The website itself wasn't affected in any way, so the hashes were not altered. Anyone who verified the hash would have known, but realistically very few people do.John connor wrote: ↑Sat Jan 27, 2018 4:11 am Question: was the hash that is displayed for validation also altered? If not then people who download the packages and compare the hash would, or should I say know that the package was not legit.
For access to your forum + many more.
I'm sorry John, can you share/recommend some good "file verification software"?John connor wrote: ↑Sat Jan 27, 2018 8:31 am Yeah, I can only imagine how few people actually check hashes with downloads that offer them. I always check the hash, especially for my browser (Pale Moon) my FTP client (WinSCP) and anything else that's pretty critical, especially phpBB.
Only if you downloaded phpBB on that day between those hours..~Sentinel~ wrote: ↑Tue Jan 30, 2018 7:26 pm This may sound dumb but ... if I back up my config.php and delete all the other files and then upload new ones from a fresh download that I get today, would that take care of any potential problem and be invisible to the functioning of my board?
If you believe that you have a malicious package, please email it to [email protected] so that we can check it against the version we obtained. We will likewise let you know if it is affected.
If you have already used the package to install or update a phpBB forum, please file an incident report on our tracker and we will assist with removal of the malicious code. https://tracker.phpbb.com/projects/INCIDENT/
I am sure the following question raised for a lot of us..https://www.phpbb.com/community/viewtopic.php?f=14&t=2456896 wrote: Earlier today, we identified that the download URLs for two phpBB packages available on phpBB.com were redirecting to a server that did not belong to us. We immediately took down the links and launched an investigation.
The point of entry was a third-party site. Neither phpBB.com nor the phpBB software were exploited in this attack.
Yes but, assuming that a person did download during that time frame but has since deleted the original file so can't check the hash of the file. The reason that I ask is because this seems to me to be a rather complete way of making sure that you are OK so my first thought is that this can't be a good answer because so far nothing I see says that this is a way to make sure that you fix the problem. So is the reason that I am not seeing this being discussed as a possible solution that it is very difficult to do for some users of large boards or is it that it will not necessarily fix the problem completely? Because I have a small personal simplistic board and if this would indeed fix everything 100% guaranteed then I can do this. But if it will not fix anything then I won't waste my time.Froddelaar wrote: ↑Tue Jan 30, 2018 7:43 pm Only if you downloaded phpBB on that day between those hours..
12:02 PM UTC and 15:03 PM UTC on January 26th
You also need to keep: files, ext, store and images folders
We all are aware of that, already.thecoalman wrote: ↑Tue Jan 30, 2018 9:38 pm It's an ongoing investigation 3Di and no details will be released until it's completed.
Well, since the links are posted at .com, I do (the whole web does I guess) believe there is at least a discrepance on what has been stated.we identified that the download URLs for two phpBB packages available on phpBB.com were redirecting to a server that did not belong to us.... snip .. The point of entry was a third-party site. Neither phpBB.com nor .... snip
Marshalrusty wrote: ↑a third-party site
Which one and how? Downloads are primarily from this websites, or is there a reason why SourceForge is not named?