By Dan Goodin in San Francisco
4th February 2009
The website for one of the net's more popular bulletin board software
packages has been taken offline following a security breach that gave an
attacker full access to a database containing names, email, address, and
hashed passwords for its entire user base.
In a message posted Sunday, administrators of phpBB.com said the
attacker gained access through an unpatched security bug in PHPlist, a
third-party email application. The miscreant had access for more than
two weeks before the breach was discovered, and phpBB remained down at
time of writing, more than three days later. Administrators didn't
respond to emails seeking comment.
A blogger who claimed to have carried out the attack said that details
for more than 400,000 accounts were intercepted. The writer claims to
have created a script that was able to crack more than 28,000 passwords
hashed using an unsalted MD5 algorithm, before posting them to the
internet. The passwords were not accessible at time of writing.
A notice posted to a temporary support forum said that the latest
version of phpBB uses "a complex hashing algorithm in order to prevent
someone from determining the plaintext value of a password." An earlier
version used less secure protection based on MD5. To be protected by the
more robust algorithm, users had to have registered or logged into their
accounts since the upgrade was made.
Best Selling Security Books & More!