[Question] How was his forum hacked?

netomx

it bugs me... is what vanilla? or using the kernel hack?

support123

Old vanilla version vulnerability

imperio

Cause of the drama(s).

ErawanArifNugroho

permission hack?

Nickk

Was the DB stolen? Or passwords should be ok?

MrAndroid

Using SQL injection. http://www.cvedetails.com/cve/CVE-2013-3527/

netomx

danke

eastonch

Passwords were unhashed and plain text after the attacker got in, I assume the salt was in a generically readable place...

vanarp

test post

wlanboy

@eastonch
What? Plain text passwords?

Benedikt

How can one possible be that dumb to save passwords as plain text? Wtf!

eastonch

No, the passwords were hashed, but apparantly the hacker / exploiter was able to unhash them using the salt that was on the node, not 100%, just what I read, but assume PW stolen, go reset.

neroux

The salt does not need to be necessarily secret. It shall prevent the use of rainbow tables.

@eastonch How can you say whether the passwords were in a readable format?

Without more information from the system administrators it all is just guessing.

eastonch

@Neroux

On the first hack, everybody was granted admin status, and then the passwords were visible to all admins (users), I read that it had been unhashed and plain-text passwords revealed.

This again happened on the second hack.

Bogdacutuu

> On the first hack, everybody was granted admin status, and then the passwords were visible to all admins (users), I read that it had been unhashed and plain-text passwords revealed.

I only saw hashes back then.

neroux

@eastonch

The screenshots I saw only contained hashes. An "unhashing" is not possible, only brute-force attempts. I guess only @Liam can tell more

Grande

http://www.webhostingtalk.com/showthread.php?t=1266477
http://www.webhostingchatter.com/threads/lowendtalk-hacked.200/
http://www.erawanarifnugroho.com/2013/05/16/lowendtalk-hacked.html
http://www.hostingclerks.com/discussion/140/lowendtalk-com-hacked#Item_2

lol

Who did it? Someone any idea?