Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Replies

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 12, 2016 at 1:08 am #5059

    Hi Brajesh,

    I found the issue!!

    Turns out the problem was a BuddyPress option called, “Activity auto-refresh” in settings. When checked, it seems to force a page reloaded event every time something is submitted (posts, ‘load more’, etc.) Although, as you mentioned, I think it’s just blocking a lot of JS. As soon as I disabled the option everything started working perfectly.

    I’m still in disbelief that it was a simple check box, but really glad we found it!

    Thanks again!
    Carl

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 11, 2016 at 6:41 pm #5051
    This reply has been marked as private.
  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 11, 2016 at 6:10 pm #5049

    Hi Brajesh,

    Thanks for looking into it!

    I have a limited understanding of Java script, so I created a fresh install of WordPress (none multisite) and only installed MediaPress and BuddyPress to ensure there was no script blocking behaviors or other conflicts. I then tested again and got the same issue (Site-wide activity posts not posting with attached media).

    My host is WPEngine, so aside from getting support involved with some possible server side information, I’m not sure where to go?

    The test site I just created is 100% dedicated to fixing this issue, so if you need admin or FTP access I can set it up for you.

    Let me know what you think the best way to proceed is?

    Thanks Brajesh! We’ll find it!
    Carl

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 10, 2016 at 3:41 am #5018
    This reply has been marked as private.
  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 8, 2016 at 9:39 pm #4998

    Hi Brajesh

    I’m going to close this support topic because the MediaPress topics are a higher priority than this one.

    I’m going to stick with using ‘Private Message v1.0.5’ unless there are any security concerns that were addressed during the last three updates?

    Thanks for your help!
    Carl

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 6, 2016 at 1:15 am #4970

    Hi Brajesh,

    I tested it again with ALL plugins deactivated except; MediaPress, Akismet, and BuddyPress and tested with both the Default TwentyFourteen and Default TwentyFifteen Themes and still was not able to get it working properly.

    Could it be a Multisite vs Non-Multisite issue (My site is a Multisite Install). And I’m now running BuddyPress 2.6.2, but the same issue happened with 2.6.1. It was also happening before the last MediaPress update (before 1.0.6).

    I’ll send you the MediaPress Debug report also via the contact form.

    Let me know what else I can do to help. Thanks for looking into it!
    Carl

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 4, 2016 at 2:13 am #4932

    Hi Brajesh,

    Thanks for looking into it!

    The only additional relevant information I was able to get are these two warnings:

    Warning: array_filter() expects parameter 1 to be array, string given in /nas/content/staging/username/wp-content/plugins/buddypress-message-privacy/buddypress-message-privacy.phpon line 219

    Warning: Invalid argument supplied for foreach() in /nas/content/staging/username/wp-content/plugins/buddypress-message-privacy/buddypress-message-privacy.php on line 226

    I tested both versions (1.0.5 and 1.0.8) and the warnings only populated when using v1.0.8.

    I did test with “BP Private Message Rate Limiter” deactivated, as well as a few other message plugins, but they didn’t seem to fix the problem. The only plugin that is making testing complicated is https://wordpress.org/plugins/bp-profile-message-ux/ , because it changes the messaging work flow and has some custom integration. However, Private Message v1.0.5 worked with “Bp-profile-message-ux” perfectly.

    Let me know if this information is helpful or if anything else is needed.

    Thanks!
    Carl

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 4, 2016 at 1:06 am #4929

    You’re the best! That was it.

    Thanks again!

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 4, 2016 at 12:31 am #4926

    Sorry for all the topics today! Big project coming out in a few weeks 🙂

    BuddyPress – Version 2.6.1.1
    WordPress – 4.5.3
    All Plugins Updated
    Theme – TwentyFourteen

  • Participant
    Level: Initiated
    Posts: 15
    Carl Hassett on August 4, 2016 at 12:21 am #4918

    No problem and it worked perfect! Thank you!

    I did come across a few other issues, but I’ll open new topics to stay organized 🙂

    Thanks again!
    Carl