[Oni]

Seems like we aren't the only site this happened to.

Could it have been possible that Sinisterly was breached through your hosting provider? I previously had my forum hacked because of poor security on the host I was on.

Otherwise, it might be a vulnerability in a plugin that is in use, or even in MyBB itself, since the team isn't working on 1.6 anymore, unfortunately.

---

Someone has the right idea. If you're able to find a critical exploit in 1.6.16 now, practically every other MyBB forum is at your mercy since 1.6 isn't going to be updated, and people are too lazy to switch to 1.8 because themes and many plugins will be incompatible.

It wasn't through the hosting company. I considered it a possibility early on, but nope.

A backup from 12/26 was restored, so anything made after that is now nonexistent. It does not look as though any breach was done via the hosting company as the injection vector was identified to be the ACP. How they got in there, we don't yet know.

But, nobody is getting into the ACP ever again. It's really well hidden.

Spoiler:

"/reallywellhidden" was the old admin panel link. Creative, right?

That was @Oni who came to that solution, they planted a remote shell from there. We intercepted it before anything serious was done (the filename was hilarious), and then took the remainder of the 2 days to implement countermeasures and do damage control.

"dongs.php" - literally the only reason I didn't get mad about the whole thing. To be honest, we've done worse to others. @phyrrus9 and a couple others believe that no data was taken, although I am slightly inclined to believe otherwise. That being said, they have seen everything that I have, and that's their conclusion. Either way, everyone should be careful about their passwords.

[Ominous]

Probably an unreleased MyBB vulnerability then...

Anyways, do you use the Admin CP PIN plugin Oni? That seemed helpful in thwarting an attack on my forum when I had it installed. That, and the Admin CP Honeypot.

[lux]

Why do I feel that one of our old users, who is/was in 'Lizard Squad', may have something to do with this, as LS have become active again, around the same time as this.

Also that the DDoS' were apparently from shelled sites/servers, and that SL was reportedly shelled?

Hmm... Fishy...

#CUNSPIRASEA

[Oni]

Why do I feel that one of our old users, who is/was in 'Lizard Squad', may have something to do with this, as LS have become active again, around the same time as this.

Also that the DDoS' were apparently from shelled sites/servers, and that SL was reportedly shelled?

Hmm... Fishy...

#CUNSPIRASEA

We know who it was. I am just not announcing who. Last thing we need to do is give the kid fame. If anyone is genuinely curious, they can shoot me a private message.

[OversouL]

We know who it was. I am just not announcing who. Last thing we need to do is give the kid fame. If anyone is genuinely curious, they can shoot me a private message.

I'm curious. When did you know who it was?

[phyrrus9]

Pretty much immediately, he sent @Oni a message about it.

[Ominous]

Pretty much immediately, he sent @Oni a message about it.

Well someone definitely wanted to brag about their "accomplishment."

So is this confirmed to be some sort of 0-day, or did the attacker smash their head into their keyboard and guess Oni's password?

Edit: Found some more info on this vulnerability/bug

Just a quick heads up that in the next 2-3 days a lot of rumors might spread about a 0day or MyBB exploit floating around.

It's nothing more than a very low security risk bug that requires credentials to be exposed as well as a malicious site visit (CSRF).

So don't be alarmed by news of this and start freaking out. You don't need to change your passwords or do anything different. Just exhibit the same common sense browsing habits you normally would to maintain your safety.

1. Don't download anything from potentially malicious sites.
2. Don't click links you're not familiar with. Important to hover over a link sometimes to ensure it's not forged anchor text.
3. Don't use the same password on HF anywhere else. This is seriously important.

Just don't worry about it though otherwise.

[Oni]

Well someone definitely wanted to brag about their "accomplishment."

So is this confirmed to be some sort of 0-day, or did the attacker smash their head into their keyboard and guess Oni's password?

Edit: Found some more info on this vulnerability/bug

I find it very unlikely that he's correct.

[The Toilet Paper King]

I find it very unlikely that he's correct.

Given his experience vs your experience - I'd take his statements over yours on the matter any day. I mean really - he's not a super admin or anything, but you're still a massive noob in comparison. I think it's just pure dumb luck that this site is still online

[Oni]

Given his experience vs your experience - I'd take his statements over yours on the matter any day. I mean really - he's not a super admin or anything, but you're still a massive noob in comparison. I think it's just pure dumb luck that this site is still online

His statement is too broad. He's insinuating that all of the recent security breaches are due to a CSRF and lack of discretion when it comes to login details. That, of course, isn't the case for us. The vulnerability that allowed the attacker to spawn a shell, was in the admin panel (but wasn't a CSRF). Credentials weren't gained through me or clicking of an unsafe link, either. But hey, you have no experience at all - so I wouldn't take much from your statement either.