phpbb forum hacked

Our forum was hacked a few days ago, this is the second time now, is there anyone in here with the skills to track this guy down for us? I'm presenting you guys with a challenge to attain bragging rights!!!! :D

I'm not the clan owner, but an admin, if anyone can help I'll ask him to post all relevant information.

This hacker is threatening us & we suspect that we know who it is, so possibly I have his ip on file, although he claims to have deleted logs & is using a "stolen dial-up connection". I assume by his threats posted below that he intends to target our online game server's FTP next, any help on this would be greatly appreciated, as we are a gaming clan & not really into hacking related stuff.

Quote:

---

As you may be aware, the ACE forums got hacked.

The hacker sent me an email and reading it, it sounds like somebody we know.



Here they are and you tell me what you think and if you know if there is anything we can do to track him down.

I have replied to these emails and told him I already know who he is.



Email 1



Hopefully this will teach you a lesson, be careful who you **** with. Don't

spread **** that isnt true. Next time, it wont just be your forums. I will

not reveal the source of the attack, however i will tell you that your

database has been compromised. I am offering a backup of your database taken

minutes before the attack in agreement that your clan will no longer promote

several lies pertaining to other clans and their members.



~ Marx



Email 2



We'll see my friend. Since you have my home address I'm sure you wouldn't

mind sharing it with me. Also, good luck with the ip address, I don't mind

telling you that I am running off of a stolen dial up connection outside of

the states so tracking my ip address with accuracy would be quite a task.

Also, don't bother with the web logs, all traceable data has been truncated.

Hope you enjoy the surprises I have embedded for later. As for your site,

this was no attack against you as your clan surely suffers more than you do.

I have attached a copy of the backup in a previous email to your hotmail

address once you realize your forum cant do without it. I'd like to see you

speed up your game reflexes a bit, your not providing a worthy challenge

lately. See you in the games,



~ Marx

---

wow! have you patched fully & completely?

:-\

What version of phpBB are you running?
There were some vulnerabilities not to long ago.
These are the ones that were found this month.

PHPBB Authentication Bypass Vulnerability
PHPBB Session.PHP Autologin User_Level Privilege Escalation Vulnerability
PHPBB Multiple Remote Path Disclosure Vulnerabilities
PHPBB Arbitrary File Deletion Vulnerability
PHPBB Arbitrary File Disclosure Vulnerability
PHPBB Privmsg.PHP SQL Injection Vulnerability

As for recovering.. Backup the data you still trust and start over. There's no way to tell what they may have modified (Marx is hinting about a backdoor).

Thanks for the reply, that looks pretty scary,with so many hacks in a single month, is it worth sticking with phpbb or would it be more secure moving to say invision power boards :confused:

I'll find out what version we were running & post that info.

Are you running AWStats too.... This was a biggie a few weeks ago. PHPBB's site was brought down by this exploit. If you are there is a patch out there for it. Till you get it turn off AWStats.

Since he seems to be coming in as he pleases you need to consider that the box is compromised and you might have to bring it down and reinstall from scratch.

As Tiger stated, after so many breakthrus, its advisable to clean and reinstall.
Please install phpbb 2.0.13 -- current version.

OK, thanks all for the assist, we will "bite the bullet" & do a full re-install, we may move to phpnuke or stay with phpbb.

In any case, thanks to all.

[ACE]MORGUE

phpnuke? better stay on phpbb. :)

Quote:

---

Originally posted here by cacosapo
phpnuke? better stay on phpbb. :)

---

Any reason for that? security maybe?

Hey Morgue, we had a discussion of portals a few weeks ago I'll post the link. If you are having trouble maintaining the security of PhPBB then going to a product with many more features like PhPNuke may not be a wise choice. Besides, it uses PhPBB as it's Forum! ;)

//EDIT Here is the link . I see you are new, it's an old thread so don't post in it unless you have something significant to add to the discussion.

Thanks, info passed on to owner. Hopefully he will find something.

He's operating off a stolen dial-up address outside the United States huh? DHs like that piss me off.

Quote:

---

Originally posted here by RoadClosed
He's operating off a stolen dial-up address outside the United States huh? DHs like that piss me off.

---

If he's smart he'll have a few more stacked somewhere. Pretty easy to come by these days, unfortunately.

Morgue: Is the site hosted? Do they also maintain the database?
If that's the case odds are only your site got hosed.
Do they also make backups or do you have take care of that yourself?

Did you change anything to the source of phpBB?
If you didn't change anything you could download the same version from a trusted source and diff it. Anything he changed (backdoors i.e.) will popup. But then again, he probably only added himself as an admin to your site so he can change things at will.

Quote:

---

Originally posted here by SirDice

If he's smart he'll have a few more stacked somewhere. Pretty easy to come by these days, unfortunately.

Morgue: Is the site hosted? Do they also maintain the database?
If that's the case odds are only your site got hosed.
Do they also make backups or do you have take care of that yourself?

Did you change anything to the source of phpBB?
If you didn't change anything you could download the same version from a trusted source and diff it. Anything he changed (backdoors i.e.) will popup. But then again, he probably only added himself as an admin to your site so he can change things at will.

---

The site is hosted by fluxservices.com, as I understand it they had backed it up three days after it was hacked!!! I don't think the owner made a backup :(

Everything was up to date, we had 0.012 installed, except the last patch which came out on 28th Feb, just a few days before we were hacked, only one person had admin, and the source code was default. Maybe he simply guessed the pw, I remenber the site owner saying to me, that we has SIX MILLION hits in one month, yet we only have 120-140 registered users, maybe it was a pw scanner running?

Quote:

---

Originally posted here by [ACE]MORGUE
I remenber the site owner saying to me, that we has SIX MILLION hits in one month, yet we only have 120-140 registered users, maybe it was a pw scanner running?

---

Yes. That's definitely possible. It may take a while but eventually...
But all those attempts should have been logged somewhere.
Probably too late now.... but somebody should have noticed that...

Quote:

---

but somebody should have noticed that...

---

...and here lies the problem with trusting others with your property... They just don't care about it like you do....

Assuming it had been noticed, what steps could have been taken to stop such an attack?

Firewall rules would have been a good start - block the offending IP entirely. IDS would have been useful too. Maybe even packet dump all activity from the IP and allow it to break your BBS and then see how he is getting in. It really depends upon your strategy and intent.

Firewall rules would be a good start to block. In the mean time I would send the logs I already got to the ISP of the offending IP. If that ISP is any good they would take that "stolen dial-up" off the net. If you keep this up he (marx) will quickly run out of options. That ISP may even help you to find out who is using that "stolen dial-up".

There's also an 'unethical' way to track the culprit. If he (marx) can hijack that PC, chances are you can do it too. Install some monitoring software on it and wait untill he tries again. That will bring you one step closer to him. At least it'll give you an idea where he's coming from. Beat him at his own game. But as I said it's rather unethical and probably illegal.