(Apr 23, 2019 05:33 PM)Omniscient Wrote:  There has been a report to me that a competing site has been compromised and that a number of HF cookies were stolen from the browser.  In order to ensure that HF accounts are not stolen or used for malicious purposes I have reset all account login keys which kills all active sessions and cookies.  You were forced to login again essentially.

You should be secure on HF though as long as you don't use your HF password anywhere else.  And you should also enable 2FA (upgrade feature).

https://hackforums.net/gauth.php

I can't be sure of the risk involved to members but I had credible enough information that doing a forced login for everyone is a reasonable measure until I know more.

Thank you.

(Apr 23, 2019 06:22 PM)Dervie Wrote:  Always startles me when my cookies have been seemingly cleared without my knowledge. I'm glad it was for a security purpose. I haven't read the thread nor any articles, but is it more than one site that has been compromised?

(Apr 23, 2019 06:19 PM)DerJager Wrote:  1. A few sites got compromised using a MYBB 0day. It works using a exploit discovered today merged with a exploit in the myBB posts and signature.
2. Around 4k HF accounts have been compromised but not leaked. (in this layout URL | LOGIN | PASSWORD | COOKIE | COOKIE NAME)
3. Killing cookies etc wont fix it the only way is to recode the posts system and signature as its an exploit from like 1.2 hasnt been fixed till today.
4. All credentials are safe and will not be publiced. It was more of a tester run rather than a milicious intent.

I am aware Mr Robot told you, I dont know how this information got to him, seems like a game of chinese whispers.
Dont believe everything people tell you especially people that know nothing about the situation.

(Apr 23, 2019 06:29 PM)Tom Wrote:  Thanks for information mate
I’m gonna change password

(Apr 23, 2019 06:32 PM)BTC Wrote:  Agreed . Definitely changing my password. Good thing I use this password on all other websites. jk

(Apr 23, 2019 06:25 PM)BTC Wrote:  Cookies are bad you should constantly delete them every time you close your browser :(

(Apr 23, 2019 06:19 PM)DerJager Wrote:  1. A few sites got compromised using a MYBB 0day. It works using a exploit discovered today merged with a exploit in the myBB posts and signature.
2. Around 4k HF accounts have been compromised but not leaked. (in this layout URL | LOGIN | PASSWORD | COOKIE | COOKIE NAME)
3. Killing cookies etc wont fix it the only way is to recode the posts system and signature as its an exploit from like 1.2 hasnt been fixed till today.
4. All credentials are safe and will not be publiced. It was more of a tester run rather than a milicious intent.

I am aware Mr Robot told you, I dont know how this information got to him, seems like a game of chinese whispers.
Dont believe everything people tell you especially people that know nothing about the situation.

(Apr 23, 2019 06:36 PM)StarZ Wrote:  Lol it's sad how many people use the same handle and password for everything. Thank God I'm such a skeptic. Use different personas for different activities.

(Apr 23, 2019 06:19 PM)DerJager Wrote:  1. A few sites got compromised using a MYBB 0day. It works using a exploit discovered today merged with a exploit in the myBB posts and signature.
2. Around 4k HF accounts have been compromised but not leaked. (in this layout URL | LOGIN | PASSWORD | COOKIE | COOKIE NAME)
3. Killing cookies etc wont fix it the only way is to recode the posts system and signature as its an exploit from like 1.2 hasnt been fixed till today.
4. All credentials are safe and will not be publiced. It was more of a tester run rather than a milicious intent.

I am aware Mr Robot told you, I dont know how this information got to him, seems like a game of chinese whispers.
Dont believe everything people tell you especially people that know nothing about the situation.