About the php2shell issue

[Yablee0]

Initially, I almost got worried but after reading some news about PHP cyber security update news worldwide to avoid the site been affected later, I was relieved and hope to see the forum start working again but I didn't expect it to be this fast. I'm happy that the forum is back and we can continue from where we stopped. Theymos, you're more than a genius to fix this ASAP.

I initially panic as well, let me be sincere here. But the later update that prompted gave me the hope that all will soon be well. That said. Theymos at his end was super proactive and was able to address the issue at once. All thanks to him and his team for making this forum a more better place.

[Silverstonez]

It’s always good to be back again. A lot has already been said on the thread, so there’s not much left to add. I’m just glad that the admin reacted to the situation as quickly as possible, because the HPH issue needed to be addressed promptly before things got out of hand. And as the admin has said, it will cause nothing to reset our passwords, therefore I will reset mine as soon as possible. Thanks again sir theymos for reacting to the situation as quickly as possible, you are indeed a great admin.

[un_rank]

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

If your password is breached, it doesn't matter how random your selection of characters are, scammeers will gain access. A good password protects you from bruteforce not from flaws in the security code of the website making you vulnerable.

Your trust in not changing passwords should be based on the forum security system and the depth of checks done to ensure there is no risk and not the strength of your website.

- Jay -

[dkbit98]

This was probably one of the longest forum downtime I remember in a while, and I saw other forums and websites were also affected.
I am happy to see things are resolved now, but similar things are likely to happen in future as hackers are using more AI tools to find bugs everywhere.

[SuperBitMan]

...

...

I’m not changing my password, I believe we have nothing to worry about however, it’s good to change your password once in a while for safety reasons.

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

People that are advised to change their password periodically are those who allow others to have access to their system or those who always use one password in every other thing, it’s advisable to change password periodically across, because if it leaks you are finished.
So it’s not really about how strong your password is, changing of password won’t cost anything so if changing it periodically can keep you safe is good to do it always.

If he wants to take extra precautions to protect himself then it’s fine, I see nothing wrong in that, but if he knows he those not remember his present password then he can’t change his password to a new one, but it’s very bad to forget your present password, he should try to remember his present password if he forgot it, it’s very important.

If he knows his present password, there’s nothing there to be scared about, he should just carry on and change his password.

What a jargon! And you can reset password via email.

It’s been a very long time I changed my email password so I actually have forgotten how it’s been done, but I remember if you request for password reset, they send a link to your email and then you change your password from there, I can’t really remember if they usually ask for your recent password and then your new password.

[Pikiboy]

You know, I was online when the forum shut down and I was like "how do I reach to theymos and few other admin. Like, lot of things was ringing in my head whether if Theymos is sleeping or not.
Maybe the site has been hijacked or what? Before I have to understand that was the PHP issues after a friend share with me about the situation on ground then I have to stop panicking.

Anyway thank you Theymos for the action taken.

[uchegod-21]

You have done well, Theymos. Thanks for the efforts you put into ensuring that everyone is safe. The recommended password change is a good one, but I do not think there is anything we should worry about now.

Truly, yesterday's shutdown was the longest I have experienced since joining the forum. I am glad the forum is open to users again; otherwise, I would have panicked if it had remained inaccessible until now. Welcome back, everyone!

[DPHOR]

This was the biggest down time ever on the history of the forum if I am not mistakenly. Anyone out there can correct me if I am wrong.
Although, from where I have to meet the forum.

You have done well boss theymos bringing back the site online.

[NotATether]

Theymos, do you use a sandbox for the Bitcointalk servers like SELinux or AppArmor?

It's going to be a long day.... 

[libert19]

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

If your password is breached, it doesn't matter how random your selection of characters are, scammeers will gain access.

Obviously .

A good password protects you from bruteforce not from flaws in the security code of the website making you vulnerable.

True. So, periodic change of password doesn't really help with anything, does it? (provided you have chosen a strong password to begin with which brute force attacks are unlikely to breach).

Your trust in not changing passwords should be based on the forum security system and the depth of checks done to ensure there is no risk and not the strength of your website.

I TRUST THEYMOS ^{[despite my older account getting hacked in 2015 hack]}...! Elsewhere, let's not talk about it and ^{[italic part flew above my head]}...!

- Jay -

- libert19 -

Edit 2: Space added.

changing of password won’t cost anything so if changing it periodically can keep you safe is good to do it always.

The task of changing passwords periodically causes monumental burden on my brain cells.

It’s been a very long time I changed my email password so I actually have forgotten how it’s been done, but I remember if you request for password reset, they send a link to your email and then you change your password from there, I can’t really remember if they usually ask for your recent password and then your new password.

This is what password reset page says: https://talkimg.com/image/a2unwc

Thus, it leads me to conclude that you are not required to present your present password at all. Just follow the link and set a new one! It would be stupid to require old password anyhow ^{[I forgot that's why I am resetting dumbass]}...!

Or you could be confounding being able to reset password by answering secret question?

You know, I was online when the forum shut down and I was like "how do I reach to theymos and few other admin.

I think discord is the only place where you can connect with other Bitcointalk admin, Cyrus, I reckon he is admin of pizza related group there.

^ Please correct (cause, I am not active on discord these days), this is my half-assed memory.

Edit: ^^ Check Cyrus's signature to find answer to your question, s/he also has Twitter handle linked.

[KingsDen]

This was probably one of the longest forum downtime I remember in a while, and I saw other forums and websites were also affected.
I am happy to see things are resolved now, but similar things are likely to happen in future as hackers are using more AI tools to find bugs everywhere.

If this continue to happen, that means that the era of bug bounty will be back, and this will enable people use same AI to detect vulnerabilities before the bad players discover it themselves.

We are yet to witness the advert effect of this AI generation, more shockers will happen.

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

I also do not see a lot of sense it on anyways. Whether you change password or not, you will still be affected by any breach. I even think that frequent update of the password will make one begin produce weak or repetitive password pattern that can be guessed.

[Agbe]

Several attacks? Thank God you put things in place to secure the forum. It was good for the response and the security architecture set on the forum. Different thoughts came to different individuals but all still arrived at one idea of under maintenance and possible ddos attack because this was the longest shut down of the forum as I came. And your advise is good for the changing of password and other credentials.

[Renampun]

Thank you theymos for your action that was so responsive in handling those PHP vulnerabilities in our forum..

It's so great to be back on this forum 

[Supreme Donvic]

I did not log in yesterday evening so I never knew the forum was down up until seeing this post, I'm sure a lot of people were very worried, thank God the forum is back.

I want to ask a question, if you wake up one morning and the forum is gone forever, how will you feel after a week without bitcointtalk forum?

[GiftedMAN]

Thank you Theymos for being proactive. It is good to know that nothing happened but this is yet another opportunity to remind us the importance of security and to always have different measures to safeguard the things we love end cherish.

Kudos to all those who have been working so hard to ensure the safety of the forum.

[Doan9269]

This was a quick response that you ensured was put in place to avoid any unforeseen situation on the forum, which shows your swift response and ability to stay on top of things. Honestly, I already know that the delay was to ensure that everything remains in perfect shape, and I must applaud you for doing a good job.

Thank you theymos.

[suzanne5223]

Yes, this is really nullius, posting in

Does that apply to accounts that just woke up after over four years?

Welcome back. Yes.

I pray AI don't be the end of us all. 

Thank you Theymos.

To be sincere.
Praying is not enough when every platform needs to frequently upgrade their platform from time to time because AI is making things that were not possible years ago possible
The hardware wallet and PHP vulnerabilities are just the beginning because AI's influence in all settings is just getting started.

[knowngunman]

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

And forget? I guess you really don't mean that part 

People that are advised to change their password periodically are those who allow others to have access to their system or those who always use one password in every other thing, it’s advisable to change password periodically across, because if it leaks you are finished.
So it’s not really about how strong your password is, changing of password won’t cost anything so if changing it periodically can keep you safe is good to do it always.

Does it make any difference changing your password often? I think it doesn't because as long as you still allow people to have access to your device, they'll still discover the new password with time.

Moreover, how can people know your password just by having access to your device? I guess you still save your password in your phone note. That's a bad practice imo. If your password is not saved carelessly in your phone, someone can not just have access to your device and automatically have access to your password. How you manage your password is what matters the most, not how people have access to your device.

It’s been a very long time I changed my email password so I actually have forgotten how it’s been done, but I remember if you request for password reset, they send a link to your email and then you change your password from there, I can’t really remember if they usually ask for your recent password and then your new password.

Changing password should require present password and then new password by default. In the case of forgotten password, you should get the link to reset via email.

[Z-tight]

The forum is really a great place to 'hang out', and that downtime proved it again. I spent more time on IG in my free time yesterday, than i had done in ages. I know it was only a couple of hours, but i am sure it felt longer than that for a lot of users, because it did for me.

However, good job Theymos, it is great to be back. See you around guys!

[Welsh]

Cheers theymos! The fact that there were attempts on the server is quite something. Makes you think that with such a exploit that Bitcointalk was still on someones list to try it on, rather than others which were also affected and probably a lot more incentive. Just glad none of them were successful!

This could've easily turned into a 2015 situation or even worse.

so the forum wasn't shut down until around 14:30 UTC, 30 minutes after the public announcement of the vulnerability details, and about 7 hours after some details had begun to leak.

I consider this pretty quick, considering you also have a life outside of this forum!

The funny thing is, when I first visited the forum, all I saw was the default 503 Service Temporarily Unavailable error.

I was literally about to message @Cyrus on Discord and suggest putting up a custom maintenance page with some explanation.

I think this might be the first maintenance / error message I've seen with the forum going down. I think previously it was on Twitter years ago, but yeah this was nice to see considering the circumstances.

Does that apply to accounts that just woke up after over four years?

AFAIK, if you logged in after the hotfix, then probably OK. My understanding, which might be wrong is; malicious actors could've perform 'remote code execution', which they could've gained access to the database. During this time they could've:

- Stolen password hashes / salts
- gathered information when entered into login fields. (so this technically would only expose those that logged in during the time of a compromise).
- Could've put a backdoor into the server which would send out sensitive info (which would expose those that log in even after the hotfix)
- Someone could theoretically have used this months / years ago, but obviously that's incredibly unlikely. Usually, zero day exploits are just that first day exploits that hackers use to quickly compromise their target within a short period of time.

However, it seems theymos has already cleared this and fairly confident none of this happened. Although, it goes without saying 'probably ok' probably isn't good enough. I'd just recommend everyone changes it so er on the side of caution.

I saw other forums and websites were also affected

Yeah, world wide. Basically every website running PHP which is the majority. Banks, news are just some that are affected. Some are still down, as their websites are more complex / larger.

This was the biggest down time ever on the history of the forum if I am not mistakenly. Anyone out there can correct me if I am wrong.

That would probably be 2015. Though, that was also hacked and had all sorts going on without it being down too. Plus, I wasn't around for some of the other compromises the forums suffering like 2011.

True. So, periodic change of password doesn't really help with anything, does it? (provided you have chosen a strong password to begin with which brute force attacks are unlikely to breach).

A lot of organizations suggest changing your password periodically, some as often as two weeks. However, I believe the attitude is changing towards this and we are not in favour of a strong password, and not changing so often. After all, changing regularly includes user based errors which can lead to locking out of their account etc. At the end of the day, the idea is by changing regularly, if the malicious user has access to the hashed version they might be working on solving it, but by changing it regularly you make that moot.

Thus, it leads me to conclude that you are not required to present your present password at all. Just follow the link and set a new one! It would be stupid to require old password anyhow

That's if you reset your password via the "I forgot my password" if you do it within settings, you'll need to enter your current password, this is because you're logged in and any actor who gets access to your computer could potentially try changing the password, so while logged in a password is required if doing it from settings.
However, if your password is of sufficient complexity solving the hash isn't realistic anyway.