3 ms·
Other than the obvious, some things worry me. > We have confirmed that initial entry was made via a team member's compromised login details and not as the resu
by anw 12y ago
Other than the obvious, some things worry me.
> We have confirmed that initial entry was made via a team member's compromised login details and not as the result of a vulnerability in the phpBB software.
> The attackers were able to obtain access to the phpBB.com and area51 databases, meaning that user information, including hashed salted passwords, was compromised. Additionally, all logins on area51 between Dec. 12th and Dec. 15th were logged in plaintext. While the hashing algorithm utilized in phpBB will make it difficult to obtain those passwords, you should not take any chances.
A bit of clarification should be given. The staff's login information was stolen, allowing someone to get a dump of the database containing user info. What kind of login information was stolen? Is this an shell account, was an SSH key stolen, was this an admin panel account?
Secondly, "all logins [...] were logged in plaintext". Does this mean the username and password were logged, the password hashes and sessions? What actual information was plaintext to the user?
It's great that groups are willing to own up to these kinds of events, but without specific information, it's hard to understand how broad a compromise we're talking.
- ars 12y agoThe hacker probably modified the code to log all passwords. If you logged in on the dates specified you should assume your password has been stolen.
- wGEric 12y agoHere is an email I received from phpbbhelp.org: > Hello everyone, > > On September 9th, an attacker was able to gain unauthorized access to the server hosting phpbbhelp.org. This remained unnoticed until late yesterday. The individual (might be individuals) responsible is the same one taking credit for the Tapatalk, phpBB.com, and Ars Technica breaches. > > A keylogger was added to the login page, and if your username is on the following list, the plaintext password you used on phpbbhelp.org is likely in their hands. > List: [removed] > We have to assume that the database was likewise dumped and that everyone's email addresses and hashed passwords are likewise in the wild. > > Please change any password that you may have used on phpbbhelp.org since September. > > If I have any further information, I will provide it. USF will remain offline until after we have restored phpBB.com and I have some time to go through it. > > > > - Yuriy Rusko I'm would assume the same thing was done on the phpbb.com servers.