Lemon Amiga forum hacked!

[jaycee1980]

Originally Posted by jbenam

Great stuff, I retired a PHP4 application after 20 years just some months ago and it was never attacked. The code? It was utter trash. Did a vulnerability scan on it some years ago before rewriting it and it literally had dozens of 9+ vulnerabilities. On every part. Oh, and it had a phpmyadmin version from 1999 installed next to it.

PHP4 was indeed an era of much crap full of vulnerabilities. 5 helped and things have gotten pretty much tighter with 7.

A lot of it is deployment as well as the code though. PHP setups that echo errors out to the end user are just asking to be exploited. I always configure PHP so that it logs errors to a logfile, and if neccesary the HTTP side responds with 500.

Stuff like phpmyadmin, webmin, cpanel etc left exposed is also bad news. Either limit it by IP, put it behind a VPN, or dont run it at all. I quickly got rid of phpmyadmin from anything i worked on.

[Karlos]

If you’re a so-called dev and don’t even check if what you’re installing is *actually* what you meant to install (be it by sigs, checksum, or by just reading the freaking URL you’re cloning) the problem doesn’t lie in the framework and/or the package manager, it lies between the screen and the chair.

I agree wholeheartedly in principle, but in practise large applications often have hundreds of dependencies and as always in online businesses, driven by MVP and time to market concerns. Stuff gets overlooked all the time. As long as nothing appears to be obviously wrong, stuff gets applied without the level of review you expect. I just don't think it's fair to hold a team of Devs working to a tight deadline responsible for not noticing something insidious when security auditing is probably a job that someone working for a CISO should habe.

Plus, a lot of companies simply don't (want to) pay for SAST tools that go a long way to automating these processes too.

[lifeschool]

I believe Lemon/64 was running at least php 7.

Upgrading to the latest builds of phpbb is a supreme ball ache, and there should be some kind of easy way to batch run installs.

[lifeschool]

Good news. Lemons are back in a couple of days. !

Look out for progress maybe soonish.

[Seiya]

very good news

[Karlos]

Originally Posted by lifeschool

I believe Lemon/64 was running at least php 7.

Upgrading to the latest builds of phpbb is a supreme ball ache, and there should be some kind of easy way to batch run installs.

Do they know what the attack vector was?