[Disease]

as long as you don't use your HF password anywhere else.

Based on a thread I made recently I have a feeling this affects more people on HF than it should. Surprisingly only because, for a hacking/security focused forum, you’d think users here would be more security minded, and not fall for the most common pitfalls.

[Omniscient]

Well, as I suspected, it seems that HF is NOT vulnerable. This bug with MyBB doesn't effect HF. This is what I've been told which imho is just as reliable as being told there was an exploit without any PoC.

I took what I felt was a simple precaution upon hearing a rumor from a credible source by resetting all cookies. Not that big a deal. But trying to get to the bottom of the exploit and confirming it has caused some minor drama.

I've been given enough information that I have pieced together what the exploit probably is. I've had this patched on HF for at least a year. HF has a lot of extra security measures that prevent things like SQLi and XSS. This includes but is not exclusively our Cloudflare WAF (web application firewall). The CF WAF is something members often complain about that interrupt or even prevents their posts but it's there to help secure and protect the site. It's a necessary evil to stop evil doers.

I am still skeptical about all this. I never saw a Proof of Concept on the exploit or anything that might indicate to me accounts or the site were at risk. Apparently this exploit is a big secret known to only a few who want to remain tight-lipped about it. So be it. I'll keep the same watchful eye over HF that I would on any other day. If shit hits the fan then I'll get my gloves and clean it out. :)

Overall members should show good security on their end with 2FA and backing it up. Secure your emails accounts with 2FA as well. Use minimal extensions on your browser. Just do your part to be smart and secure your stuff.

Thanks everyone.

[JoshAllen]

Not gonna lie it scared me a little.
Just got back from a little vacation and saw HF was signed out on 2 devices lmao.

EDIT: Even that I think we should change our passwords often, I think stuff like this should be an annual thing.
Maybe it could help with stolen accounts.

[Cooligan]

Well, as I suspected, it seems that HF is NOT vulnerable.  This bug with MyBB doesn't effect HF.  This is what I've been told which imho is just as reliable as being told there was an exploit without any PoC.  

I took what I felt was a simple precaution upon hearing a rumor from a credible source by resetting all cookies.  Not that big a deal.  But trying to get to the bottom of the exploit and confirming it has caused some minor drama.  

I've been given enough information that I have pieced together what the exploit probably is.  I've had this patched on HF for at least a year.  HF has a lot of extra security measures that prevent things like SQLi and XSS.   This includes but is not exclusively our Cloudflare WAF (web application firewall).  The CF WAF is something members often complain about that interrupt or even prevents their posts but it's there to help secure and protect the site. It's a necessary evil to stop evil doers.

I am still skeptical about all this.  I never saw a Proof of Concept on the exploit or anything that might indicate to me accounts or the site were at risk.  Apparently this exploit is a big secret known to only a few who want to remain tight-lipped about it.  So be it.  I'll keep the same watchful eye over HF that I would on any other day.  If shit hits the fan then I'll get my gloves and clean it out.  :)

Overall members should show good security on their end with 2FA and backing it up. Secure your emails accounts with 2FA as well.  Use minimal extensions on your browser.  Just do your part to be smart and secure your stuff.  

Thanks everyone.

Thanks for the update Omni.

I knew you'd be keeping a very watchful eye over all of this.

[DerJager]

Well, as I suspected, it seems that HF is NOT vulnerable.  This bug with MyBB doesn't effect HF.  This is what I've been told which imho is just as reliable as being told there was an exploit without any PoC.  

I took what I felt was a simple precaution upon hearing a rumor from a credible source by resetting all cookies.  Not that big a deal.  But trying to get to the bottom of the exploit and confirming it has caused some minor drama.  

I've been given enough information that I have pieced together what the exploit probably is.  I've had this patched on HF for at least a year.  HF has a lot of extra security measures that prevent things like SQLi and XSS.   This includes but is not exclusively our Cloudflare WAF (web application firewall).  The CF WAF is something members often complain about that interrupt or even prevents their posts but it's there to help secure and protect the site. It's a necessary evil to stop evil doers.

I am still skeptical about all this.  I never saw a Proof of Concept on the exploit or anything that might indicate to me accounts or the site were at risk.  Apparently this exploit is a big secret known to only a few who want to remain tight-lipped about it.  So be it.  I'll keep the same watchful eye over HF that I would on any other day.  If shit hits the fan then I'll get my gloves and clean it out.  :)

Overall members should show good security on their end with 2FA and backing it up. Secure your emails accounts with 2FA as well.  Use minimal extensions on your browser.  Just do your part to be smart and secure your stuff.  

Thanks everyone.

If im free ill release a short guide on what to do to be safe from this exploit 🤝 have a good day everyone, was fun testing it on HF took a while to do due to the gay firewalls but its all good 🤝 as i said on my first post there was no need for anyone to be worried

[bοxxy]

I thought my account got closed for some reason.
Thanks for posting this.

[Omniscient]

as i said on my first post there was no need for anyone to be worried

Not exactly the most trusted source though. I personally am not comfortable with believing you on face-value.

HF took a while to do due to the gay firewalls

Protection from exploits is anything but gay. They are there to make HF safer and exploiting the site much harder. It seems to do what it is designed to do.

[ShinyThings]

Thanks for the update Omni. Watching this thread has been entertaining to say the least.

[BTC]

Well, as I suspected, it seems that HF is NOT vulnerable. This bug with MyBB doesn't effect HF.

Glad to hear 🤝 Thanks for the update, this hoax seems to have stirred up some people for sure.

[DerJager]

Not exactly the most trusted source though.  I personally am not comfortable with believing you on face-value.  


Protection from exploits is anything but gay.  They are there to make HF safer and exploiting the site much harder. It seems to do what it is designed to do.

Fair enough, you dont know me on a level of credentials etc so fair enough.

Firewall does its job from a pentesting experience its gay as fuck, and annoying to work around but thats the industry i chose, and it was a fun challenge trying to parse it over, do i still have permission to continue to test and twist it till it works.

[Omniscient]

Firewall does its job from a pentesting experience its gay as fuck, and annoying to work around but thats the industry i chose, and it was a fun challenge trying to parse it over, do i still have permission to continue to test and twist it till it works.

Sure, go for it. LMK if you come across anything (hopefully you will tell me).

[Hexalogy]

Thank you omni makin us safer, Last thing is we need is pesky people stealing HF accounts.

[SIM-403479]

Good bye to all those who lost their 2fa.

[Bacardi Cola Lime]

Good bye to all those who lost their 2fa.

There are 3 threads here already. It's funny how some people take security measures and back ups as a joke.

[BTC]

There are 3 threads here already. It's funny how some people take security measures and back ups as a joke.

Right..kind of makes no sense considering this is a hack forums 😏

You would think most people understand a thing or two about security.