CyberInsecure.com

phpBB Open Source Bulletin Board Hacked, 28,000 Passwords Out Of 400,000 Accounts Cracked And Published

One of the most widely used open-source bulletin board system, phpBB, has been attacked by malicious hackers. The security breach gave an attacker full access to a database containing names, email, address, and hashed passwords for its entire user base. phpBB is an open-source software package webmasters use to run discussion forums on their sites. It is based on the PHP language and stands for PHP bulletin board. The breach had nothing to do with phpBB, and there are no known vulnerabilities in the most recent version of the program.

In a message posted Sunday, administrators of phpBB.com said the attacker gained access through an unpatched security bug in PHPlist, a third-party email application. The miscreant had access for more than two weeks before the breach was discovered, and phpBB remained down at time of writing, more than three days later.

The attacker gained entry through a recently patched vulnerability in PHPlist, an open-source package for managing newsletters. On January 29, the program was updated to fix a security bug that allowed unauthorized access. According to the time line provided by both the purported attacker and phpBB, the attack was carried out some two weeks before the PHPlist patch was issued, courtesy of this published exploit. The attack could have been prevented by adding a single line to an administrator’s index file.

No other details were offered but the phpBB maintainers said no vulnerabilities were found in the phpBB software itself. A blogger who claimed to have carried out the attack said that details for more than 400,000 accounts were intercepted. The writer claims to have created a script that was able to crack more than 28,000 passwords hashed using an unsalted MD5 algorithm, before posting them to the internet.

A notice posted to a temporary support forum said that the latest version of phpBB uses “a complex hashing algorithm in order to prevent someone from determining the plain text value of a password.” An earlier version used less secure protection based on MD5. To be protected by the more robust algorithm, users had to have registered or logged into their accounts since the upgrade was made.

Posted in Breaches And Incidents, Data Theft, Hacked, Privacy, Targeted Attacks, Vulnerabilities |  Print This Post