+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: Account Security Notification #3 (/showthread.php?tid=5262356)
Account Security Notification #3 - Omniscient - May 7, 2016
As part of our roadmap to enhance account security we will be doing a full site password reset for all accounts. So everyone at some point in the near future will be getting an email to reset their password. If you do not get the email then you will lose access to your account.
Please confirm your email is valid and accepting HF emails unfiltered. If you need to change your account email please do so now. You will need to have a valid working email account that does not spam filter HF emails.
Use this link to check or change your email:
https://hackforums.net/usercp.php?action=email (Only change your email if it's invalid such as lost access or doesn't get HF emails because of spam filters)
Also you will need to ensure that any notifications we send about changes will be allowed to be sent to you:
https://hackforums.net/usercp.php?action=options
Check the "Receive emails from the Administrators" please if you wish to get email notifications when we do send them. Please note we've only sent it out twice in nine years. We have no intention to make it a habit of sending email blasts and we are against using email promotional spam.
I will ask that all members with 2FA/Gauth access enable it asap. It's vital you secure your HF account using this method.
https://hackforums.net/gauth.php
If you have not done so also change your password even though we do plan on a reset it's good to have a fresh password on the site. One that you don't use anywhere else and is unique. Trust Scan page now shows when you last changed your PW.
https://hackforums.net/usercp.php?action=password
I'm sure many will ask when we plan to do the password resets. I can't say 100% for sure but my best guess is within two weeks. Could be a lot sooner depends on how fast I work and what I find when it comes to the accounts security. I may opt to upgrade us to MyBB 1.8x before doing a PW reset just in case there is an exploit being using in 1.6x series. In that case it could be a few weeks as it's a lot of work. And it doesn't make sense to do a PW reset until I know we're secure.
There are lots of rumors of dumps and leaks. But let me make it clear that indeed these are rumors and there has yet to be any confirmation that indeed we have been dumped. I actually find it hard to believe since no one has shown actual proof they have the DB dumped. Realize there are a lot of childish braggarts in this world. Many will lie about having the DB when in-fact they don't have it. Some will take credit for any compromise when in-fact they didn't do it. Members are reporting being threatened or blackmailed, in which case, I suggest you ignore the bullies.
If it wasn't for my own threads stating that I believe we've been compromised no one would be behaving any differently. While I don't regret making the thread I do think it should be made clear that there is no actual proof so far. I am starting to seriously question if we have been compromised in a way that a dump was possible. Currently the situation is that we have Ub3r and l33t accounts being stolen. No data on HF has been changed. The site is operating normally. There has been no manipulation of the database as far as I can tell. I've not found any shells on our servers. I have not found any evidence at all that we're potentially compromised at any level beyond these stolen, or possibly sold, accounts.
Normally in the past when we are indeed compromised it's much more evident. The site is defaced. The database is leaked and I see actual proof. Server gets owned with things like a root password change. Admin accounts get altered. All types of mayhem normally occurs. And the hackers delight in it, take credit, and do a full-on victory dance. So far....nothing...and that's very odd.
These facts are very true:
1. I'll secure HF.
2. I will secure accounts.
3. HF will continue as usual.
4. Eventually, we'll get compromised again.
5. Rinse and repeat as they say.
Thank you.
EDIT:
Suggested services:
Tutanota.com (encrypted)
Gmail.com (2FA login provided)
Protonmail.com (encrypted)
Yahoo, Outlook, Live, Hotmail, and AOL all work with HF but may experience intermintent problems with delivery.
EDIT 2:
A simple way to check if you're getting HF emails is to enable email notifications for PMs.
https://hackforums.net/usercp.php?action=options
Check the: "Notify me by email when I receive a new Private Message."
Then send yourself a PM. Yes, MyBB allows you to PM yourself.
After you verified that you get emails you can uncheck the option for email upon PM.
* - Sevn Alias - May 7, 2016
So HF is now full secured? And you might ban accounts if the user logged in since few months ago. To avoid scams.
* - Magna imperium - May 7, 2016
Thanks omni for the update.
* - NormieFag - May 7, 2016
(May 7, 2016 02:11 PM)Sevn Alias Wrote: So HF is now full secured? And you might ban accounts if the user logged in since few months ago. To avoid scams.
That's not how that works. There's always a margin for error.
* - Granny Bacon - May 7, 2016
Thank you for your update!
* - My Computer - May 7, 2016
Thanks for the update Omni. :)
* - $uicide - May 7, 2016
sounds good, looking forward to this :D
* - Iwata - May 7, 2016
Has HF been hacked or something?
* - xFR3 - May 7, 2016
Have you checked site logs? I doubt it got dumped again because otherwise there'd probably be someone bragging.
* - Treeline - May 7, 2016
Thanks for letting us know Omni
* - MysticParadox - May 7, 2016
Glad to see the new security changes.
* - Cara Delevingne - May 7, 2016
Thanks alot for this update, appreciate it
* - F16™ - May 7, 2016
Thnx for update Omi 🤝
* - ❤️Kill❤️ - May 7, 2016
Thanks for keeping us up to date Omni!
* - Redwall - May 7, 2016
Thanks for the update omni
Safety is first