Security Issue - Admin Accounts Cracked

[Koby]

I pondered on whether I should let this be known or not at first, but decided this was something that definitely needed to be let known.

 

Apparently someone managed to obtain Renzourin's password and successfully logged into the admin control panel. The same user apparently had somehow obtained multiple passwords of my own through unknown means (likely other sites were compromised). Luckily the user did not have my password that I use for this site and that Renzourin's account didn't have any real privileges that could have done major damage. However, despite this; there is no log of my credentials being altered, yet I too was unable to access my account without some alterations.

 

Luckily; whoever it was doesn't seem to have done much. They changed the passwords of a couple accounts and gave one of them my email address. Though the fact this took place in the first place could likely mean a lot more accounts have or could be compromised and I suggest everyone change their password even if you don't believe you need to.

 

In case you're wondering; yes I have remained up-to-date with the IP.Board Security Patches. This crack does not appear to be a flaw in our security nor our server; but rather the fact that someone obtained our passwords from other sites. I don't use my password for this forum else where; but apparently Renzourin did and that allowed his account to be compromised.

 

I've demoted him for now until I can talk to him and make sure something like this doesn't happen again.

 

Just a reminder to everyone; especially my staff, it's best to make sure you use a different password for every site. If you have any staff powers here, please do not use the password you use here anywhere else and be sure it's not something simple that can be cracked with a dictionary algorithm.

 

----

 

Some information on the crack:

 

IP Address: 212.7.208.145

 

It's a Poland IP Address for what appears to be dedicated server providers. Though it's likely this IP is fake/proxied.

 

Suspected real IP of the user: 76.24.86.129

^ That's a Comcast user from Massachusetts.

It's not proven that this is the culprit; but I'm pretty sure it is.

 

[Moodkiller]

Wow scary stuff to be honest. Thanks for the update and deciding to inform us in the end. Just thankful that they didn't do anything else or worse

[mikezilla2]

Heartbleed ?

[lemmingllama]

Well, I'm glad that nothing was damaged. Thanks for the update.

 

Also if it was one of the people from this site, really???? (One question mark isn't enough)

[J-Lord]

I was due to change my password anyway, this will just help me get the motivation to get it done lol. That is a shame though that this had happened.

[Kenzou]

Thanks for the heads up Koby. That really messed up for someone trying to hack this site.

[JimDaddy]

Speaking of accounts that was compromised *raises hand*.... situation rectified.

[HeavenlyClassic]

hmm im fine...so im slightly offended... :3

[SuperSlamm]

I'm curious to know why someone would want to do this. What exactly was there to gain?

[Renzourin]

hmphh i hadnt even noticed a poland and a Mass ip fucking hell alright, in a moment im force changing my password and changing my email into a fresh one ill be creating just for this account

 

EDIT: its been done the password has been changed into something completely unique that i never have nor will i ever use on another site and the email has been changed into something i just created 5 minutes ago my account should now be secure but in the meantime im gonna run a full scan of every virus/malware thing i have to check for shit

Edited May 5, 2014 by Renzourin

[SoultakerSpirit]

Maybe someone is jealous cause they don't have a cool site like this and wanted to crash it.

[Koby]

hmphh i hadnt even noticed a poland and a Mass ip fucking hell alright, in a moment im force changing my password and changing my email into a fresh one ill be creating just for this account

 

EDIT: its been done the password has been changed into something completely unique that i never have nor will i ever use on another site and the email has been changed into something i just created 5 minutes ago my account should now be secure but in the meantime im gonna run a full scan of every virus/malware thing i have to check for shit

I don't think it's your fault, or that it was even virus/malware related. Judging from the fact the culprit had intel on numerous passwords I use; I'm guessing other sites we visit were compromised and they obtained the passwords there; did a simple google search for accounts on the web with our usernames and found us; or knew of this site and thus looked for sites that may have been capable of being exploited. Either way; the issue is definitely an off-site matter, and just goes to show why everyone should always try to use separate passwords for each site they visit.

[Alice]

I'm changing mine right now to be on the safe side.

 

Edit:

Password changed...having to write it down because I'll never remember it  LOL

Edited May 5, 2014 by Nagisa

[† LimitLess]

I hope someone finds out who this bastard is.

Anyways, It's not like they'll be able to get my password. It's the best password anyone in the whole world has ever come up with.

 

I'll even give 70 hints, you still wouldn't figure it out

I'm Being Sarcastic

[ZeroPenguins]

Oh this makes me feel bad, my password is my username and 1234 on top... Hmm

[slick1109]

I am glad you chose to share this information Koby.  I think it is important for everyone to know about, and hopefully take proactive steps to avoid any more future problems.

[† An IP BreAKDoWN]

Everyone, this is a good time to start using LastPass. Don't forget your Firefox and Chrome extensions for auto logins.

LastPass is a tool that'll help curb all of horrible password practices everyone here, including the ones Renzourin is having. I personally used a 100 unique scrambled character password that is changed between sites. Though is can be done easily on the computer, you might think it's impossible to type that on a phone. However LastPass is in the Google Play store, iOS too. It does have a subscribtion base service to use (only in the mobile app), but is starting to look like the only good solution at the time.

Guys! Get LastPass, make your master password a super giant thats easy to type on a phone like: correcthorsebatterystable (better yet, CorrecthorseBatterystable~ , get creative), change your password on EVERY site that you use (using the password generator). I was scared to use a password like Ged9SGPZu6jhg^!%k4jcUty&YBdWXwVf5Ht296VkFe34ySARpz^@V&MAE3V%rfrn@bgN7n$2SQjWnS8m3AX$qaxcz$@xStVgxNFu at first, but I haven't had an issue yet and I've been using it for a year now. I HAD to get the mobile app to make any of this usable.

[JohnFlower]

Everyone, this is a good time to start using LastPass. Don't forget your Firefox and Chrome extensions for auto logins.

LastPass is a tool that'll help curb all of horrible password practices everyone here, including the ones Renzourin is having. I personally used a 100 unique scrambled character password that is changed between sites. Though is can be done easily on the computer, you might think it's impossible to type that on a phone. However LastPass is in the Google Play store, iOS too. It does have a subscribtion base service to use (only in the mobile app), but is starting to look like the only good solution at the time.

Guys! Get LastPass, make your master password a super giant thats easy to type on a phone like: correcthorsebatterystable (better yet, CorrecthorseBatterystable~ , get creative), change your password on EVERY site that you use (using the password generator). I was scared to use a password like Ged9SGPZu6jhg^!%k4jcUty&YBdWXwVf5Ht296VkFe34ySARpz^@V&MAE3V%rfrn@bgN7n$2SQjWnS8m3AX$qaxcz$@xStVgxNFu at first, but I haven't had an issue yet and I've been using it for a year now. I HAD to get the mobile app to make any of this usable.

This totally didn't sound like an ad >_>

LastPass. Use it.

[† An IP BreAKDoWN]

Sorry, I was really high and about to run out the door to work.

I don't know really how to talk about LastPass that'll make people use it. I could just show peeps this video, but I don't know if that's any better. But what's wrong ads though?

[lemmingllama]

Sorry, I was really high and about to run out the door to work.

I don't know really how to talk about LastPass that'll make people use it. I could just show peeps this video, but I don't know if that's any better. But what's wrong ads though?

 

Well, unless the rules have been changed then there is a rule stating that advertising isn't allowed. It's fine to condone a product, but entire posts about it are normally not the best. Still, the program you mentioned seems interesting, although I would personally never use it.