+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: [News] Discord Connecting and Account Security (/showthread.php?tid=5993892)
Pages: Pages
1
2
Discord Connecting and Account Security - Omniscient - Jul 28, 2019
I have removed the Discord social login. Anyone who had their HF accounts connected to Discord needed to create a full HF account else they've just lost access at least for now. The plugin we used has an exploit of some sort allowing access to the accounts without providing credentials. I am still trying to Reverse Engineer the exploit so we can patch it but felt it was best that until we do the Discord login is removed. Twitter, Facebook, and Google are still available options which at this time I do not believe share the exploit. It seems restricted to just Discord. I suspect it has to do with Discord bots or possibly Discord's API methods. But something is exposed and members were at risk.
Sorry to those that this inconveniences. If you joined HF under our Discord username and never created your own Password then you might be locked out completely. I'm unsure if once we resolve this the account will link again but assume it will not.
This exploit was already used by a scammer but luckily it doesn't appear it was successful and I've spent time on this all week trying to track down how exactly the scammer got ahold of the accounts. Now I know it was our social login plugin and Discord. I'll eventually get the exact method which we'll patch.
Sorry for the inconvenience and thank you.
RE: Discord Connecting and Account Security - cobaltstrike - Jul 28, 2019
what if it was just password re-use and the account associated had their emails on dehashed or another leaked db
RE: Discord Connecting and Account Security - Omniscient - Jul 28, 2019
(Jul 28, 2019 02:26 PM)cobaltstrike Wrote: what if it was just password re-use and the account associated had their emails on dehashed or another leaked db
And yet that's not it.
RE: Discord Connecting and Account Security - Careless - Jul 28, 2019
Happy you stopped it in its tracks brilliant work on this.
RE: Discord Connecting and Account Security - M L T - Jul 28, 2019
Were you using OAuth by any chance? For discord login integration?
RE: Discord Connecting and Account Security - Omniscient - Jul 28, 2019
(Jul 28, 2019 03:02 PM)M L T Wrote: Were you using OAuth by any chance? For discord login integration?You know something you want to tell me?
We used a plug-in with some custom alterations for our needs but we really didn't touch the libraries the author used. I am still looking into the code but since it's disabled now it's now #1 priority. Took me a lot of time just to track it down. I have a few other things going on right now which requires my attention.
Tomorrow I will have xerotic take a peek at it. I also offered the scammer see money for exact details as a bounty. We will find it with or without him though now that I know the entry point.
Discord sucks. This is just more proof of that. Only about 15% of the social connects were discord anyways.
RE: Discord Connecting and Account Security - Ram - Jul 28, 2019
Isnt discord prohibited from HF anyways?
RE: Discord Connecting and Account Security - duplex - Jul 28, 2019
(Jul 28, 2019 03:17 PM)Ram Wrote: Isnt discord prohibited from HF anyways?
Not really
RE: Discord Connecting and Account Security - GnosticPlayers - Jul 28, 2019
Thanks Omni. Good move removing the feature entirely :)
RE: Discord Connecting and Account Security - Crypto - Jul 28, 2019
(Jul 28, 2019 03:17 PM)Ram Wrote: Isnt discord prohibited from HF anyways?
I guess not anymore, I wasn't very active for some weeks but when I came "back" I saw people suddenly posting their discord information like it wasn't prohibited anymore...
Anyways thanks Omni for keeping our accounts safe & being on top of it once again when the site's security is at risk.
Your dedication is inspiring for sure.
RE: Discord Connecting and Account Security - Meow - Jul 28, 2019
(Jul 28, 2019 03:17 PM)Ram Wrote: Isnt discord prohibited from HF anyways?I believe you're not allowed to link to a Discord server but you're allowed to advertise your Discord username (same with Skype/Telegram).
RE: Discord Connecting and Account Security - Crypto - Jul 28, 2019
(Jul 28, 2019 03:24 PM)Meow Wrote: I believe you're not allowed to link to a Discord server but you're allowed to advertise your Discord username (same with Skype/Telegram).
![[Image: 6ccf63e2acbe5c396a4bc489eddaf8a1.png]](https://i.gyazo.com/6ccf63e2acbe5c396a4bc489eddaf8a1.png)
Your right.
RE: Discord Connecting and Account Security - M L T - Jul 28, 2019
(Jul 28, 2019 03:09 PM)Omniscient Wrote: You know something you want to tell me?
We used a plug-in with some custom alterations for our needs but we really didn't touch the libraries the author used. I am still looking into the code but since it's disabled now it's now #1 priority. Took me a lot of time just to track it down. I have a few other things going on right now which requires my attention.
Tomorrow I will have xerotic take a peek at it. I also offered the scammer see money for exact details as a bounty. We will find it with or without him though now that I know the entry point.
Discord sucks. This is just more proof of that. Only about 15% of the social connects were discord anyways.
No specific reason I'm asking, I was just curious because it's possible to hijack sessions via OAuth integration if it's misconfig'd + if someone managed to find an open redirect on *.hackforums.net somewhere (which I believe exist within the tracking subdomain) - I was just curious if someone maybe pulled an attack similar to what I'm describing here -- the same concept could apply for any OAuth linked application although I'm using facebook in my description. I was just figuring someone maybe abused OAuth integration paired with an open redirect in one of your domains to hijack user accounts, and maybe that could have been the issue.
Just a guess is all, I've no idea what went down nor have I heard anything.. If you were using OAuth though, depending upon how it's configured, someone could have used it to hijack accounts by pairing it with one of the open redirects in your 'tracking' subdomain. I'm unsure if you've found the root cause, and maybe I'm totally in the wrong ball park here, but if you were using OAuth maybe it's worth looking into that as the possible source of the problem.
EDIT: this report explains what I'm talking about fairly well... like I said though, no idea if the issue you're having is related to OAuth, just speculation.
RE: Discord Connecting and Account Security - Sigma - Jul 28, 2019
(Jul 28, 2019 03:51 PM)M L T Wrote: No specific reason I'm asking, I was just curious because it's possible to hijack sessions via OAuth integration if it's misconfig'd + if someone managed to find an open redirect on *.hackforums.net somewhere (which I believe exist within the tracking subdomain) - I was just curious if someone maybe pulled an attack similar to what I'm describing here -- the same concept could apply for any OAuth linked application although I'm using facebook in my description. I was just figuring someone maybe abused OAuth integration paired with an open redirect in one of your domains to hijack user accounts, and maybe that could have been the issue.
Just a guess is all, I've no idea what went down nor have I heard anything.. If you were using OAuth though, depending upon how it's configured, someone could have used it to hijack accounts by pairing it with one of the open redirects in your 'tracking' subdomain. I'm unsure if you've found the root cause, and maybe I'm totally in the wrong ball park here, but if you were using OAuth maybe it's worth looking into that as the possible source of the problem.
EDIT: this report explains what I'm talking about fairly well... like I said though, no idea if the issue you're having is related to OAuth, just speculation.
I have seen this report too. I am glad it is getting removed, too risky.
RE: Discord Connecting and Account Security - JustMadeAnotherAltAcc0unt - Jul 28, 2019
How am i a scammer? i just want my data removed like i already asked on discord :). kindly do it please