http://www.theregister.co.uk/2009/02/04/phpbb_breach/ By Dan Goodin in San Francisco The Register 4th February 2009 The website for one of the net's more popular bulletin board software packages has been taken offline following a security breach that gave an attacker full access to a database containing names, email, address, and hashed passwords for its entire user base. In a message posted Sunday, administrators of phpBB.com said the attacker gained access through an unpatched security bug in PHPlist, a third-party email application. The miscreant had access for more than two weeks before the breach was discovered, and phpBB remained down at time of writing, more than three days later. Administrators didn't respond to emails seeking comment. A blogger who claimed to have carried out the attack said that details for more than 400,000 accounts were intercepted. The writer claims to have created a script that was able to crack more than 28,000 passwords hashed using an unsalted MD5 algorithm, before posting them to the internet. The passwords were not accessible at time of writing. A notice posted to a temporary support forum said that the latest version of phpBB uses "a complex hashing algorithm in order to prevent someone from determining the plaintext value of a password." An earlier version used less secure protection based on MD5. To be protected by the more robust algorithm, users had to have registered or logged into their accounts since the upgrade was made. [...] _______________________________________________ Best Selling Security Books & More! http://www.shopinfosecnews.org/Received on Wed Feb 04 2009 - 22:58:01 PST
This archive was generated by hypermail 2.2.0 : Wed Feb 04 2009 - 23:16:50 PST