May 3, 2016 01:33 PM
(This post was last modified: May 3, 2016 01:33 PM by Omniscient.)
I can't say when or how but apparently somewhere at some point we had a compromise of account security. It has to be based on my findings today.
While conducting my normal day of checking for stolen accounts I came across a dozen or so Ub3r accounts stolen in the last few days. Upon further inspection and looking for more accounts stolen or sold related to these accounts I found something rather alarming. In my logs I found that nearly 40 accounts had attempts to login and it became obvious these were not sold accounts. Indeed these appear stolen. I conclude that because out of the 40 accounts only the ones without 2FA were actually logged into and stolen. And more than a few members of these stolen accounts closed have contacting me to claim they were not sold and their computers are not infected.
That leads me to believe this person has the password of the account. They can only get that either by the member using the same password on another site, being infected by a RAT/keylogger, or if their hashed password was cracked from a dump. So it's rather alarming to find this out.
I have to conclude this was on our old hardware or some fluke compromise at some point when I was working on something. Could even have been MyBB vulnerability which is likely now patched. If there was some way for the person to still have DB access I would assume they'd alter the member login or other site details and have their way. Even do a complete dump (I have measures in place to make that very very difficult) which does not appear to have happened. They'd also disable 2FA if they had SQL access and steal any account they wished.
All accounts compromised are older than 1 year ago. Which might be when the compromise occurred, maybe.
I am going to add a plugin which will now require 2FA to post in the Marketplace or to send a PM if you have an upgraded account with 2FA/Gauth access. I have also altered the setting for the minimum character length of a password from 10 to 12 characters. In the future that should slow down any decrypting of hashed passwords in case of a dump.
If there is a silver lining in this it's that we now know that 2FA works to secure accounts.
I have contacted all the accounts compromised with 2FA enable and still open instructing them to immediately change their passwords and leave 2FA enabled.
Still, questions remain. When did it happen? How did it happen? Are we still insecure? And unfortunately at the time of this writing I can't say. I am still investigating this and messages have been sent to the members involved. With their help I should be able to get some answers to the previous questions.
I will need all members to change their passwords immediately and enable 2FA if you have an account with access.
Oh....btw some good news also...HF database does not store any private order data like name, address, or phone. We only have the most basic info which is IPs and emails.
It's very important for all members to check Trust Scan before making any deals. The information provided on the page is plenty and should be enough to give you an indication of how secure the account has been and if it has behavior that would deem them a high risk.
An email is being sent to all Ub3r instructing them to create a new password and to enable Gauth/2FA.
This will give everyone something to talk about at the very least.
While conducting my normal day of checking for stolen accounts I came across a dozen or so Ub3r accounts stolen in the last few days. Upon further inspection and looking for more accounts stolen or sold related to these accounts I found something rather alarming. In my logs I found that nearly 40 accounts had attempts to login and it became obvious these were not sold accounts. Indeed these appear stolen. I conclude that because out of the 40 accounts only the ones without 2FA were actually logged into and stolen. And more than a few members of these stolen accounts closed have contacting me to claim they were not sold and their computers are not infected.
That leads me to believe this person has the password of the account. They can only get that either by the member using the same password on another site, being infected by a RAT/keylogger, or if their hashed password was cracked from a dump. So it's rather alarming to find this out.
I have to conclude this was on our old hardware or some fluke compromise at some point when I was working on something. Could even have been MyBB vulnerability which is likely now patched. If there was some way for the person to still have DB access I would assume they'd alter the member login or other site details and have their way. Even do a complete dump (I have measures in place to make that very very difficult) which does not appear to have happened. They'd also disable 2FA if they had SQL access and steal any account they wished.
All accounts compromised are older than 1 year ago. Which might be when the compromise occurred, maybe.
I am going to add a plugin which will now require 2FA to post in the Marketplace or to send a PM if you have an upgraded account with 2FA/Gauth access. I have also altered the setting for the minimum character length of a password from 10 to 12 characters. In the future that should slow down any decrypting of hashed passwords in case of a dump.
If there is a silver lining in this it's that we now know that 2FA works to secure accounts.
I have contacted all the accounts compromised with 2FA enable and still open instructing them to immediately change their passwords and leave 2FA enabled.
Still, questions remain. When did it happen? How did it happen? Are we still insecure? And unfortunately at the time of this writing I can't say. I am still investigating this and messages have been sent to the members involved. With their help I should be able to get some answers to the previous questions.
I will need all members to change their passwords immediately and enable 2FA if you have an account with access.
Oh....btw some good news also...HF database does not store any private order data like name, address, or phone. We only have the most basic info which is IPs and emails.
It's very important for all members to check Trust Scan before making any deals. The information provided on the page is plenty and should be enough to give you an indication of how secure the account has been and if it has behavior that would deem them a high risk.
An email is being sent to all Ub3r instructing them to create a new password and to enable Gauth/2FA.
This will give everyone something to talk about at the very least.
![[Image: rebelsig.gif]](https://imageupload.co.uk/images/2016/12/28/rebelsig.gif)
![[Image: mfLLgfI.png]](https://i.imgur.com/mfLLgfI.png)
