2O]

The admin of the site will have to give you permissions to access the logs. That's not a moderator permission by default.

[hollyinalbury]

Yep i know, I am here on behalf of the admins. All of us are new to the forum world (and they are boys and i think their pride wont let them ask lol) so i said i would do some investigating for them, as i am the mod of the private section that has been breached.

If i can give them the info on how to look it up, then they can do it and let me know where the prob is coming. It seems someone has a back door into the forum... long story..

[Greg]

Go to user groups and look at all the member counts for each group. there are to types, people in the group and people with a group as a secondary group. Make sure only the folks you want are in each group with mod and admin perms.

[hollyinalbury]

We have done that and everything on the surface looks ok..

Ok so the issues it this - the secure section of the forum has had infromation from posts tweeted onto twitter. One of the admin was looking around and could see on the thread in question, who had visited the thread from 2pm-5pm. We checked out IP addresses and times to pin point who it could have been. one Ip address stood out as they did not have access to the section of the forum..
BUT now when we want to go back and look again, as a second breach has occured, the admin cannot remember where he went in the ACP to see IP address and when they were on particular threads.

How do the admin get to that section? Where they can see the thread and who has visited and when?

Do you get what im tryin to say? im sorry i dont know all the right terminolgy

[bigH2O]

They can view IP and members information right in the "who's online" under "quicklinks" You don't even need cp access for that... just default permissions. Twitter links and the like are going to be plugins that you picked up from who knows where. Security holes exist in some of these programs that you could drive a C5B through, so you're taking your chances.