IMPORTANT: Kodi Forum - Data Breach

An anonymous, hooded figure stares out from the screen, his face hidden in darkness. Zeroes and ones - binary - flood everywhere.

IMPORTANT: Kodi Forum - Data Breach

Community 

Team Kodi

April 08, 20234 min read

Updated 25th April - forum, wiki and paste systems are now back on line - please see below.

----

Original post, 08th April 2023

In the last 24 hours we became aware of a dump of the Kodi user forum (MyBB) software being advertised for sale on internet forums. This post confirms that a breach has taken place.

MyBB admin logs show the account of a trusted but currently inactive member of the forum admin team was used to access the web-based MyBB admin console twice: on 16 February and again on 21 February. The account was used to create database backups which were then downloaded and deleted. It also downloaded existing nightly full-backups of the database. The account owner has confirmed they did not access the admin console to perform these actions.

The admin team have disabled the account used in the breach and have conducted an initial review of team infrastructure the team member had access to.

The nightly full backups that were downloaded expose all public forum posts, all team forum posts, all messages sent through the user-to-user messaging system, and user data including forum username, email address used for notifications, and an encrypted (hashed and salted) password generated by the MyBB (v1.8.27) software. At the current time, we have found no evidence of unauthorised access to the underlying server that hosts the MyBB software.

Although MyBB stores passwords in an encrypted format we must assume all passwords are compromised. This requires actions from the team, and forum users:

  • The admin team are investigating how best to perform a global password reset and how best to assure the integrity of the server host and associated software. The forum server has been taken offline while this activity completes. This will also impact the Kodi pastebin and wiki sites. There is currently no time estimate for the forum server being online again; our focus is being thorough, not being quick.
  • Users must assume their Kodi forum credentials and any private data shared with other users through the user-to-user messaging system is compromised. If you have used the same username and password on any other site, you should follow the password reset/change procedure for that site. Once the Kodi forum comes back online we will provide instructions on how to complete a reset of your Kodi forum password.

We will post more information as it becomes available.

----

Update, 11th April 2023

The admin team are in the process of commissioning a new forum server. We have not seen any evidence of compromise or other reason to question the integrity of the existing system, but a migration was already being planned and we will bring this forwards.

We have chosen to redeploy the forum on the latest version of MyBB software. This requires us to extract and review all differences between the latest MyBB release and the fork we maintain, which includes numerous functional changes and backported security fixes. This is not a simple task and the forum will remain offline until it completes: we estimate several days more work. As part of the redeployment we will restrict and harden access to the MyBB admin console, revise admin roles to reduce privileges wherever possible, and improve audit logging and backup processes.

The current forum server was hosted in the UK, so we have notified the UK Information Commissioner's Office of the breach and a report has been filed with the UK police. There are no plans to make other country-level breach notifications.

We are in the process of sharing exposed email address data with the breach disclosure website haveibeenpwned to increase awareness. We are also investigating how to best send a notification and password reset advice email to users once the forum is online again.

The wiki is being moved to another server host. A review of the code files has been completed and it will be redeployed using the latest MediaWiki version. We recognise the wiki is the go-to Kodi info resource for many users and we aim to bring it online again as a priority. The paste server will also be moved and restored but this is less urgent.

The anarchic nature of a global internet-based software project guarantees there will always be areas to improve upon, so the admin team would like to conduct formal penetration testing once the forum and other services are back online. Team Kodi members are all volunteers who contribute to the project for free. If you or your company offer professional pentest services, and can donate some time and expertise to help us audit our infrastructure, we would like to hear from you.

Thank you for your continued patience, understanding, and support.

----

Update, 15th April 2023

As promised, we are now very close to bringing the wiki back online as a first step towards normality. As part of the system rebuild, we have upgraded both the core MediaWiki software and its associated plugins, which will improve both feature set and security.

Please note that we have reset both secrets and user passwords, so current sessions are invalid and old passwords will no longer work: once the system is available, you will need to use the "forgotten password" link to gain access.

Further systems will be brought back on line in due course. Thank you for bearing with us in the meantime.

----

Update, 17th April 2023

System recovery and rebuild continues apace: the Kodi wiki and paste sites are now back online, with work continuing on bringing the forum back up as soon as we can.

----

Update, 25th April 2023

The forum is now back on line and available to everybody. There will inevitably be a few tweaks yet to come as we fine-tune plugins, formats and similar, but the content is all there. Thank you for your patience.

Remember that you will need to use the password recovery function (to your registered email address) before you can log in, as all passwords and sessions have been reset.