BleepingComputer.com: Bot Herders Ready Attack Against Message Forums

Jump to content

Page 1 of 1

You cannot start a new topic
You cannot reply to this topic

Bot Herders Ready Attack Against Message Forums

#1 quietman7

Bleepin' Janitor

Group: Global Moderator
Posts: 25,518
Joined: 09-July 05
Gender:Male
Location:Virginia, USA

Posted 21 March 2006 - 11:23 AM

Quote

The SANS Institute's Internet Storm Center (ISC) noted that a bot going by the name "FuntKlakow" has registered on thousands of phpBB forums. Speculating, ISC analyst Marcus Sachs noted that the bot's owner(s) may be preparing to exploit a zero-day vulnerability against the popular php bulletin board software.

securitypipeline.com

Microsoft MVP - Consumer Security 2007-2012

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#2 rms4evr

Distinguished Member

Group: Members
Posts: 811
Joined: 11-October 05
Gender:Female
Location:East Coast

Posted 21 March 2006 - 11:55 AM

Um...does this mean we're hosed? I hope not :thumbsup:

#3 Scarlett

Bleeping Diva

Group: Members
Posts: 7,479
Joined: 25-April 04
Gender:Female
Location:As always I'm beside myself ;)

Posted 21 March 2006 - 01:51 PM

No rms4evr

Bleeping Computer is I believe Invision Power Board.
And PHP is an entirely different board software.
Though it still not good news at all, for those that use PHP.

#4 rms4evr

Distinguished Member

Group: Members
Posts: 811
Joined: 11-October 05
Gender:Female
Location:East Coast

Posted 21 March 2006 - 11:52 PM

Good

...but your right...most forums I've seen out there use PHP...and they could be in big trouble.

#5 cowsgonemadd3

Feed me some spyware!

Group: Banned
Posts: 4,557
Joined: 18-July 04

Posted 22 March 2006 - 12:13 AM

#6 Security Geek

Member

Group: Members
Posts: 39
Joined: 10-March 06

Posted 22 March 2006 - 01:19 AM

We're recommending if forum admins see this user registered that they leave the account but disable it or change the password. That will keep this bot from simply reregistering the user if the account is deleted. Apparently you need to be running the phpBB forum software, not just a forum application that uses the PHP language. The exploit will need an attack vector and its probably doing that through an unpublished hole in the phpBB code (though no one is sure yet).

NIST.org- It's not enough to be secure, you have to prove you're secure.™