What a week this has been. I've been working diligently to figure out what has been going on with the stolen accounts.
This might be a good time to read the first notification again in case you've mistaken some of the rumors as facts.
https://hackforums.net/showthread.php?tid=5258345
It turns out we are NOT COMPROMISED. There is NO EXPLOIT. There is no DUMP or LEAK of the HF DB.
As it happens there was a code logic problem with my IP Login History plugin which I never noticed before. MyBB uses the same hook name in two places which it should not do but it does. So the plugin ran correctly with one hook and incorrectly on the second hook. That caused an IP to be logged incorrectly as logged into the account. Gauth plugin actually interrupted the login process in a way that the second hook didn't run if 2FA was enabled on the account. Explains why no 2FA enabled accounts had the false logging.
A few lessons from this.
1. Don't believe all the trolls telling you that they hacked HF.
2. Don't allow anyone to blackmail, threaten, or extort you over your HF account.
3. I'll always work as hard and fast as I can to figure out the problem and to fix it.
I do feel like I have egg on my face. All this drama was indeed my own doing. I did my best to contain it but of course if indeed HF had been compromised it was important that members know.
Pretty F'n funny that a small piece of code logic (bug) could cause so much drama. I'm very happy to make this announcement.
I'd like to officially thank the one person who helped cause this fiasco. He's the guy who attempted logins into all these accounts. Around the 4th day of my work I contacted what I hoped was a valid email address for him. He responded that it wasn't an exploit and he was just trying to get an HF account to make some money. He was a ban evader which I've been very successfully banning his new accounts. He resorted to finding a way to steal active accounts. In my communication with him he told me that he was using a simple method to obtain the accounts but it didn't make any sense to me at first. He was possibly not the actual account thief, lying to me, or some other third option which I had not yet thought of.
I headed out for a late-night drink after a long-day of work. Upon return I had a clear and yet foggy head. Then it came to me. I realized how it could all fit. I was almost certain of the problem causing this but it was very late and I needed to sleep on it. Upon awaking I was still sure of my hypothesis and needed to hop onto the server asap. Within minutes I had confirmed my deductions about the bug and spent the next hour fixing it. Hallelujah! We're fixed and not exploited or compromised. :)
The person who pushed this bug and caused me much grief this week will get some type of bounty and likely a fresh Ub3r account along with some awards. I hold no ill will towards him. It's going to be up to him if he wishes the notoriety of these claims. He was actually stealing some accounts but more like 5 not 50 and his method was completely users fault for using cross-site passwords.
Some good things of course are how serious we all took account security and some measures were put into place to increase it. Also an important bug with logins is fixed.
We no longer need a full site PW reset. However, I do plan on implementing expiration dates for passwords with a 6 month rotation. More on that feature later.
You may now exclaim your joy and relief.
This might be a good time to read the first notification again in case you've mistaken some of the rumors as facts.
https://hackforums.net/showthread.php?tid=5258345
It turns out we are NOT COMPROMISED. There is NO EXPLOIT. There is no DUMP or LEAK of the HF DB.
As it happens there was a code logic problem with my IP Login History plugin which I never noticed before. MyBB uses the same hook name in two places which it should not do but it does. So the plugin ran correctly with one hook and incorrectly on the second hook. That caused an IP to be logged incorrectly as logged into the account. Gauth plugin actually interrupted the login process in a way that the second hook didn't run if 2FA was enabled on the account. Explains why no 2FA enabled accounts had the false logging.
A few lessons from this.
1. Don't believe all the trolls telling you that they hacked HF.
2. Don't allow anyone to blackmail, threaten, or extort you over your HF account.
3. I'll always work as hard and fast as I can to figure out the problem and to fix it.
I do feel like I have egg on my face. All this drama was indeed my own doing. I did my best to contain it but of course if indeed HF had been compromised it was important that members know.
Pretty F'n funny that a small piece of code logic (bug) could cause so much drama. I'm very happy to make this announcement.
I'd like to officially thank the one person who helped cause this fiasco. He's the guy who attempted logins into all these accounts. Around the 4th day of my work I contacted what I hoped was a valid email address for him. He responded that it wasn't an exploit and he was just trying to get an HF account to make some money. He was a ban evader which I've been very successfully banning his new accounts. He resorted to finding a way to steal active accounts. In my communication with him he told me that he was using a simple method to obtain the accounts but it didn't make any sense to me at first. He was possibly not the actual account thief, lying to me, or some other third option which I had not yet thought of.
I headed out for a late-night drink after a long-day of work. Upon return I had a clear and yet foggy head. Then it came to me. I realized how it could all fit. I was almost certain of the problem causing this but it was very late and I needed to sleep on it. Upon awaking I was still sure of my hypothesis and needed to hop onto the server asap. Within minutes I had confirmed my deductions about the bug and spent the next hour fixing it. Hallelujah! We're fixed and not exploited or compromised. :)
The person who pushed this bug and caused me much grief this week will get some type of bounty and likely a fresh Ub3r account along with some awards. I hold no ill will towards him. It's going to be up to him if he wishes the notoriety of these claims. He was actually stealing some accounts but more like 5 not 50 and his method was completely users fault for using cross-site passwords.
Some good things of course are how serious we all took account security and some measures were put into place to increase it. Also an important bug with logins is fixed.
We no longer need a full site PW reset. However, I do plan on implementing expiration dates for passwords with a 6 month rotation. More on that feature later.
You may now exclaim your joy and relief.
![[Image: wOdD4yf.gif]](https://i.imgur.com/wOdD4yf.gif)
![[Image: mfLLgfI.png]](https://i.imgur.com/mfLLgfI.png)
![[Image: RIP7FkV.gif]](https://i.imgur.com/RIP7FkV.gif)
![[Image: lkp0bxV.jpg]](https://i.ibb.co/MD7cKcgB/lkp0bxV.jpg)
![[Image: pV8jKWs.jpg]](https://i.imgur.com/pV8jKWs.jpg)