3 ms·

It should be noted that it appears to be a persistent hack that has been around for some time. The defacement was quite a lengthy animated video. The attacker h

by nwh 13y ago

It should be noted that it appears to be a persistent hack that has been around for some time. The defacement was quite a lengthy animated video. The attacker had at least access as the PHP user, which of course has database access. There's a video of the defacement here — http://youtu.be/LKrOHAfMdxI http://youtu.be/LKrOHAfMdxI A 50BTC bounty has been offered by Theymos (author of the advisory), awarded to anyone who can find the source of the compromise. It's near impossible for an outsider though as despite it running SMF, there's been extensive modifications which may have been the source of the vulnerability.

citricsquid 13y ago
Source on the bounty: http://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_hacked/ccjyjti http://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_... also with an update: Update: It's unfortunately worse than I thought. There's a good chance that the attacker(s) could have executed arbitrary PHP code and therefore could have accessed the database, but I'm not sure yet how difficult this would be. I'm sending out a mass mailing to all Forum users about this. Personally I suspect that it's due to misconfigured nginx which allows uploaded files to be executed, a user in #bitcoin demonstrated they could upload a PHP file using an exploit in the avatar uploading system, although theymos did have someone looking at the nginx configurations about 6 hours ago and hasn't mentioned finding anything.
antocv 13y ago
Looks like end-point security, the (usually PHP) applications the server is running at, is a weak point in the Tor ecosystem. Generally, I would rant on PHP for this, but seriously now, had they been on jvm, a complicated application like a forum talk with avatars and all other fancy features, would probably still have holes in it.
astrodust 13y ago
If you're running a Bitcoin site and you're using off-the-shelf PHP, you're probably going to have a bad day.

by nwh 13y ago

citricsquid 13y ago

Source on the bounty: http://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_hacked/ccjyjti http://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_... also with an update: Update: It's unfortunately worse than I thought. There's a good chance that the attacker(s) could have executed arbitrary PHP code and therefore could have accessed the database, but I'm not sure yet how difficult this would be. I'm sending out a mass mailing to all Forum users about this. Personally I suspect that it's due to misconfigured nginx which allows uploaded files to be executed, a user in #bitcoin demonstrated they could upload a PHP file using an exploit in the avatar uploading system, although theymos did have someone looking at the nginx configurations about 6 hours ago and hasn't mentioned finding anything.

antocv 13y ago

Looks like end-point security, the (usually PHP) applications the server is running at, is a weak point in the Tor ecosystem. Generally, I would rant on PHP for this, but seriously now, had they been on jvm, a complicated application like a forum talk with avatars and all other fancy features, would probably still have holes in it.

astrodust 13y ago

If you're running a Bitcoin site and you're using off-the-shelf PHP, you're probably going to have a bad day.