Recent hackings, who fault is it!?

[Enter Username Here]

My password is dog99.

 

[+paradox]

My password is dog99.

you too?

 

[Darth-Apple]

Well I did some quick research, and I'm wondering if it could be possible that one of the SQL injection vulnerabilities fixed in MyBB 1.8.2 may have been used to brute force weak passwords. You can't easily brute force MyBB without a vulnerability because it limits login attempts, nor can you easily unhash a secure password, but SQL injection is a bit of a backdoor on its own to getting information about fields in the database while bypassing other security measures.

Not sure if this is how so many forums were recently hacked or not. If it is, it might explain why people have linked the hackings with weak passwords. Either way, it's good that the team has patched the issue. I'm very surprised at how many vulnerabilities were fixed in the latest version of MyBB.

 

[Payton]

Well I did some quick research, and I'm wondering if it could be possible that one of the SQL injection vulnerabilities fixed in MyBB 1.8.2 may have been used to brute force weak passwords. You can't easily brute force MyBB without a vulnerability because it limits login attempts, nor can you easily unhash a secure password, but SQL injection is a bit of a backdoor on its own to getting information about fields in the database while bypassing other security measures.

Not sure if this is how so many forums were recently hacked or not. If it is, it might explain why people have linked the hackings with weak passwords. Either way, it's good that the team has patched the issue. I'm very surprised at how many vulnerabilities were fixed in the latest version of MyBB.

That's a possible scenario, albeit less likely. I feel like it is also likely that the hacker could have done a simple query like...

UPDATE `mybb_users` SET `password` = 'hashed_password' WHERE `username` = 'admin_username'

... to grant access to an admin account.

 

[Darth-Apple]

I tried that on a test forum out of curiosity, but the SQL injection vulnerability is a little difficult to exploit because the query is complicated and the PHP/MySQLi driver doesn't support stacked queries with the default mysqli_query function that the MyBB uses. So, for example, using the following in the form field won't work:

[hash value]' AND q.qid = '15'; UPDATE `mybb_users` SET `usergroup` = '4' WHERE `uid` = '2' --

For that reason, SQL injections for applications that use PHP and MySQLi are often a little trickier to implement because they generally rely on manipulating the query that already exists. Then again, the only time I ever try this stuff is on a test forum for the sake of curiosity, so I'm by no means an expert when it comes to this stuff.

 

[Payton]

I tried that on a test forum out of curiosity, but the SQL injection vulnerability is a little difficult to exploit because the query is complicated and the PHP/MySQLi driver doesn't support stacked queries with the default mysqli_query function that the MyBB uses. So, for example, using the following in the form field won't work:

[hash value]' AND q.qid = '15'; UPDATE `mybb_users` SET `usergroup` = '4' WHERE `uid` = '2' --

For that reason, SQL injections for applications that use PHP and MySQLi are often a little trickier to implement because they generally rely on manipulating the query that already exists. Then again, the only time I ever try this stuff is on a test forum for the sake of curiosity, so I'm by no means an expert when it comes to this stuff.

Interesting! Which version of the software was Off Topix and EUH's forum using when it was exploited? I'd like to try it out myself. Could it perhaps be a subquery?

 

[+paradox]

@Payton, mybb 1.6.x i believe...

 

[~KAGE-008]

This one was using MyBB 1.6.X before it was hacked.

 

[Darth-Apple]

1.6 isn't vulnerable to this particular SQL injection vulnerability. It's a vulnerability in the security questions feature that comes with MyBB 1.8, which was obviously not present in MyBB 1.6.x.

As for subqueries, I had tried that as well just out of interest. I could have done something wrong, but I don't think MySQL allows "update" subqueries in a select query. I'm not an expert on this though.

 

[Enter Username Here]

Well it was confirmed to me that my hacking was through a news plug-in.

But, if you add an Admin PIN and back up your database daily/nightly, the measures are not that bad if you do get "Shade and Spook'ed".

 

[Darth-Apple]

You should share the URL to the plugin that was vulnerable to warn other administrators. The team may add it to the vulnerable plugins list.

 

[Enter Username Here]

Paul.H of MyBB support is aware of the plug-in and I think he's on it.

I've noticed strange activity lately too, like on my forum people recovering passwords on Online List.