Several of the web servers powering phpBB.com were compromised

https://www.phpbb.com/community/viewtopic.php?f=64&t=1186015

by thepanamus • 12 years ago

44 25 12 years ago

akersten• 12 years ago

Is it just me, or does anyone wish that compromise disclosures should be hosted somewhere other than the site that has been compromised? What if there's a persistent threat and their webserver is still hosed, injecting 0days into responses? Not that it's happening here - I still clicked it - but I was hesitant.

xico• 12 years ago

You are right. We should even go further and reset the whole interweb each time there is a disclosure, or at least randomize the DNS records of the affected servers.

protomyth2• 12 years ago

It is the one site you know the users will come to. I would do the new web server at old address. Hacked machines should not be put back in service.

couchwire2• 12 years ago

I think what you want is the "Full Disclosure" mailing list:

  http://nmap.org/mailman/listinfo/fulldisclosure

ploxiln• 12 years ago

I don't think there's much point in worrying about drive-by browser attacks. We all visit a lot of sites, and many sites are hacked without their owners knowing, but just serving malware/phishing/redirects for spam, ad networks, and injection into more popular sites.

If a browser 0day really did apply to my up-to-date version of firefox and really was a problem, well, I'd feel pretty screwed.

jldugger• 12 years ago

If they have any clue, they rebuilt their entire server and deprecated the old one.

nicofuma• 12 years ago

This page is hosted on a new VM (set up on this purpose) which only serve static html files, so...

anw• 12 years ago

Other than the obvious, some things worry me.

We have confirmed that initial entry was made via a team member's compromised login details and not as the result of a vulnerability in the phpBB software.
The attackers were able to obtain access to the phpBB.com and area51 databases, meaning that user information, including hashed salted passwords, was compromised. Additionally, all logins on area51 between Dec. 12th and Dec. 15th were logged in plaintext. While the hashing algorithm utilized in phpBB will make it difficult to obtain those passwords, you should not take any chances.

A bit of clarification should be given. The staff's login information was stolen, allowing someone to get a dump of the database containing user info. What kind of login information was stolen? Is this an shell account, was an SSH key stolen, was this an admin panel account?

Secondly, "all logins [...] were logged in plaintext". Does this mean the username and password were logged, the password hashes and sessions? What actual information was plaintext to the user?

It's great that groups are willing to own up to these kinds of events, but without specific information, it's hard to understand how broad a compromise we're talking.

ars• 12 years ago

The hacker probably modified the code to log all passwords.

If you logged in on the dates specified you should assume your password has been stolen.

wGEric• 12 years ago

Here is an email I received from phpbbhelp.org: > Hello everyone, > > On September 9th, an attacker was able to gain unauthorized access to the server hosting phpbbhelp.org. This remained unnoticed until late yesterday. The individual (might be individuals) responsible is the same one taking credit for the Tapatalk, phpBB.com, and Ars Technica breaches. > > A keylogger was added to the login page, and if your username is on the following list, the plaintext password you used on phpbbhelp.org is likely in their hands. > List: [removed] > We have to assume that the database was likewise dumped and that everyone's email addresses and hashed passwords are likewise in the wild. > > Please change any password that you may have used on phpbbhelp.org since September. > > If I have any further information, I will provide it. USF will remain offline until after we have restored phpBB.com and I have some time to go through it. > > > > - Yuriy Rusko

I'm would assume the same thing was done on the phpbb.com servers.

couchwire2• 12 years ago

PhpBB, the gift that keeps on giving. Isn't phpBB one of the most compromised pieces of software installed?

knieveltech2• 12 years ago

I'm pretty sure sendmail still wears that crown.

astrodust3• 12 years ago

Unpatched Exim was giving it a pretty good run for a while.

GigabyteCoin• 12 years ago

phpBB (the software) wasn't compromised in this situation. An admin's account credentials were.

McGlockenshire2• 12 years ago

phpBB 2 was a total security nightmare and anyone running it or version 1 in production should be shot.

They realized how horrible things were and massively cleaned up their act around version 3. No published vulnerabilities issued since 2010, and only a handful for 3.x in general.

http://secunia.com/advisories/product/17998/?task=advisories

ikeboy• 12 years ago

Can I point out that there's no need to link to a specific subforum when the same message is on the homepage?

webo2• 12 years ago

I have a Google App Engine instance, and it started getting a lot of random requests, which may be related to this. My website had 5,000 requests yesterday (normally less than 50). The logs indicate a lot of these:

    221.145.183.89 - - [16/Dec/2014:04:11:43 -0800] "GET /bbs/zboard.php?id=notice&
    no=41&PHPSESSID=98802904391cd2920f0473f7956305be HTTP/1.1" 404

Might be some kind of DNS forwarding issue, but I don't my server handling unnecessary requests. What can I do?

McGlockenshire2• 12 years ago

That's an unrelated probe for a different, surely vulnerable, script - Zeroboard.

If the attack probes disturb you, begin gathering their patterns and plonking their IPs into a black hole using something like fail2ban. Er, well, that's what I'd do on a normal system. Not sure what to do about that on GAE.

webo2• 12 years ago

Thanks for the heads up. Didn't know about Zeroboard.

In case anybody is wondering, it is pretty easy block IPs as well.

Several of the web servers powering phpBB.com were compromised

Related Stories