[DerJager]

There has been a report to me that a competing site has been compromised and that a number of HF cookies were stolen from the browser.  In order to ensure that HF accounts are not stolen or used for malicious purposes I have reset all account login keys which kills all active sessions and cookies.  You were forced to login again essentially.

You should be secure on HF though as long as you don't use your HF password anywhere else.  And you should also enable 2FA (upgrade feature).

https://hackforums.net/gauth.php

I can't be sure of the risk involved to members but I had credible enough information that doing a forced login for everyone is a reasonable measure until I know more.

Thank you.

1. A few sites got compromised using a MYBB 0day. It works using a exploit discovered today merged with a exploit in the myBB posts and signature.
2. Around 4k HF accounts have been compromised but not leaked. (in this layout URL | LOGIN | PASSWORD | COOKIE | COOKIE NAME)
3. Killing cookies etc wont fix it the only way is to recode the posts system and signature as its an exploit from like 1.2 hasnt been fixed till today.
4. All credentials are safe and will not be publiced. It was more of a tester run rather than a milicious intent.

I am aware Mr Robot told you, I dont know how this information got to him, seems like a game of chinese whispers.
Dont believe everything people tell you especially people that know nothing about the situation.

[iNviZ]

Thanks for the heads up man, great precaution.

[SIM-82498]

Always startles me when my cookies have been seemingly cleared without my knowledge. I'm glad it was for a security purpose. I haven't read the thread nor any articles, but is it more than one site that has been compromised?

[Tyler‌]

I'm glad this post was here. I was pretty confused and wondered why I was required to log in again.

[Mr. Robot]

I only use HF - so the only way i'm getting hacked is if HF gets hacked.

[BTC]

Always startles me when my cookies have been seemingly cleared without my knowledge. I'm glad it was for a security purpose. I haven't read the thread nor any articles, but is it more than one site that has been compromised?

Cookies are bad you should constantly delete them every time you close your browser :(

[ETH]

1. A few sites got compromised using a MYBB 0day. It works using a exploit discovered today merged with a exploit in the myBB posts and signature.
2. Around 4k HF accounts have been compromised but not leaked. (in this layout URL | LOGIN | PASSWORD | COOKIE | COOKIE NAME)
3. Killing cookies etc wont fix it the only way is to recode the posts system and signature as its an exploit from like 1.2 hasnt been fixed till today.
4. All credentials are safe and will not be publiced. It was more of a tester run rather than a milicious intent.

I am aware Mr Robot told you, I dont know how this information got to him, seems like a game of chinese whispers.
Dont believe everything people tell you especially people that know nothing about the situation.

Thanks for information mate
I’m gonna change password

[StarZ]

Thanks for making our security your top priority.

Tbh, I think it would be safer for most members if the site just forced random passwords. A site I used to frequent back in the day did this.

[BTC]

Thanks for information mate
I’m gonna change password

Agreed . Definitely changing my password. Good thing I use this password on all other websites. jk

[StarZ]

Agreed . Definitely changing my password. Good thing I use this password on all other websites. jk

Lol it's sad how many people use the same handle and password for everything. Thank God I'm such a skeptic. Use different personas for different activities.

[Hell]

Was literally shocked when I had to login to HF today. Finally some peace of mind after reading this. It's good that I use different passwords for different sites and HF is the only forum I use. Thanks Omni and good day to everyone.

[SIM-82498]

Cookies are bad you should constantly delete them every time you close your browser :(

Ha! I used to have my browser clear my cookies before but it got tiresome logging into the same websites every time. Not to mention when my browser crashes/gets closed accidentally. At that point, I just go to sleep.

[Mr. Robot]

1. A few sites got compromised using a MYBB 0day. It works using a exploit discovered today merged with a exploit in the myBB posts and signature.
2. Around 4k HF accounts have been compromised but not leaked. (in this layout URL | LOGIN | PASSWORD | COOKIE | COOKIE NAME)
3. Killing cookies etc wont fix it the only way is to recode the posts system and signature as its an exploit from like 1.2 hasnt been fixed till today.
4. All credentials are safe and will not be publiced. It was more of a tester run rather than a milicious intent.

I am aware Mr Robot told you, I dont know how this information got to him, seems like a game of chinese whispers.
Dont believe everything people tell you especially people that know nothing about the situation.

This is a serious accusation and I expect you to back these claims.

[BTC]

Lol it's sad how many people use the same handle and password for everything. Thank God I'm such a skeptic. Use different personas for different activities.

Nah, we call that DID. You are just crazy and got multiple personalities. OP sec is not a thing, it's just a bunch of lunatics with multiple personalities 😈

[Omniscient]

1. A few sites got compromised using a MYBB 0day. It works using a exploit discovered today merged with a exploit in the myBB posts and signature.
2. Around 4k HF accounts have been compromised but not leaked. (in this layout URL | LOGIN | PASSWORD | COOKIE | COOKIE NAME)
3. Killing cookies etc wont fix it the only way is to recode the posts system and signature as its an exploit from like 1.2 hasnt been fixed till today.
4. All credentials are safe and will not be publiced. It was more of a tester run rather than a milicious intent.

I am aware Mr Robot told you, I dont know how this information got to him, seems like a game of chinese whispers.
Dont believe everything people tell you especially people that know nothing about the situation.

This is all a rumor imho until I see direct evidence of compromised accounts. Personally finding it hard to believe.

Passwords are not stored in the cookies. If a browser exploit existed it would have to steal it from the AUTOFILL.
https://chromereleases.googleblog.com/20...3.html?m=1

So maybe that's what's going on.

Maybe MyBB allows for malformed signature that's allowing code execution into the browser?

I really think this could be a hoax. Some of what is being stated doesn't make much sense.