ct7Security forums

Over the past year, a large number of the publicized forum hacking incidents have had as their root cause compromised access to forum staff or ftp account credentials.

While many people believe that most of the hacks happen because of unknown software bugs or zero-day exploits, that is simply not the case with most forum software hacks.  If you look at the major forum software packages, you will not see many updates in the last year because of some serious new exploit found in the code.  Yet, forums keep getting hacked.

As a consultant that assists forum owners with security matters, most of the hacks I've worked on were caused simply by staff members reusing passwords at multiple sites.  Then, when one of the other sites has its database compromised, the passwords recovered from there are used at other sites, often leading to additional hacked forums.  And, this just keeps going.  Passwords from that site, then in turn, are used to hack the next site...

Moderator or Admin accounts being accessed by persons unknown is much more common than people think.  So, my advice is that you tell your staff to never use the same password at more than one site.  If they have, they should change the password on your site immediately!

Also, maintain proper security over domain/ftp account passwords.  Change them whenever any staff change occurs, consultant finishes a project, or, if there's any chance that a password was communicated insecurely.

The vast majority of forum hacks could be prevented if the staff and server side passwords are simply kept unique to each site.

The avast! forum reopened about two hours ago. (At least that is the timing of a relauch message posted in their main section.)

The forum remains on SMF, now version 2.0.7.

Here's a view of the bottom of the index page:

avast! really seems to have dropped the ball on this.  There is no reason for them to have taken this long to address this situation.

We now have this update from SMF:

http://www.simplemachines.org/community/index.php?topic=523494.msg3704499#msg3704499

Yet, no word of update from avast! at all.

Everyone says "passwords are bad."  They are insecure by design because in order to be secure, they must be complex.  If they are complex, almost no one can remember them.  So, people either dumb-down their passwords, or, record them insecurely somewhere. ("Post-it note under the keyboard" sound familiar?)

So, I decided to use biometrics in my security app.  With the latest devices having built-in fingerprint scanners, I figured that would be the idle tool.  After a long development process, I perfected my fingerprint ID system, with biometric information stored in a database on the backend authentication server.

All tests and initial implementation went great.  It worked!  People authenticate with just a touch of a finger.  So, we went live across the board.

What could possibly go wrong?

Hackers cracked their way into the server and stole the database.  That's what could and did go wrong.

The bad guys made off with 80000 customer records, which included all the digitized fingerprint scans.  And, since I made ten separate accounts while testing, the hackers have all my fingerprints.  Since I'll never have any other fingers, and therefore no new or different fingerprints, I am basically screwed - forever.

At least with passwords, if the database was stolen, I could pick new passwords in the future.  With fingerprints, I only got 10 chances to keep them secure.  And now those are gone.

Biometrics - an idea that sounds so good on the surface, but, should never be used in the real world.

References:

http://www.wilderssecurity.com/threads/can-anyone-get-to-avast-forum-today.364250/

http://blog.avast.com/2014/05/26/avast-forum-offline-due-to-attack/

The avast! forum remains offline since it was hacked on May 24, 2014.  No word has yet been released as to the exact attack vector used to gain entry.  Company representatives said the database of usernames, email addresses and hashed passwords for its almost 400,000 members was downloaded by the hackers.

The avast! forum was running on the SMF (Simple Machines Forum) software package.  The avast! COO stated they were running version 2.0.6, though there was confusion over why their forum had an old copyright date notice in their footer, (i.e. SMF © 2012).  There were no versions of SMF v2 using that date.  A v2.0.6 SMF forum should have had a 2013 date for its copyright notice.

Early speculation by avast! staff was that there was an unannounced security fix in the latest version of the SMF, v2.0.7, which may have been used to hack their forum.  The SMF support team denies any security fix was included in 2.0.7.

This forum was built deliberately to review the upgrade path, copyright notice dates, and code changes, occurring from a base install of SMF v2.0.3, and stepping through each patch/upgrade kit to 2.0.7.  No 2012 copyright signature ever appeared throughout this process.  Likewise, a code review performed here showed no security fixes occurred from 2.0.6 to 2.0.7.  The changelog from the SMF website appears to be accurate.

avast! and the SMF team have said they are working together to review logs, and any other available data, in order to determine just what happened during the hack.