neuron2's video forum hacked

[BruceL]

neuron2's video forum appears to have been crudely hacked.:(

[Sirber]

Yeah, seems to. Is phpBB secure?

http://neuron2.net/board/

[dragongodz]

ye, real mature.

[Axed]

Its good to see the way some people treat such a great and productive member of the Video Encoding community. This is a big shame, there was some really useful information on the forums.

[Doom9]

phpBB, unfortunately, isn't the safest bulletin board around and you regularly have to upgrade it. A lot of phpBB boards have been hacked in the past few months, and to make things worse, there were worms that automatically attacked known weaknesses of phpBB boards. Those worms also tried to get in here, but not being a phpBB they didn't have any luck.

Also, it's important that you always keep up with the PHP version (also not quite the most secure language there is).

[mpucoder]

From the looks of it his admin account was broken into. All the defacement is areas that can be changed from the admin panel. ie, no php was altered, nor was MySql broken into. Someone just guessed his password.

Donald, what I did to add some security was put basic authentication on the directory containing the admin scripts. This means you have two usernames and passwords to enter before you can acces the admin panel. Make them different.

[Guest]

I've just woken up and find this.

I'm in LA at DirecTV and I don't have time to mess with this. I asked my host to explain, since they had told me the PHPBB was upgraded.

I suppose this means the death of the forum.

[Sirber]

Do you have backups?

[Guest]

Yes, but I won't bring it back up unless I can be assured that I won't have to spend my life patching PHPBB vulnerabilities and worrying about whether I will wake up to find all my efforts wiped out by some low-life.

[mpucoder]

As I said, simple password hack. They managed to figure out your password and access the board as you, with admin priviledges.

[Sirber]

yeah. the best is a combinaison of letter and numbers

a-z, A-Z and 0-9.

Adding other caracters is hazardeous if you have keyboard problems :)

[Guest]

Originally posted by mpucoder
As I said, simple password hack. They managed to figure out your password and access the board as you, with admin priviledges. That's speculation on your part.

The board is back up now.

[mpucoder]

Originally posted by neuron2
That's speculation on your part Yes, based on the fact that no php was changed, only the content that can be changed from the admin panel. The only other way to change the contents is to break into the database, and I doubt that your host has exposed the MySql interface, although I could check if you like.
I also run a phpBB, so it's easy to spot what was changed. I also added a log file to mine to record, among other things, bad password attempts. If you have such a log you can look for the break in.
And ask your host if basic authentication can be added to the admin directory, it adds another level of security.

[Sirber]

Can I have your tweaks? :D

[bond]

seems the bsplayer forum (phpbb) has also been hacked:
http://forum.bsplayer.org/viewtopic.php?t=6426

according to betaboy (corecodec) thats fake

[Sirber]

What's going on? :scared:

[edit]

I upgraded mine to 2.0.13. I have the latest php too. I think I will set some .htaccess on /admin ...

[rjamorim]

phpBB is a terrible, buggy and unsafe forum platform. I know of at least 6 forums that have been hacked (counting neuron2's and BSplayer's). I'm advising all people I know that are using phpBB to move to something else. vBulletin or Invision 2.0x if they are willing to pay, or Invision 1.3.1 if they aren't.

No wonder they are changing their forum name to "Olympus" in an attempt to get rid of the huge bad karma they have... :rolleyes:

[Neo Neko]

Originally posted by rjamorim
phpBB is a terrible, buggy and unsafe forum platform. I know of at least 6 forums that have been hacked (counting neuron2's and BSplayer's). I'm advising all people I know that are using phpBB to move to something else. vBulletin or Invision 2.0x if they are willing to pay, or Invision 1.3.1 if they aren't.

No wonder they are changing their forum name to "Olympus" in an attempt to get rid of the huge bad karma they have... :rolleyes:

I have to disagree with you quite a bit. It is not that buggy. And it's not that unsafe. No more so than any of the alternates you have mentioned. Frankly I think PHPBB is just having a bad go. This recent vulnerability has turned out bad. Unfortunatly with all the other BBS software either pay or going pay. This leaves PHPBB free and clear in the rather large field of users who can't afford the alternate solutions. Unfortunatly these are also the people that often don't do that well patching their desktop OS let alone PHP based forum software.

The only real gripe I have ever seen as reasonable are the lack of some features etc. But as far as that is concerned it's not that big a deal. I mean after all you get what you pay for. And in this case more. This is just yet another case of people not keeping up with patches or their web hosts not keeping up in Donald's case. But Don appears to be a good admin with backups handy and his host should have their patches up to date now.

[BlackSun]

I confirm that story was totally a fake and I was the first surprised to see that and didn't found it funny, that someone in the audio/video world use my name like that.

[Sirber]

Why did he do that?

[Sylf]

Originally posted by rjamorim
vBulletin or Invision 2.0x if they are willing to pay, or Invision 1.3.1 if they aren't.
<OT>Invision's licensing scheme changed between 1.3.0 final and 1.3.1. I don't think 1.3.1 is considered free. And the development and patch on 1.3.x tree of that forum has stopped, so it's not safe when more security flaws are uncovered there.

I've also found that 1.3.x is not completely compatible with PHP5. The fix on this was easy though : Just had to eliminate all the duplicate member variable declarations in handful of classes.</OT>

[rjamorim]

<OT>Invision's licensing scheme changed between 1.3.0 final and 1.3.1. I don't think 1.3.1 is considered free. And the development and patch on 1.3.x tree of that forum has stopped, so it's not safe when more security flaws are uncovered there.

1.3.1 is still free. Actually even 2.0 is free. A few hours after the free version of 2.0 was released, they pulled it and replaced it with the trial version. Whoever was lucky enough to download the free 2.0 version can keep using it...

Also, there's a strong community of enthusiasts taking care of patching the forum engine after security advisories are published by secunia and the like. It's also a testament to IPB's superior security model that only a handful of holes have been found since it was released.

Anyway, I resurrected this thread because of this Netcraft article:
http://news.netcraft.com/archives/2005/07/08/hosts_ban_phpbb_as_security_issues_persist.html

Enough said...

[Guest]

Thanks for reminding me to backup my forum. :)

[rjamorim]

Thanks for reminding me to backup my forum. :)

Hehe. Consider creating some automated backup process.