Page 1 of 1

[Forum] Security Breach Detected

Posted: Mon Aug 30, 2010 7:34 pm
by ThePhoenixBird
BEFORE READING THIS, GO CHANGE YOUR PASSWORD NOW!!!

Image
On the past days we have been doing a heavy duty emergency maintenance on forums and server, the reason of this emergency was that it was detected a malicious script injected into our forum core files, somehow a partially-unknown attacker used a vulnerability in our forum software (3.0.5 at the moment of the attack) and placed this script, so far we know all our users passwords have been compromised. In order to restore the security in our server and forums we taked down the forums and made a check of the uploaded files, deleted all the old forum files and upgraded the forum to the lastest version (3.0.7-PL1), we also made a full check of our custom themes and updated those to match the lastest version of Prosilver series. Also the software and OS running in our server was updated as well.

We apologize for any inconvenient caused to our users due this incident, we are currently investigating and we have some clues of who was the attacker, but for now, we will not publish that information in order to keep investigating. An attacker with enought time, skills and horsepower can crack password hashes with rainbow tables, passwords with less than 6 characters can be cracked in just a couple of minutes, we suggest to all our users to use a secure password with more than 8 characters and use UPPERCASE, lowercase, Numb3rs and $pecial Characters to increase your password security.

In order to ensure everyone safety we have issued a FORCED PASSWORD UPDATE for everyone, so once you login to the forums you will be asked to change your password, if you dont, you cant keep browing the forum with your account.

Again we ask for apologizes for any trouble caused.

Additional Notes:
We are moving to a new box in a few days, if you see the forum closed again its because we are doing the move.

Update: Forums have been already moved, enjoy the new box.

Re: [Forum] Security Breach Detected

Posted: Mon Aug 30, 2010 8:04 pm
by qwerty13
Welcome back. :)

Re: [Forum] Security Breach Detected

Posted: Mon Aug 30, 2010 9:37 pm
by kuriku
Fine

Re: [Forum] Security Breach Detected

Posted: Mon Aug 30, 2010 10:32 pm
by hope
So is this why the forums lag all the time

Re: [Forum] Security Breach Detected

Posted: Tue Aug 31, 2010 2:56 pm
by denser
glad to see all this work guys :) hope we find these bastard and shit him off :P
nice to see old smiles instead of new one(f..ng baloons...)

Re: [Forum] Security Breach Detected

Posted: Tue Aug 31, 2010 3:21 pm
by thecast
Look ... the phpbb is turned on failure.
Invasions and injections are common across the Forum.

Here in their forums if I leave some options open as register_globals = On in 10 minutes the site goes down. Only restarting the apache to return.
Here I put register_globals = Off decreased 99.9% of attacks.
But all is failure of the board, and a retarded who do not have to do!

Re: [Forum] Security Breach Detected

Posted: Thu Sep 02, 2010 1:05 pm
by JustLikeMe
From what is this attacker benefited? Finding members' passwords ? This is nonsense.

Re: [Forum] Security Breach Detected

Posted: Fri Sep 03, 2010 4:03 pm
by DrLecter
S/he wanted to steal our dancing girls!

Re: [Forum] Security Breach Detected

Posted: Tue Sep 07, 2010 10:28 pm
by ThePhoenixBird
Image
over 9000 inactive forum accounts were deleted today.

Re: [Forum] Security Breach Detected

Posted: Fri Sep 10, 2010 11:29 am
by blacksea
To bad for me... i was in vacance he got my pp account and my money tt, yes.. sucks.. same email/password:-s