ct7Security forums

Over the past year, a large number of the publicized forum hacking incidents have had as their root cause compromised access to forum staff or ftp account credentials.

While many people believe that most of the hacks happen because of unknown software bugs or zero-day exploits, that is simply not the case with most forum software hacks.  If you look at the major forum software packages, you will not see many updates in the last year because of some serious new exploit found in the code.  Yet, forums keep getting hacked.

As a consultant that assists forum owners with security matters, most of the hacks I've worked on were caused simply by staff members reusing passwords at multiple sites.  Then, when one of the other sites has its database compromised, the passwords recovered from there are used at other sites, often leading to additional hacked forums.  And, this just keeps going.  Passwords from that site, then in turn, are used to hack the next site...

Moderator or Admin accounts being accessed by persons unknown is much more common than people think.  So, my advice is that you tell your staff to never use the same password at more than one site.  If they have, they should change the password on your site immediately!

Also, maintain proper security over domain/ftp account passwords.  Change them whenever any staff change occurs, consultant finishes a project, or, if there's any chance that a password was communicated insecurely.

The vast majority of forum hacks could be prevented if the staff and server side passwords are simply kept unique to each site.

The avast! forum reopened about two hours ago. (At least that is the timing of a relauch message posted in their main section.)

The forum remains on SMF, now version 2.0.7.

Here's a view of the bottom of the index page:

avast! really seems to have dropped the ball on this.  There is no reason for them to have taken this long to address this situation.

We now have this update from SMF:

http://www.simplemachines.org/community/index.php?topic=523494.msg3704499#msg3704499

Yet, no word of update from avast! at all.

Everyone says "passwords are bad."  They are insecure by design because in order to be secure, they must be complex.  If they are complex, almost no one can remember them.  So, people either dumb-down their passwords, or, record them insecurely somewhere. ("Post-it note under the keyboard" sound familiar?)

So, I decided to use biometrics in my security app.  With the latest devices having built-in fingerprint scanners, I figured that would be the idle tool.  After a long development process, I perfected my fingerprint ID system, with biometric information stored in a database on the backend authentication server.

All tests and initial implementation went great.  It worked!  People authenticate with just a touch of a finger.  So, we went live across the board.

What could possibly go wrong?

Hackers cracked their way into the server and stole the database.  That's what could and did go wrong.

The bad guys made off with 80000 customer records, which included all the digitized fingerprint scans.  And, since I made ten separate accounts while testing, the hackers have all my fingerprints.  Since I'll never have any other fingers, and therefore no new or different fingerprints, I am basically screwed - forever.

At least with passwords, if the database was stolen, I could pick new passwords in the future.  With fingerprints, I only got 10 chances to keep them secure.  And now those are gone.

Biometrics - an idea that sounds so good on the surface, but, should never be used in the real world.

References:

http://www.wilderssecurity.com/threads/can-anyone-get-to-avast-forum-today.364250/

http://blog.avast.com/2014/05/26/avast-forum-offline-due-to-attack/