4chan is back online after major hacking incident

After almost two weeks, 4chan is back in business. Users can now revisit the forum and post their messages online.

On Monday, April 14, a hacker using an IP address originating from the United Kingdom was able to hack and gain access to one of 4chan’s servers, which ran on outdated software.

Because of this vulnerability, the attacker was able to upload a bogus PDF file, giving him access to 4chan’s database and administrative dashboard.

Once in, the hacker spent ‘several hours’ exfiltrating database tables and a large portion of 4chan’s source code. Supposed login credentials for 4chan moderators, private posts of moderators, and parts of the website’s source code were leaked online.

“When they had finished downloading what they wanted, they began to vandalize 4chan, at which point moderators became aware and 4chan’s servers were halted, preventing further access,” 4chan says in a blog post that was published this weekend.

In the following days, 4chan’s development team found out that the attacker caused catastrophic damage. “While not all of our servers were breached, the most important one was, and it was due to simply not updating old operating systems and code in a timely fashion,” the online forum explains.

So why was this server out-of-date and ill-maintained? According to 4chan, this was due to the lack of technically skilled workers to update the forum’s code and infrastructure, but also because advertisers aren’t willing to spend more money on the forum due to ‘external pressure campaigns.’

“Advertisers and payment providers willing to work with 4chan are rare, and are quickly pressured by activists into cancelling their services,” 4chan states.

Over the last two weeks, the compromised server has been replaced. The operating system and source code have also been updated to the latest versions. For the moment, PDF uploads have been temporarily disabled, but will be back in the future.

4chan promises to bring in more developers to bring down the workload.