- Joined
- Apr 26, 2013
- Messages
- 8,505
- Likes received
- 69,739
This morning, an unknown attacker used a vulnerability in Xenforo to alter the visible settings on QQ pages and achieve limited code execution.
The changes were noticed by users immediately, as mentioned e.g. here. Staff quickly began investigating, and after it became clear that there had been a security breach, brought the site down as a precautionary measure.
After investigating server logs, we found that the attacker was using a fairly unsophisticated exploit that appeared clearly in logs. We believe that we understand everything the attacker did, and that no further changes were made to the site and no user data was disclosed. The vulnerabilities that the attacker used have now been patched.
Via an unrelated exploit, the same attacker was able to view a random selection of recently posted links. This is technically non-public data, but the attacker was not able to view any information about who posted the links or where. We currently believe this to be a low-severity disclosure; the links disclosed were, as far as we can tell, all public ones, and the only information available to the attacker was that they were posted somewhere on QQ.
Moving forward, we will be instituting more advanced security measures on the backend to harden the site against cyberattacks. We have patched the vulnerabilities that were used in this attack, and will take steps to prevent any further attacks and limit the damage or information disclosures associated. Luckily, in this attack, no QQ users were affected and no user information was disclosed.
The changes were noticed by users immediately, as mentioned e.g. here. Staff quickly began investigating, and after it became clear that there had been a security breach, brought the site down as a precautionary measure.
After investigating server logs, we found that the attacker was using a fairly unsophisticated exploit that appeared clearly in logs. We believe that we understand everything the attacker did, and that no further changes were made to the site and no user data was disclosed. The vulnerabilities that the attacker used have now been patched.
Via an unrelated exploit, the same attacker was able to view a random selection of recently posted links. This is technically non-public data, but the attacker was not able to view any information about who posted the links or where. We currently believe this to be a low-severity disclosure; the links disclosed were, as far as we can tell, all public ones, and the only information available to the attacker was that they were posted somewhere on QQ.
Moving forward, we will be instituting more advanced security measures on the backend to harden the site against cyberattacks. We have patched the vulnerabilities that were used in this attack, and will take steps to prevent any further attacks and limit the damage or information disclosures associated. Luckily, in this attack, no QQ users were affected and no user information was disclosed.
