Avast forum offline due to attack

http://blog.avast.com/2014/05/26/avast-forum-offline-due-to-attack

by sunilkumarc • 12 years ago

15 13 12 years ago

blog.avast.com

atmosx• 12 years ago

Let me guess, it was a virus \o/

mandlar• 12 years ago

Direct link to blog post: http://blog.avast.com/2014/05/26/avast-forum-offline-due-to-...

dang• 12 years ago

Thanks. Changed.

LawnGnome• 12 years ago

It appears they were running SMF, so in this case "hashed" means "a single iteration of SHA-1 after salting with the username"[1]. Ugh. Hopefully nobody was using a password they used elsewhere.

[1] https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/So... — I can't find a public VCS for 2.0.x, but the code hasn't changed.

epochwolf5• 12 years ago

Unfortunately, forums with decent security, forums that are free, and forums that have the features you are looking for are groups that rarely overlap.

SMF was the only viable option for a forum I started. My requirements were

    1. An events calendar
    2. Discussion boards with varying permissions
    3. Tiered membership 
    4. Automatic events newletter
    5. Costs less than $10/month to host
    6. Takes less than 2 hours/month of technical work to run
    7. Can be set up and running in less than 40 hours.
    8. Can be run/hosted by someone else if I'm no longer have time to manage the site.

I'd write my own but there's only so much time available in a day. I'll be looking into a way to add bcrypt hashing to SMF as a plugin. Not an easy thing to solve.

Edit: "newsletter" isn't the same thing as forum reply notifications.

Edit2: Added requirement #8.

nwh• 12 years ago

bitcointalk.org is spending millions on their new forum system that's being written from scratch. Hopefully that will be one to look out for when it's complete.

infogulch3• 12 years ago

Have you considered Discourse[1]?

It can act as a mailing list with reply-able email notifications or daily/weekly/semi-weekly digests. Super easy setup and maintenance.

[1] http://www.discourse.org/

Avast forum offline due to attack

Related Stories