Some facts about the PHPList vulnerability and the phpbb.com hack
A few days ago phpbb.com was hacked through a super-globals-overwrite vulnerability in PHPList that was used by an attacker for a local file inclusion exploit. [--cut] From the explanation it seems that the PHP installation on phpbb.com was more or less a default one that was not hardened against attacks at all, but I will get into this later.
First I want to shed some light on the super-globals-overwrite vulnerability in PHPList that was wrongly attributed a local file inclusion vulnerability in so many places (including the PHPList announcement). [...]
-----------------------------...
Tech~Covo
Home of -jm- AKA juanm ,,, with stuff, some news, an album and so on
News
phpBB.com back online
And then the most important thing:
What happened yesterday
As you might have already seen from this global announcement yesterday morning, phpBB.com server was cracked by a script kid who exploited a vulnerability on phplist found surfing through a 'security' site, and then leaked the stolen data with the world.
No vulnerability was found into phpBB3 itself. Please note that your account on phpbb.com might have been compromised (e.g. : password leaked) if you didn't login after the conversion to the new password hashing system (MD5 can be bruteforced). Please note also that we strongly advice you not to use the same combination password-usernam... Last edited by Juanm on Monday February 2nd, 2009 09h22:00, edited 2 times in total.
Reason: updated Emergency notice
(contacts here (301), details here) Channel topic #phpbb - 7:43 UTC+1 2/1/2009
RSS troubles (fixed)
Hi, there were some troubles in the past days with RSS feeds hanging around.
Let's see:
Many feeds moved
Hi,
As you might have noted, all feeds have been moved, and in the meanwhile a little page restructuring was in order. If you are a subscriber and you don't want the 301 redirect, replace
Of course this doesn't affect the few self-hosted feeds you might find around  2.0.x MODs of mine disc
All MODs of mine related to phpBB 2.0.x are discontinued since January 1st 2009 due to phpBB Group discontinuing support for 2.0.x line.
No more updates will be released. Cricca guestbook due to its peculiarity (taken over from 3rd part by me and then with two unofficial release hanging around elsewhere) might receive some basic support, but nothing more. No replacement is available for Olympus yet and there's nothing in the workload at least for now. Album feed reactivated
It was down since the site conversion, happened on August 3rd, 2008.
Now the photoalbum RSS feed has been brought to a new life. As an addition, latest posts, latest downloads, latest album photos appear on the right side of the home page too. Have fun Windows 7 beta available 'til january 24th
On january 10th both the Windows 7 download page and Microsoft.com were intermittently unreachable despite the "additional infrastructure support to the Microsoft.com properties" announced on jan 10th 2009, 03:53:00 . Then a new post was made on win7 team blog yesterday night
phpBB2 official support discontinued this morning
19h18' ... this is the timeframe passed from the official closing of phpBB2 support and 2.0.x support forum locking on phpBB.com
And then ....
|
Latest postsLatest downloadsMODification announcementsLatest photosLast edited pages |
