my-symbian.com hacked!

If people channel their energy towards something creative and not some script kiddy games the world would be a better place.I hope My-Symbian will be back soon.

They have only raplaced a couple of pages.I'm browsing the 9500 forum right now: http://my-symbian.com/forum/viewforum.php?f=1

GhostDog wrote:If people channel their energy towards something creative and not some script kiddy games the world would be a better place.I hope My-Symbian will be back soon.

They have only raplaced a couple of pages.I'm browsing the 9500 forum right now: http://my-symbian.com/forum/viewforum.php?f=1

Cheers for the link - I'm back on :icon14:

Rizlam wrote:It's been proper hacked 😞

It wasn't hacked. Someone took advantage of a very serious exploit in phpBB. It lets use the viewtopic.php script of phpBB forum to modify, delete or alter files on server without actually getting into it. All one has to do is to pass a code as a parameter for viewtopic.php - it's enough to copy it to the browser's URL bar and hit Enter. Geez, can you believe it's been in phpBB ever since it was born?

The problem is that phpBB released a fix for it three weeks ago but they forgot to mention what the fix fixes and how important it is. It wasn't even called "critical" - they added it only recently.
http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240636

They only managed to say how important the update is today. Now they call it extremely serious.
http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=244451
Only after someone discovered the issue and attacked a lot of websites.

This is a very irresponsible behaviour of the phpBB team. They should ALWAYS provide full information about all risks. I know phpBB is free, but it is too widely used for such things to be ignored by the developers. I know that I should be taking care about my website myself and that I should apply all updates, but I should be told about such serious security issues. Keeping such things in secret doesn't help. If I knew about the issue, I would have updated the forums three weeks ago.... I ignored the update because (based on its description) I considered it a cosmetic release.

I will look for something more reliable and secure than phpBB for my website.

BTW. The very same happened yesterday to Kylom.

Michael,

Thanks for letting us know. I know we changed away from phpBB to vBulletin on AAS over a year ago, but it's still worrying. I guess websites (just like phones) have one important rule... ALWAYS Back Up Your Data!

Glad you're back.