(12-30-2014, 11:13 PM)Ominous Wrote: Could it have been possible that Sinisterly was breached through your hosting provider? I previously had my forum hacked because of poor security on the host I was on.

Otherwise, it might be a vulnerability in a plugin that is in use, or even in MyBB itself, since the team isn't working on 1.6 anymore, unfortunately.

---

Someone has the right idea. If you're able to find a critical exploit in 1.6.16 now, practically every other MyBB forum is at your mercy since 1.6 isn't going to be updated, and people are too lazy to switch to 1.8 because themes and many plugins will be incompatible.

(12-31-2014, 01:36 AM)phyrrus9 Wrote: A backup from 12/26 was restored, so anything made after that is now nonexistent. It does not look as though any breach was done via the hosting company as the injection vector was identified to be the ACP. How they got in there, we don't yet know.

(12-31-2014, 02:47 AM)phyrrus9 Wrote: That was @Oni who came to that solution, they planted a remote shell from there. We intercepted it before anything serious was done (the filename was hilarious), and then took the remainder of the 2 days to implement countermeasures and do damage control.

(12-31-2014, 11:58 PM)Lux Wrote: Why do I feel that one of our old users, who is/was in 'Lizard Squad', may have something to do with this, as LS have become active again, around the same time as this.

Also that the DDoS' were apparently from shelled sites/servers, and that SL was reportedly shelled?

Hmm... Fishy...

#CUNSPIRASEA

(01-01-2015, 12:17 AM)Oni Wrote: We know who it was. I am just not announcing who. Last thing we need to do is give the kid fame. If anyone is genuinely curious, they can shoot me a private message.

(01-01-2015, 04:32 AM)phyrrus9 Wrote: Pretty much immediately, he sent @Oni a message about it.

Omniscient Wrote:Just a quick heads up that in the next 2-3 days a lot of rumors might spread about a 0day or MyBB exploit floating around.

It's nothing more than a very low security risk bug that requires credentials to be exposed as well as a malicious site visit (CSRF).

So don't be alarmed by news of this and start freaking out. You don't need to change your passwords or do anything different. Just exhibit the same common sense browsing habits you normally would to maintain your safety.

1. Don't download anything from potentially malicious sites.
2. Don't click links you're not familiar with. Important to hover over a link sometimes to ensure it's not forged anchor text.
3. Don't use the same password on HF anywhere else. This is seriously important.

Just don't worry about it though otherwise.

(01-01-2015, 05:24 AM)Ominous Wrote: Well someone definitely wanted to brag about their "accomplishment."

So is this confirmed to be some sort of 0-day, or did the attacker smash their head into their keyboard and guess Oni's password?

Edit: Found some more info on this vulnerability/bug

(01-01-2015, 05:29 PM)Oni Wrote: I find it very unlikely that he's correct.

(01-01-2015, 05:44 PM)The Toilet Paper King Wrote: Given his experience vs your experience - I'd take his statements over yours on the matter any day. I mean really - he's not a super admin or anything, but you're still a massive noob in comparison. I think it's just pure dumb luck that this site is still online