MyBB Says Hacker Didn’t Access User Data, Source Code

MyBB’s official Twitter profile and a staff member’s accounts were hijacked in late January. The developers of the popular open source forum software have now provided details on the incident.

According to the MyBB team, someone gained unauthorized access to the community forum account and the personal website of a staff member. The password for the @MyBB Twitter account was stored in plaintext in one of the threads, allowing the attacker to take over the organization’s social media account.

The hacker used the hijacked Twitter account to post offensive messages, MyBB staff IP addresses, and installation statistics. The attacker also claimed to have gained access to information on unpatched SQL injection and cross-site scripting (XSS) vulnerabilities affecting the forum software.

“Within two hours, we had isolated the breach and banned the staff member’s account to prevent any further purusing of private data,” MyBB wrote in a blog post on Monday.

MyBB pointed out that the staff member whose account had been compromised did not have access to the Admin Control Panel, so the hacker couldn’t have gained access to private user data. The developers say there is no evidence to suggest that other information has been compromised.

The attacker changed the Twitter account’s password and email address to prevent MyBB staff from recovering it. The developers regained access to the profile after contacting Twitter, which locked out the hacker during its investigation.

A few days ago, someone posted screenshots of what seemed to be the MyBB 2.0 GitHub repository on a forum. The poster offered to sell the MyBB 2.0 source code for an unspecified amount of Bitcoins.

It appears that the staff member whose account was compromised used the same password for GitHub and he didn’t have two-factor authentication enabled. However, MyBB said the hacked GitHub account didn’t store anything of value.

“The code the user had was simply the initial commit of Laravel into the repository, none of the actual 2.0 code was present,” MyBB noted.

MyBB 2.0, a complete rewrite of the software, is currently under development and in pre-alpha.

“At MyBB we have a strong commitment to security. All staff with ACP access use a secret PIN, a form of 2FA. We release patches to any serious issues usually within hours of them being reported. We have Two Factor Authentication enabled on our staff email accounts and Github, and are actively working on getting 2FA for our other development tools,” MyBB said.