Codezwiz >> Forums >> The Board >> phpBB.com hacked

[ Register or login to view links on this board. ]
Creating Communities

At present [ Register or login to view links on this board. ] is offline due to a group of politically motivated hackers wishing to use an opensource project to push their agenda ... shame on them.

I will take this opportunity to note that given currently available information this hacking episode does not appear to be due to phpBB itself. Instead a third party application looks to have been the problem. Other sites were attacked at the same time as [ Register or login to view links on this board. ] by the same group displaying the same information and in these cases the same third party application has been suggested as the common factor (thus far). Equally we are not aware of any other phpBB boards being attacked and we have not been notified of any valid security issues recently. Obviously we will have more details when we've reviewed just what happened.

We are working to recover the server but this may take some time. Meanwhile users can visit our development board, area51.phpbb.com where they can receive support for phpBB 2.0.x. Of course you can also view the next version of phpBB, 3.0 "Olympus" in the process (minus the new style of course!)

We are also maintaining our IRC support channel, #phpbb on the irc.freenode.net network

We apologise for any problems this may cause our userbase. We obviously take the huge support our community gives phpBB very seriously. And we will do our best to return to "normal operations" just as soon as we can.

psoTFX - phpBB Group

ty for the info

Now I know why I couldn't access the phpBB site, thanks for the update.

i was just over there and saw that, came back here to post and found this post.

i don't know about you guys, but i find it a bit disconcerning when the developer's own site gets hacked.

i'm kind of glad i haven't started promoting my site yet, otherwise i'd likely be doing backups twice a day right now.

Yes they are claiming its because of third party software. I personally dont use a standard phpBB (not obvious?) but I would be on the look out.

I've read about this on several websites today. Any idea what the "third-party software" is that they're referring to?

If I had to guess I would say there php engine. Not real sure though.

i heard it was AWStats.
http://www.awstats.org/

this is a msg on awstats site

Warning, a security hole was recently found in AWStats versions from 5.0 to 6.2 when AWStats is used as a CGI: A remote user can execute arbitrary commands on your server using permissions of your web server user (in most cases user "nobody").
If you use AWStats with another version or with option AllowToUpdateStatsFromBrowser to 0, you are safe. If not, it is highly recommanded to update to 6.3 version that fix this security hole.

did a little research to protect my site....apparently this guy has been busy
[ Register or login to view links on this board.]
[ Register or login to view links on this board.]

he also attacked xoops cms via awstats
[ Register or login to view links on this board.]

maybe this should be posted in the news section?