We have determine that a developer's account which had access to some forum Admin functionality recently had his password compromised. In the interest of transparency, here is the pertinent info on what was attempted:
We have taken various security measures on the server just to be on the safe side, and further restricted access to Admin functionality to fewer people, who we will make sure are using a unique password from this point on.
As above, there is no evidence whatsoever that any other account information was compromised beyond the one developer's account, and plenty of evidence to indicate the attacker was otherwise unsuccessful.
So: your accounts and information should be safe. For our more cautious users, it of course never hurts to play it safe, so you might consider changing your password on the forum and anywhere else where you use the same password.
- The attacker tried and failed to download a backup of the forum database through the forum admin panel, which is not possible on our forum.
- The attacker managed to upload a theme which they tried to insert a malicious script into, in another effort to gain deeper access.
- Due to problems in their code, it was not able to be successfully run on the server, and failed to accomplish anything.
- At most, it appears the only thing compromised was the developer's account and one page of their PMs.
- 4 users tried using the non-working theme, and were temporarily unable to access the forum as a result. Their accounts were not compromised, however, as the malicious code was inoperative and further would have been blocked from running anyway by an additional security measure we have in place. The affected users regained access to the forum yesterday when I removed the problem theme.
We have taken various security measures on the server just to be on the safe side, and further restricted access to Admin functionality to fewer people, who we will make sure are using a unique password from this point on.
As above, there is no evidence whatsoever that any other account information was compromised beyond the one developer's account, and plenty of evidence to indicate the attacker was otherwise unsuccessful.
So: your accounts and information should be safe. For our more cautious users, it of course never hurts to play it safe, so you might consider changing your password on the forum and anywhere else where you use the same password.
