Welcome Guest ( Log In | Register )


 
Reply to this topicStart new topic
> Forum Security, Hacker steals 45 million accounts from hundreds of forums
NickTheGreek
post 15 Jun 2016, 09:35 AM
Post #1


Administrator
Group Icon

Group: Admin
Posts: 85560
Joined: 3-June 05
From: Athens, Greece
Member No.: 1
Zodiac Sign: I'm a leo!
Gender: I'm a m!



Following this article i am really alarmed considering how old is the forum software that we are running ....

Hacker steals 45 million accounts from hundreds of car, tech, sports forums




A hacker has stolen tens of millions of accounts from over a thousand popular forums, which host popular car, tech, and sports communities.

The stolen database contains close to 45 million records from 1,100 websites and forums hosted by VerticalScope, a Toronto-based media company with dozens of major properties, including forums and sites run by AutoGuide.com, PetGuide.com, and TopHosts.com.

The company didn't outright confirm the breach, but said it was investigating.

"We are aware of the possible issue and our internal security team has been investigating and will be collecting information to provide to the appropriate law enforcement agencies," said Jerry Orban, vice-president of corporate development, in an email.

He added:

QUOTE
"We believe that any potential breach is limited to usernames, user IDs, email addresses, and encrypted passwords of our users. In addition, we are reviewing our security policies and practices and in response to increased Internet awareness of security-related incidents, including potential incidents on our communities, we are implementing security changes related to our forum password strength and password expiration policies across certain forum communities."


But a further analysis of the leaked database, obtained by breach notification site LeakedSource.com, suggests that the scope of data may be greater than first thought.

In a sample given to ZDNet, the database shows email addresses, passwords that were hashed and salted passwords with MD5 (an algorithm that nowadays is easy to crack), as well as a user's IP address (which in some cases can determine location), and the site that the record was taken from.

LeakedSource confirmed the findings in a blog post, published Tuesday.

The group said in its blog post that it was "likely that VerticalScope stored all of their data on interconnected or even the same servers as there is no other way to explain a theft on such a large scale."



Despite a push in recent years for stronger encryption and fixing security flaws, the forums thought to be affected by the breach fell far behind industry security norms.

A cursory search of the list of domains caught up in the hack revealed that none of the sites we checked offered basic HTTPS website encryption, which would prevent usernames and passwords from being intercepted.

Many of the forums ran versions of vBulletin software dating back to 2007. Most were running software versions that were easily exploitable by hackers with known vulnerabilities. A blog post from security reporter Brian Krebs from 2013 showed that older versions of the vBulletin forums that were vulnerable could be easily searched with readily-available attack tools.

It's not clear who carried out the hack. A LeakedSource group member said it was "not related" to the recent hacks against MySpace, LinkedIn, and Tumblr.

As of Tuesday, the company has not made any public statement in relation to the hack.

Unlike in other recent other breaches, this data does not appear to be for sale on the dark web -- for now.

Source : ZDNET



--------------------

c:\ When the going gets tough, the tough get going ...
Go to the top of the page
 
Bookmark this: Post to Del.icio.usPost to DiggPost to FacebookPost to GooglePost to SlashdotPost to StumbleUponPost to TechnoratiPost to YahooMyWeb
+Quote Post
NickTheGreek
post 15 Jun 2016, 09:47 AM
Post #2


Administrator
Group Icon

Group: Admin
Posts: 85560
Joined: 3-June 05
From: Athens, Greece
Member No.: 1
Zodiac Sign: I'm a leo!
Gender: I'm a m!



also, please bear in mind that a second password helps but it is not as strong as .htaccess protection

i see on other forums for example:



but ideally you should have:



the difference is crucial, in the first occasion the attacker may try indefinite amount of passwords, or can circumvent the entire admin/index.php using a potential exploit

On the second approach though, things are quite harder: here we have true 2-factor authentication, one utilizes the script authentication mechanism while the other uses Apache authentication. Not only do you have limited attempts on 1st level but if you use a smart software firewall with authentication daemons in place ( for example Login Faulre Daemon - LFD on CSF ) then after 5 wrong attempts the attacker IP is blocked entirely off the server

Just my 2 thoughts on security, these are critical countermeasures i plan to offer for free on all www.forumsandmore.com hosted customers.


--------------------

c:\ When the going gets tough, the tough get going ...
Go to the top of the page
 
+Quote Post

Reply to this topicStart new topic
2 User(s) are reading this topic (2 Guests and 0 Anonymous Users)
0 Members:

 



RSS Lo-Fi Version Time is now: 23rd August 2019 - 12:43 PM
Skin and Graphics by Dan Ellis and Anubis. Hosting by Forums & More 2005-2011.
InvisionGames - Your #1 Arcade Games Repository | AllSigs - Signatures for all | Rock Band + Guitar Hero = RockHero ! | The Remoters - Remote Assistance | FileMiners - You ask, We find