Topic: Ändert eure Passwörter ! (Read 2633 times)

Ändert euer Foren-Passwort !
Obwohl die Passwörter mit 7500 Runden SHA 256 und einem Salt gehasht wurden , sind Wörterbuch-Attacken nicht auszuschließen.

das dumme für die anderen war das man nun auch eine derer Hintertüren gefunden hat (FEDS?)

Die Zahl der SR Accounts hat nichts zu sagen. Aktive Accounts davon waren es glaube ich ca. 140k ? Steht auf jedem Fall in dem Bericht mit drin. Aktiv = entweder was gekauft oder verkauft,

Die anderen waren wohl nur neugierig.

Hinter jedem von uns fleißig tippenden Leuten stehen 6 die nicht im Bitcoinforum angemeldet sind aber dafür auf der SR angemeldet waren.

Also ich bin begeistert, wie gut der btc diese Woche durchstanden hat.  
Jetzt fällt nämlich auch das mieseste Argument gegen btc weg(SR).

Ja, das war ja was mit diesem perfekt getimten Angriff.

Da hat offensichtlich jemand auf eine gute Gelegenheit gewartet den durchzuführen, bin mal gespannt wie lange die schon Zugriff hatten um so etwas auszuführen.

Naja, bis auf ein paar Spekulanten, die auch offensichtlich nur gehofft haben wieder billiger einzukaufen hat sich der BTC ja ziemlich unbeeindruckt gehalten. 

So ein Stress Test ab und zu ist doch auch was wert. Der Bitcoin ist in den letzten Monaten offensichtlich um einiges widerstandsfähiger geworden.

Drei Tage war der Bitcointalk so krank!
Jetzt schnauft er wieder.
Gott sei Dank!

On October 3, it was discovered that an attacker inserted some JavaScript into forum pages. The forum was shut down soon afterward so that the issue could be investigated carefully. After investigation, I determined that the attacker most likely had the ability to execute arbitrary PHP code. Therefore, the attacker probably could have accessed personal messages, email addresses, and password hashes, though it is unknown whether he actually did so.

Passwords were hashed very strongly. Each password is hashed with 7500 rounds of sha256crypt and a 12-byte random salt (per password). Each password would need to be individually attacked in order to retrieve the password. However, even fairly strong passwords may be crackable after a long period of time, and weak passwords (especially ones composed of only a few dictionary words) may still be cracked quickly, so it is recommended that you change your password here and anywhere else you used the password.

The attacker may have modified posts, PMs, signatures, and registered Bitcoin addresses. It isn't practical for me to check all of these things for everyone, so you should double-check your own stuff and report any irregularities to me.

How the attack was done

I believe that this is how the attack was done: After the 2011 hack of the forum, the attacker inserted some backdoors. These were removed by Mark Karpelles in his post-hack code audit, but a short time later, the attacker used the password hashes he obtained from the database in order to take control of an admin account and insert the backdoors back in. (There is a flaw in stock SMF allowing you to login as someone using only their password hash. No bruteforcing is required. This was fixed on this forum when the password system was overhauled over a year ago.) The backdoors were in obscure locations, so they weren't noticed until I did a complete code audit yesterday.

After I found the backdoors, I saw that someone (presumably the attacker) independently posted about his attack method with matching details. So it seems very likely that this was the attack method.

Because the backdoors were first planted in late 2011, the database could have been secretly accessed any time since then.

It was initially suspected by many that the attack was done by exploiting a flaw in SMF which allows you to upload any file to the user avatars directory, and then using a misconfiguration in nginx to execute this file as a PHP script. However, this attack method seems impossible if PHP's security.limit_extensions is set.

The future

The forum is now on a new server inside of a virtual machine with many extra security precautions which will hopefully provide some security in depth in case there are more exploits or backdoors. Also, I have disabled much SMF functionality to provide less attack surface. In particular, non-default themes are disabled for now.

I'd like to publish the forum's current code so that it can be carefully reviewed and the disabled features can be re-enabled. SMF 1.x's license prohibits publishing the code, though, so I will have to either upgrade to 2.x, get a special copyright exception from SMF, or do the auditing myself. During this investigation, a few security disadvantages to 2.x were brought to my attention, so I don't know whether I want to upgrade if I can help it. (1.x is still supported by SMF.)

Special thanks to these people for their assistance in dealing with this issue:
- warren
- Private Internet Access
- nerta
- Joshua Rogers
- chaoztc
- phantomcircuit
- jpcaissy
- bluepostit
- All others who helped