My Board

Message Board Security Problems

By T Frady

Security leaks can be a big problem for any site using a message board. Hackers can actually use your message board to go in and change things on your site.

This has happened to me at least four times. Once an iframe was added to every single page of one of my very large sites. Thankfully, I had it completely backed up, so all I had to do was send the pages back up to the server. Twice, the front page of one of my sites was hijacked. The entire content of the front page was replaced by some note from a hacker stating he had been there.

The last time one of my sites had to be taken down to prevent the server from crashing. After calling my web host they were able to tell me my message board was the cause of the problem. I used, and still do on some sites, the phpbb message board. It is one of the most popular boards on the internet, and it's free. The web host tech told me that the problem was that a virus of sorts had been placed onto the server, through the message board, in the message board folder, and was calling out to other servers causing a major load on my web host's server. To fix the problem the web host tech found the file and deleted it. After that, all I had to do was update to the latest version of phpbb and so far so good.

If you use a popular message board like phpbb you need to make sure you've always got the latest version. The more popular a message board is, the more hackers are likely to strike. Perhaps the familiarity is the problem or maybe the hackers kno w they can get a lot of bites going after a widely used board. As of this writing, the most current version of phpbb is 2.0.15. As the phpbb guys are always security conscious they have added to this version a re-authentication to access the administration panel.

Forums are a very important part of a website, but they can be the downfall if your board script is not updated on a regular basis.


--------------------------------------------------------------------------------
About the Author:
T Frady webmaster of [url=\"http://www.buyersmls.com/\"]http://www.buyersmls.com/[/url] for over six years.

[url=\"http://www.enterprisesecuritynews.com/\"]source: Enterprise Security News[/url]

*edit* phpBB is up to v2.0.17 now.

yeah the reauthentication process is definately a good thing, and a surprise.. i didnt realize until i tried that even if you are on someone elses session you still have to log into admin cp unless they are already logged into and you find the hole within the admin cp. good article, ty for posting <img src=\'http://www.killanet.net/forum3/public/s ... iggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />

I ran a test this afternoon, and they (phpBB) did manage to finally patch the loopback hole that was causing so much trouble through the net... this is the well-publicized hole that's been around since 2.0.10 that allowed a user to send a string in a URL that would cause the board to essentially dos itself or another site. It was a fairly simple exploit and it's depressing that it took them this long to patch it up.
This server was protected by the exploit with mod_security and Tipping Point... but quite a few others out there were not so lucky.
On the other hand, they left a few more holes open, and from what I have heard, created a whole new one that's even more eadly than the last loopback exploit.
Shame.