pondus Posted May 27, 2014 ID:834730 Share Posted May 27, 2014 AVAST forum offline due to attack http://blog.avast.com/2014/05/26/avast-forum-offline-due-to-attack/ Link to post Share on other sites More sharing options...
MrBiz Posted May 27, 2014 ID:834750 Share Posted May 27, 2014 Saw this on malwaretipsSad, i expected a ddos attack and not for it to be hacked, let hope all gets well soon since this is my main antivirus company Link to post Share on other sites More sharing options...
Braedog3 Posted May 27, 2014 ID:834790 Share Posted May 27, 2014 Mine to MrBiz and in MAD Link to post Share on other sites More sharing options...
Ghost_Killer Posted May 27, 2014 ID:834803 Share Posted May 27, 2014 That sucks but im sure Glad i use bitdefender free since ive had avast & it let viruses,etc into my pc & no issues since switching to bitdefender Link to post Share on other sites More sharing options...
daledoc1 Posted May 27, 2014 ID:834804 Share Posted May 27, 2014 Hi, @Ghost_Killer: That sucks but im sure Glad i use bitdefender free since ive had avast & it let viruses,etc into my pc & no issues since switching to bitdefender This topic was started by @pondus to notify Avast users of a user forum outage, not to discuss one's AV preferences.Please try to keep your posts on-topic. Thanks very much for your understanding, Link to post Share on other sites More sharing options...
Nesivos Posted May 27, 2014 ID:834899 Share Posted May 27, 2014 As recently as a year or so ago the avast! forum had a number of insecure connections. While the main page may have been 'https' a number of the other pages on the forum were using 'http'. So going from one location on the forum after having logged in to another location on the forum could have subjected the user to Man In The Middle attacks. . Link to post Share on other sites More sharing options...
Propheticus Posted May 27, 2014 ID:834924 Share Posted May 27, 2014 That's pretty bad for a company that has security as it's core business... Even though Avast was using 3rd party forum software, I reckon leaving leaks open/not updating to newest forum software damages their reputation. To put it in one word: "clumsy" Link to post Share on other sites More sharing options...
Ghost_Killer Posted May 27, 2014 ID:834949 Share Posted May 27, 2014 They probably didn't expect the forums to be hacked so it must have been a low priority for them to update it to stop the hacks from happening and after it was hacked theyre probably regreting that they didn't update the necessary software that needed to be updated if that was the case in this situation Link to post Share on other sites More sharing options...
David H. Lipman Posted May 27, 2014 ID:834965 Share Posted May 27, 2014 One should not presume or wildly speculate that a software vulnerability/exploitation event ended up in a compromised Forum situation. A malicious actor may have used Social Engineering or some form of spear phishing ploy to obtain credentials and thus the site was compromised. Without the facts one should not draw conclusions or wildly speculate what happened. What one may draw a conclusion on is hinted by Propheticus as one can ask themselves..."Can I trust Alwil when they have experienced multiple breaches ?". The devil is in the details. Those details are in what actually happened or transpired at the Avast Support Forums. Link to post Share on other sites More sharing options...
Propheticus Posted May 27, 2014 ID:834976 Share Posted May 27, 2014 SMF 2.0.7 has been available since januari. Avast forums was running 2.0.6... So I'm not speculating at all. They did in fact not run the newest version. Also: they speak of hashing, but I didn't read anything about salting. Link to post Share on other sites More sharing options...
David H. Lipman Posted May 27, 2014 ID:834983 Share Posted May 27, 2014 Yes, there is CVE-2013-4465. But is there a formal Alwil statement that this was the source of compromise ? Link to post Share on other sites More sharing options...
Propheticus Posted May 28, 2014 ID:835055 Share Posted May 28, 2014 The exact cause aside: my point was that it's rather ironic for an AV company to have it's website or forum hacked. Doesn't inspire confidence, however misplaced this notion may be (pc vs webserver, 3rd party vs in-house., etc) Link to post Share on other sites More sharing options...
David H. Lipman Posted May 28, 2014 ID:835138 Share Posted May 28, 2014 Do we even know if the Forum is managed by Alwil and not a contracted entity ? Link to post Share on other sites More sharing options...
John L. Galt Posted May 28, 2014 ID:835293 Share Posted May 28, 2014 Thanks goodness that there is at least one voice of sanity in here. Throwing around speculations of what was and was not running and making grandiose claims that the company had done something or was not expecting something and thus claiming inside knowledge of their intentions and such is pure speculation. Fact: forums were down. Until more proof of information comes along, everything else is just speculation. Link to post Share on other sites More sharing options...
Wide_Glide Posted May 28, 2014 ID:835312 Share Posted May 28, 2014 EMAIL AS FOLLOWS: May 26 (2 days ago)Dear Wide Glide,The AVAST forum is currently offline and will remain so for a brief period. It was hacked over this past weekend and user nicknames, user names, email addresses and hashed (one-way encrypted) passwords were compromised. Even though the passwords were hashed, it could be possible for a sophisticated thief to derive many of the passwords. If you use the same password and user names to log into any other sites, please change those passwords immediately. Once our forum is back online, all users will be required to set new passwords as the compromised passwords will no longer work.This issue only affects our community-support forum. No payment, license, or financial systems or other data were compromised.We are now rebuilding the forum and moving it to a different software platform. When it returns, it will be faster and more secure. This forum for many years has been hosted on a third-party software platform and how the attacker breached the forum is not yet known. However, we do believe that the attack just occurred and we detected it essentially immediately.We realize that it is serious to have these usernames stolen and regret the concern and inconvenience it causes you. However, this is an isolated third-party system and your sensitive data remains secure.All the best,Ondrej VlcekCOO AVAST Software Link to post Share on other sites More sharing options...
John L. Galt Posted May 28, 2014 ID:835314 Share Posted May 28, 2014 Thanks for the email. That answers at least a couple of questions. Link to post Share on other sites More sharing options...
David H. Lipman Posted May 28, 2014 ID:835346 Share Posted May 28, 2014 Thanx Wide Glide. Link to post Share on other sites More sharing options...
pondus Posted May 28, 2014 Author ID:835373 Share Posted May 28, 2014 There is now info on the forum url https://forum.avast.com also see blog post from @vlk http://blog.avast.com/2014/05/26/avast-forum-offline-due-to-attack/#comment-45054 Link to post Share on other sites More sharing options...
Valinorum Posted May 30, 2014 ID:835982 Share Posted May 30, 2014 Hi pondus, Any news on how long it will be offline? Just curious. I want the site to be secure as possible. Link to post Share on other sites More sharing options...
pondus Posted May 30, 2014 Author ID:835992 Share Posted May 30, 2014 Hi pondus,Any news on how long it will be offline? Just curious. I want the site to be secure as possible.Hi Valinorum I do not have any info about that yetavast team arent known for being quick/good at informing.....seems it may take some time before you can continue your good work there Link to post Share on other sites More sharing options...
Valinorum Posted May 30, 2014 ID:835994 Share Posted May 30, 2014 Ah, I see. So, our waiting continues. Thanks. Link to post Share on other sites More sharing options...
Propheticus Posted June 6, 2014 ID:838695 Share Posted June 6, 2014 http://www.simplemachines.org/community/index.php?topic=523494.msg3704499#msg3704499 Link to post Share on other sites More sharing options...
David H. Lipman Posted June 7, 2014 ID:838739 Share Posted June 7, 2014 http://www.simplemachines.org/community/index.php?topic=523494.msg3704499#msg3704499More specifically and in greater detail:1- From the server logs, there is no evidence of any security vulnerability in the SMF code2- From our analysis, it is our conclusion that the "hack" was the result of a compromised admin account (although, to be clear, without any specific evidence, this conclusion is still supposition, even if it is the best guess). Specifically, similar to the attack here at simplemachines.org late last year, an admin reused account information across multiple sites, one other of which was compromised. Once the hacker had the admin account information, he would be able to promote his other dummy account to Admin or even just act as the logged in account.3- From the dates on the file edits, it would appear that the system was actually compromised several months ago, but was not noticed until the hacker did something obvious, here in May.Of course, the server logs from that time are not available from Avast, so we can not confirm this by any method other than the date-stamp on the infected file.4- Avast told us that they did not "lock down" the permissions of their files. This is important, because even a compromised admin account would still need FTP passwords (if FTP is even available) to make file changes if the file permissions were locked.As I wrote...One should not presume or wildly speculate that a software vulnerability/exploitation event ended up in a compromised Forum situation.A malicious actor may have used Social Engineering or some form of spear phishing ploy to obtain credentials and thus the site was compromised.Thus this is a good lesson on why we should not speculate on things that we don't have first hand information on or knowledge of. Thank you very much for the update Propheticus. Link to post Share on other sites More sharing options...
pondus Posted June 13, 2014 Author ID:841301 Share Posted June 13, 2014 avast forum is back online..... Link to post Share on other sites More sharing options...
MrBiz Posted June 13, 2014 ID:841324 Share Posted June 13, 2014 avast forum is back online.....Thanks Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now