[Discussion] Downtime and Server Compromise

A_Jelly_Doughnut · Post by **A_Jelly_Doughnut** » Mon Feb 02, 2009 4:03 am

From the announcement:

Passwords stored in the old format are much less secure than those stored in the new format. The attackers have been focusing purely on the passwords stored in the old format.

In other words, password hashes were available. In order to get teh actual password, some type of brute-forcing would need to be done.

Daveht · Post by **Daveht** » Mon Feb 02, 2009 4:04 am

Any word on how things are going an a time line for it to be back online?

Thanks!
Dave

Post by **Marshalrusty** » Mon Feb 02, 2009 4:09 am

Daveht wrote:Any word on how things are going an a time line for it to be back online?

"As soon as we can" is the best estimate anyone can give. It might be a few days. We are trying to be very thorough.

parasolx wrote:Oic.. so attackers have entered through phplist to access all phpbb.com database. Then he could review all the private data which not allow being see by registered users.

If that happen, why phpbb.com have closed the board? Because it only can view the private data only, not edit any phpbb files?

I'm not sure how you came to that conclusion from the announcement. Yes, modifications were made. Even if modifications were not made, that would be enough for us to take down the site for an investigation.

Phil · Post by **Phil** » Mon Feb 02, 2009 4:10 am

We're working as quickly as possible. We don't want to risk missing anything that might allow them to get back in. No estimates as of yet.

Daveht · Post by **Daveht** » Mon Feb 02, 2009 4:13 am

Thank you!

Dave

parasolx · Post by **parasolx** » Mon Feb 02, 2009 4:14 am

in phpbb3, there is a system that could send a mass email to all users.. and announcement wrote before said this problem doesn't related with phpbb software.

so, it is safe for me using phpbb3 for right now?

ToonArmy · Post by **ToonArmy** » Mon Feb 02, 2009 4:16 am

parasolx wrote:in phpbb3, there is a system that could send a mass email to all users.. and announcement wrote before said this problem doesn't related with phpbb software.

so, it is safe for me using phpbb3 for right now?

There is nothing wrong with phpBB.

A_Jelly_Doughnut · Post by **A_Jelly_Doughnut** » Mon Feb 02, 2009 4:17 am

parasolx: This problem was not with phpBB3. The phpBB built-in mass email feature was not used at phpBB.com.

kripkorn · Post by **kripkorn** » Mon Feb 02, 2009 4:24 am

may i know why phpbb.com doesnt use phpbb mass email buit in? why use another software?

Post by **Marshalrusty** » Mon Feb 02, 2009 4:43 am

kripkorn wrote:may i know how phpbb.com doesnt use phpbb mass email buit in? why use another software?

PHPList was completely separate from the board on phpBB.com. You didn't have to be a registered user on phpBB.com to receive newsletters. Not all registered users received newsletters.

Development Discussion Board

[Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise

Re: [Discussion] Downtime and Server Compromise