http://www.theregister.co.uk/2009/02/04/phpbb_breach/ 

By Dan Goodin in San Francisco
The Register
4th February 2009

The website for one of the net's more popular bulletin board software 
packages has been taken offline following a security breach that gave an 
attacker full access to a database containing names, email, address, and 
hashed passwords for its entire user base.

In a message posted Sunday, administrators of phpBB.com said the 
attacker gained access through an unpatched security bug in PHPlist, a 
third-party email application. The miscreant had access for more than 
two weeks before the breach was discovered, and phpBB remained down at 
time of writing, more than three days later. Administrators didn't 
respond to emails seeking comment.

A blogger who claimed to have carried out the attack said that details 
for more than 400,000 accounts were intercepted. The writer claims to 
have created a script that was able to crack more than 28,000 passwords 
hashed using an unsalted MD5 algorithm, before posting them to the 
internet. The passwords were not accessible at time of writing.

A notice posted to a temporary support forum said that the latest 
version of phpBB uses "a complex hashing algorithm in order to prevent 
someone from determining the plaintext value of a password." An earlier 
version used less secure protection based on MD5. To be protected by the 
more robust algorithm, users had to have registered or logged into their 
accounts since the upgrade was made.

[...]


_______________________________________________      
Best Selling Security Books & More!
http://www.shopinfosecnews.org/