Hacked!

General Discussions
#1

Puppygames got thoroughly hax0red this morning. I think that’s the end of the road for my forums, but they’ve done their job OK.

Sorry for the inconvenience and the little bit of spam you may have received from the hacker.

Cas :slight_smile:

#2

I noticed that. Bad luck…

#3

Yeah, noticed the spam. Sorry to hear that. :frowning:

You could consider it a good sign that some hacker somewhere considers your games company site big enough to bother hacking!

Woot! You hit the big time! :wink:

Kev

#4

Puppygames: The new Valve…

#5

ack, that sucks =(

Do you know how they got in?

#6

Recently unearthed sploit in phpbb, patch was only available for 2 weeks, and I never found out about it.

Cas :slight_smile:

#7

That really sucks. Bloody hackers. >:(

#8

That really sucks. Bloody phpBB.

#9

When I looked at the fix, I was reminded why I code in Java and not scripting languages.

Cas :slight_smile:

#10

Aww… that exploit. I PMed one of the yakyak admins the day the vuln was found (and it was patched hours later)… but I’d forgotten that you use phpBB, too. :-/

#11

Not any bloody more I don’t.

Cas :slight_smile:

#12

Uhm… and lwjgl.org? That’s certainly not the latest version.

#13

[quote]Uhm… and lwjgl.org? That’s certainly not the latest version.
[/quote]

[quote]we have also applied other fixes in the past, so the 2.0.4 version string isn’t all that correct.
[/quote]

#14

If anyone knows the bastard who is diRecTor, tell him to suck my ass for his shit!

#15

A script kiddy no doubt, I’ve seen this before on forums which had no visits in months.

You are right though, if one uses PreparedStatements with JSP/Servlets it’s pretty hard for SQL injection attacks to work. When codeing PHP, you have to be really careful.

Will.

#16

You might want to switch to IPB… Not free, but very secured and professional.

Chman

#17

[quote]we have also applied other fixes in the past, so the 2.0.4 version string isn’t all that correct.
[/quote]
When you update Cas, make sure you copy the install directory, and run “update_to_latest.php” as that updates your database (including the version string). Then, delete that install direcotry.

I noticed that version 2.0.13 is out, and in this one they hide the version string totally except in the admin pages.

Is there any reason that the LWJGL forums at http://lwjgl.org/forum/ are locked?

Cheers,

Will.

#18

eep! glances over at his phpbb forums

EDIT: Yes Will, check here. They’re down while the site is updated.

EDIT 2: All is safe, patch installed :slight_smile: (I hope!)