Unfortunately the entire posting database of the Total Commander forum was deleted last Friday by a script kiddy (a wannabe hacker who uses other people's exploits). I have restored Thursday morning's daily backup now, so all posts after this time have been lost.
But before re-opening the forum, I wanted to fully understand what was going on, to avoid that the exact same hack could be used again. The hack was possible because of a very bad security hole in some code which the phpbb makers had "borrowed" from someone else, probably without fully understanding it. See below for a detailed analysis. The hole was found in phpbb 2.0.10 and earlier about 2 weeks ago - too short for me to know about it.
You may want to change your forum password, because the hacker may have read it. I didn't find a trace of this in the logs, but it may have happened earlier. I will not inform users by mass mailing, because what you can do with a forum account is very limited. I did check that there are no additional admin accounts.
If you have a phpbb board yourself, you should quickly update to the latest version 2.0.11! You should also look for backdoors on the server - additional phpbb files which shouldn't be there.
Please only post in this thread about this incident. Thanks!
==============================================
Now for those technically interested in the reason of the hack. Please don't read it if you aren't a developer yourself. The following lines in viewtopic.php are the problem:
if ($highlight_match)
{
// This was shamelessly 'borrowed' from volker at multiartstudio dot de
// via php.net's annotated manual
$message = str_replace('\"', '"',substr(preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se',
"preg_replace('#\b(" . $highlight_match . ")\b#i', '<span style=\"color:#" . $theme['fontcolor3'] . "\"><b>\\\\1</b></span>', '\\0')",
'>' . $message . '<'), 1, -1));
}
It took me quite a while to understand this rather unusual regular expression code. It's easier to understand when split into two lines:
$repvalue = "preg_replace('#\b(" . $highlight_match . ")\b#i', '<span style=\"color:#" . $theme['fontcolor3'] . "\"><b>\\\\1</b></span>', '\\0')";
$message = str_replace('\"', '"', substr(preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', $repvalue, '>' . $message . '<'), 1, -1));
What happens here is that the entire contents of $highlight_match are pasted AS CODE into the variable $repvalue. On the second code line, this code is then EXECUTED when its regular expression is evaluated, because of the #se flags in the regular expression. This is really a very stupid thing to do! The follwing code also works, but doesn't have the security risk:
$repvalue = "preg_replace('#\b(' . \$highlight_match . ')\b#i', '<span style=\"color:#" . $theme['fontcolor3'] . "\"><b>\\\\1</b></span>', '\\0')";
(the second line remains unchanged).
Now what is different with this code? Here we do not paste the contents of the variable $highlight_match, but only its name. Now the variable is only replaced with its contents when the second line is evaluated - so even if it contains malicious injected code, it could never execute it.
The exploit was discovered around nov. 17., and an update released nov. 18. - I notified one of your moderators of this problem a little over a week ago, I think (well maybe 2 - 2½), including a link to the quite small and easy fix. I'm sorry it wasn't fast enough - I did point out how critical this was, maybe I should have notified you directly.
How bad can the password security compromise issue you mentioned be?
V G
