+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: Severe MyBB Bug (/showthread.php?tid=4607727)
Severe MyBB Bug - Omniscient - Dec 28, 2014
Just a quick heads up that in the next 2-3 days a lot of rumors might spread about a 0day or MyBB exploit floating around.
It's nothing more than a very low security risk bug that requires credentials to be exposed as well as a malicious site visit (CSRF).
So don't be alarmed by news of this and start freaking out. You don't need to change your passwords or do anything different. Just exhibit the same common sense browsing habits you normally would to maintain your safety.
1. Don't download anything from potentially malicious sites.
2. Don't click links you're not familiar with. Important to hover over a link sometimes to ensure it's not forged anchor text.
3. Don't use the same password on HF anywhere else. This is seriously important.
Just don't worry about it though otherwise.
* - ZuGgY - Dec 28, 2014
Thanks for the heads up, omniscient
* - Seaking - Dec 28, 2014
Thanks for the update. I try to keep my HF info completely different from everything else.
* - .Matt - Dec 28, 2014
Thanks for the heads up omni! Hopefully people don't cry too much now.
* - Paranoid - Dec 28, 2014
Thanks for the alert Omni, hopefully nothing happens.
* - iExploits - Dec 28, 2014
Thanks Omni. You are the best webmaster ever.
* - Aura - Dec 28, 2014
For those who want additional security, web extensions like ScriptSafe (on Google Chrome) and NoScript (Firefox) can help prevent these kind of "exploits". Maybe not at 100%, but when well used, they can stop a lot of script-based exploits.
Thank you for the heads up Omni.
* - ZuGgY - Dec 28, 2014
(Dec 28, 2014 08:08 PM)Aurа Wrote: For those who want additional security, web extensions like ScriptSafe (on Google Chrome) and NoScript (Firefox) can help prevent these kind of "exploits". Maybe not at 100%, but when well used, they can stop a lot of script-based exploits.
Thank you for the heads up Omni.
Gonna get them on my PC tomorrow.
Thanks Yoan.
* - Mr. Lahey - Dec 28, 2014
Thank you for the heads up Omni. I wonder how many threads will be created when it gets out. 😏
* - Sharjah - Dec 28, 2014
Thanks for letting us know OMni. Definitely made me feel more safe about my forum
* - RƎDSPY - Dec 28, 2014
Most of my passwords are random jitters that I can't even remember.
Thanks for the update.
bruh
* - SwimmingPool - Dec 28, 2014
Thanks for notifying me about this.
* - NoScript - Dec 28, 2014
Thanks for the warning, Omniscient!
* - Noire Dragon - Dec 28, 2014
Is this all versions of mybb or older (1.6.x) ? What is the CSRF like just sending a post or what lol?
* - BLURRYFΛCE - Dec 28, 2014
Thanks for letting us know, seems like a lot of people got IP banned during this downtime, me included. Sent you a PM about it, can confirm at least one of my friends got IP banned as well but he was at a friends house and is home now and he's not IP banned on that IP.