Feeds

Open sourcey bulletin board offline after hack attack

phpBB coughs up names, addresses, passwords

High performance access to file storage

The website for one of the net's more popular bulletin board software packages has been taken offline following a security breach that gave an attacker full access to a database containing names, email, address, and hashed passwords for its entire user base.

In a message posted Sunday, administrators of phpBB.com said the attacker gained access through an unpatched security bug in PHPlist, a third-party email application. The miscreant had access for more than two weeks before the breach was discovered, and phpBB remained down at time of writing, more than three days later. Administrators didn't respond to emails seeking comment.

A blogger who claimed to have carried out the attack said that details for more than 400,000 accounts were intercepted. The writer claims to have created a script that was able to crack more than 28,000 passwords hashed using an unsalted MD5 algorithm, before posting them to the internet. The passwords were not accessible at time of writing.

A notice posted to a temporary support forum said that the latest version of phpBB uses "a complex hashing algorithm in order to prevent someone from determining the plaintext value of a password." An earlier version used less secure protection based on MD5. To be protected by the more robust algorithm, users had to have registered or logged into their accounts since the upgrade was made.

The number of users fretting over the breach in this phpBB discussion thread is a testament to the sad fact that many people still use the same password for numerous online accounts. Administrators at phpBB reminded users that isn't a safe practice. They also admitted to making mistakes of their own.

"We apologise for not securing our servers in time to prevent this from happening," they wrote. "This demonstrates how critically important it is to always make sure that you keep up to date with any software that is running on your machine."

phpBB is an open-source software package webmasters use to run discussion forums on their sites. It is based on the PHP language and stands for PHP bulletin board. The breach had nothing to do with phpBB, and there are no known vulnerabilities in the most recent version of the program.

Rather, the attacker gained entry through a recently patched vulnerability in PHPlist, an open-source package for managing newsletters. On January 29, the program was updated to fix a security bug that allowed unauthorized access.

Interestingly, according to the time line provided by both the purported attacker and phpBB, the attack was carried out some two weeks before the PHPlist patch was issued, courtesy of this published exploit.

Sadly, the attack could have been prevented by adding a single line to an administrator's index file. There are some useful lessons that can come out of an autopsy of this breach, especially for fanbois who claim open-source is so much more resistnt to these SNAFUs. ®

High performance access to file storage

More from The Register

next story
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.