Topic: Why Simple Machines forum & not anything else ?. (Read 2446 times)

The free open source ones seem to suffer from hacking attempts, not sure about vbulletin, when i used to use phpbb people always got hacked.

Wait, that actually happened? I thought it was just something in the video that was just put there for humorous reasons (like a montage parody or something).

I do know who he is, but he didn't cause any permanent damage or steal any user info, so I decided not to go after him. It was just a funny joke.

I do know who he is, but he didn't cause any permanent damage or steal any user info, so I decided not to go after him. It was just a funny joke.

Maybe that could be implemented as an April fools joke? Anyways, did you guys catch the hacker, or at least know who he is?

Maybe that could be implemented as an April fools joke? Anyways, did you guys catch the hacker, or at least know who he is?

Anyways, I found this picture, it is one of the things the hacker did.

Not found the thread but found a video of apparently what the hack did:
https://www.youtube.com/watch?v=LKrOHAfMdxI

Yes all else aside, it was pretty funny. Would pop up a dialog box with a progress meter that said it was converting your bitcoins to cosbycoins. 

Woops right , didn't read it correctly . They are holding them I see , but why it's splitted to different people and I don't know anyone of them at least not Administrators or Moderators/Staff members

He didn't donate anything, thats the money the forum currently has and whos holding it. There is a list of some donators here
https://bitcointalk.org/donate.html

Dafuq only Theymos him self donated like 1.2m (with the current price of BTC) that's so huge
and to be honest with you , no I didn't knew that . I personally think that only few people donate to free projects like these (Firefox,Ubuntu etc ... ) idk .. I can seem to belieave that people could donate such amounts of money . but i can't say I was thinking about Developpers of those wallets yeah ... nice to hear that they got paid after all

Yes, read up on it. The funds were raised from donations to bitcointalk and profit from forum ads back when the Bitcoin price was a lot less. The forum never sold any BTC. Here is how much the forum holds now:

https://bitcointalksearch.org/topic/forum-funds-155000

And you do realize that some of the Bitcoin Core developers are paid >$100,000/yr salaries, yet the software is free. And the same can be said about the Linux kernel, Firefox web browser or any other large FOSS software project.

So you are telling me someone would pay 1$ million dollar just to develop a forum & at the end of the day that forum will be Free & Open source ? Like seriously ? do you really belieave that because I don't   It just dosen't make any sense

The costs are expected to be closer to $1 million in the end, $350k has been spent to date.

The software will be entirely free and open source, released under the MIT license just like Bitcoin Core.

I think also if the username was known the "hacker" has used tor or a vpn/proxy.

Hmm, I don't have the impression this has been cleared up very well.
For example, is the username known who uploaded the malicious avatar?

That's true. Will epochtalk be available for free? I guess not, given the >350k dev costs. So one should price licenses competitively and sell only for bitcoins..

What the hell lol , this is really happened on the website ? It looks a video montage to me  btw here is more informations about the hack , found this on the description of that video => http://www.reddit.com/r/Bitcoin/comments/1nmdq4/bitcointalk_hacked/
also more info here : http://cryptolife.net/bitcointalk-hacked/

Not found the thread but found a video of apparently what the hack did:
https://www.youtube.com/watch?v=LKrOHAfMdxI

UPDATE FROM THEYMOS:

It’s unfortunately worse than I thought. There’s a good chance that the attacker(s) could have executed arbitrary PHP code and therefore could have accessed the database, but I’m not sure yet how difficult this would be. I’m sending out a mass mailing to all Forum users about this.

Summary: The forum will be down for a while. Backups exist and are held by several people. At this time I feel that password hashes were probably not compromised, but I can’t say for sure. If you used the same password on bitcointalk.org as on other sites, you may want to change your passwords. Passwords are hashed using sha256crypt with 7500 rounds (very strong). The JavaScript that was injected into bitcointalk.org seems harmless.

Here’s what I know: The attacker injected some code into $modSettings['news'] (the news at the top of pages). Updating news is normally logged, but this action was not logged, so the update was probably done in some roundabout way, not by compromising an admin account or otherwise “legitimately” making the change. Probably, part of SMF related to news-updating or modSettings is flawed. Possibly, the attacker was somehow able to modify the modSettings cache in /tmp or the database directly.

Also, the attacker was able to upload a PHP script and some other files to the avatars directory.

Figuring out the specifics is probably beyond my skills, so 50 BTC to the first person who tells me how this was done. (You have to convince me that your flaw was the one actually used.) The forum won’t go back up until I know how this was done, so it could be down for a while.