On April 1, 2017, 8kun was hacked.
We are investigating the problem and hope to have the servers back online soon.
Pay attention here for updates.
April 7, 2017 - 5:00pm [GMT]
Hacker confirmed for downloading the users database. Passwords were stored in a hashed format. Please change any passwords that might have been shared with your board owner account.
April 5, 2017 - 5:20pm [GMT]
/egy/ is online. Bans working. Report system on the way. If your board isnt restored yet, dont worry, it will be restored soon. Restoring original 8kun frontpage will be next, and this temporary page will be replaced.
Sorry for being offline so long.
April 5, 2017 - 4:43pm [GMT]
Bans being re-enabled now. After /egy/ is back on, we will be restoring the original 8kun frontpage. This page will live on as a static file for posterity located here. This hack cleanup was a long journey and there will be steps made to try and prevent such things from happening again. After all boards are recovered, I will be posting patches for Tinyboard, a writeup of the hack itself, info about new server-side security policies, and 8kun will return to being an open source project.
April 5, 2017 - 4:31pm [GMT]
All batches complete and working with the exception of /egy/. /egy/ will be available shortly.
April 4, 2017 - 5:35pm [GMT]
Third batch complete.
April 4, 2017 - 5:15pm [GMT]
Second batch complete. Each batch getting faster.
April 4, 2017 - 5:07pm [GMT]
First batch complete. Starting second batch. Will try to go faster this batch.
April 4, 2017 - 4:07pm [GMT]
Working through some issues with mod tools while bringing boards back up. First batch almost finished.
April 4, 2017 - 2:42pm [GMT]
Boards coming up now. First batch starting.
April 3, 2017 - 2:40am [GMT]
Posting works again on /sudo/. I need to check some things on mod.php before bringing up more boards.
I added some new security policies to 8kun so some functionality is disabled. I will be re-enabling each function one-by-one under the new security policy.
April 3, 2017 - 6:41pm [GMT]
We got everything working except for the captcha. The captcha keeps looping and wont register correctly. Already asked Fred about how to fix captcha but hes sleeping so need to wait until hes up. After captcha is fixed, then we are back.
April 3, 2017 - 4:30am [GMT]
Wew.
/sudo/ and /wooo/ are back. Currently in read-only mode. Will be bringing posting up shortly. Need to double and triple check new configuration.
April 3, 2017 - 4:30am [GMT]
Board recovery scripts are working well on our dev. Boards should start coming back up soon. /sudo/ and /wooo/ will come online first; /sudo/ to complain about what happened and /wooo/ to lament Undertaker vs. Roman Reigns.
Boards within each batch will come online in any order. I will update this page as each board comes online. The original 8kun frontpage will be restored after the final batch ends and before we start restoring the rest of the boards not listed in the following batches.
After finishing these batches, the rest of the boards will come online in order sorted by active users. Not yet sure how long each batch will take to process, but I'm estimating an average of 30 minutes to an hour per batch. Posting on each board won't be enabled until that board's restoration is finished.
April 3, 2017 - 2:00am [GMT]
Its a bit late but /a/ board owner made a Wrestlemania thread on the smuglo.li bunker.
April 3, 2017 - 12:00am [GMT]
Was running on fumes last night and passed out before getting everything back up. Sorry about missing wrestlemania timeslot. We will continue working hard on data restoration today, it is the last piece before we can bring everything back online and we are almost there.
April 2, 2017 - 12:00pm [GMT]
I understand that some boards are currently displayed as deleted. We have backups of the data and are in the process of undeleting those boards. Dont worry, your board will probably be ok.
I am adding two new layers of security to 8kun before we bring it back online. I will talk about the new security layers in the writeup after we are back online.
April 2, 2017 - 10:15am [GMT]
We will be making and releasing security patches for anybody else running infinity or tinyboard code.
April 2, 2017 - 09:00am [GMT]
Figured out exactly how the hacker got into the machine. Holes are being plugged up now. Fixed a lot of potential security problems and fixed the hole that the hacker used to get in. Will release exact details of the security hole and how the hacker got server access later in my full writeup. Hacker downloaded the 8kun source code, so probably 8kun will become "open source" again sometime in the next few days. There is still no indication that the hacker downloaded the 8kun DB - he might have, but I cant see anything like that on the logs.
The /sudo/ board will come online first, we will be using it to test our data restore scripts. Probably /sudo/ will stay in read-only mode as we run some tests, but should be postable eventually. After /sudo/ is online, then we will bring back the other boards one at a time.
April 1, 2017 - 11:30pm [GMT]
With no issues we should start bringing boards back online within the next 6 hours or so. We will bring the bigger boards online first, then work our way to the smaller ones. Boards will be coming up one at a time so we can monitor thread and post recovery. I will let you know here if there are any delays.
April 1, 2017 - 4:00pm [GMT]
We have located the breach and are auditing scripts for security holes.
Boards should start coming back online in the next few hours as we restore from backup. We will be restoring the most active boards first. Some media files were lost in the hack and those images/videos will need to be reuploaded. Due to infrequent backups, our user database will need to be rolled back about a month; any claims since the previous backup will need to be reclaimed. As of now, I think we did not lose any posts or threads.
The hacker deleted all the databases.
We have backups of most posts and threads.
As of now, I cannot find an indication that the hacker downloaded the databases, however it is highly recommended you change any password that might be shared with your 8kun mod.php account.