[deleted]
Several of the web servers powering phpBB.com were compromised
11–20 of 27 posts
Re: Several of the web servers powering phpBB.com were compromised
#12Can I point out that there's no need to link to a specific subforum when the same message is on the homepage?
Re: Several of the web servers powering phpBB.com were compromised
#13Other than the obvious, some things worry me. > We have confirmed that initial entry was made via a team member's compromised login details and not as the result of a vulnerability in the phpBB software. > The attackers were able to obtain access to the phpBB.com and area51 databases, meaning that user information, including hashed salted passwords, was compromised. Additionally, all logins on area51 between Dec. 12t…
The hacker probably modified the code to log all passwords.
If you logged in on the dates specified you should assume your password has been stolen.
Re: Several of the web servers powering phpBB.com were compromised
#14I have a Google App Engine instance, and it started getting a lot of random requests, which may be related to this. My website had 5,000 requests yesterday (normally less than 50). The logs indicate a lot of these:
221.145.183.89 - - [16/Dec/2014:04:11:43 -0800] "GET /bbs/zboard.php?id=notice&
no=41&PHPSESSID=98802904391cd2920f0473f7956305be HTTP/1.1" 404
Re: Several of the web servers powering phpBB.com were compromised
#15Is it just me, or does anyone wish that compromise disclosures should be hosted somewhere other than the site that has been compromised? What if there's a persistent threat and their webserver is still hosed, injecting 0days into responses? Not that it's happening here - I still clicked it - but I was hesitant.
If they have any clue, they rebuilt their entire server and deprecated the old one.
Re: Several of the web servers powering phpBB.com were compromised
#16I have a Google App Engine instance, and it started getting a lot of random requests, which may be related to this. My website had 5,000 requests yesterday (normally less than 50). The logs indicate a lot of these: 221.145.183.89 - - [16/Dec/2014:04:11:43 -0800] "GET /bbs/zboard.php?id=notice& no=41&PHPSESSID=98802904391cd2920f0473f7956305be HTTP/1.1" 404 Might be some kind of DNS forwarding issue, but I don't my ser…
That's an unrelated probe for a different, surely vulnerable, script - Zeroboard.
If the attack probes disturb you, begin gathering their patterns and plonking their IPs into a black hole using something like fail2ban. Er, well, that's what I'd do on a normal system. Not sure what to do about that on GAE.
Re: Several of the web servers powering phpBB.com were compromised
#17PhpBB, the gift that keeps on giving. Isn't phpBB one of the most compromised pieces of software installed?
phpBB 2 was a total security nightmare and anyone running it or version 1 in production should be shot.
They realized how horrible things were and massively cleaned up their act around version 3. No published vulnerabilities issued since 2010, and only a handful for 3.x in general.
http://secunia.com/advisories/product/17998/?task=advisories
Re: Several of the web servers powering phpBB.com were compromised
#18I have a Google App Engine instance, and it started getting a lot of random requests, which may be related to this. My website had 5,000 requests yesterday (normally less than 50). The logs indicate a lot of these: 221.145.183.89 - - [16/Dec/2014:04:11:43 -0800] "GET /bbs/zboard.php?id=notice& no=41&PHPSESSID=98802904391cd2920f0473f7956305be HTTP/1.1" 404 Might be some kind of DNS forwarding issue, but I don't my ser…
That's an unrelated probe for a different, surely vulnerable, script - Zeroboard. If the attack probes disturb you, begin gathering their patterns and plonking their IPs into a black hole using something like fail2ban. Er, well, that's what I'd do on a normal system. Not sure what to do about that on GAE.
Thanks for the heads up. Didn't know about Zeroboard.
In case anybody is wondering, it is pretty easy block IPs as well.
Re: Several of the web servers powering phpBB.com were compromised
#19Is it just me, or does anyone wish that compromise disclosures should be hosted somewhere other than the site that has been compromised? What if there's a persistent threat and their webserver is still hosed, injecting 0days into responses? Not that it's happening here - I still clicked it - but I was hesitant.
This page is hosted on a new VM (set up on this purpose) which only serve static html files, so...