Do we need to change our SMF passwords??? - Page 1
Forum section: electronics / general

author: orbiter
author_rank: Frequent Contributor
timestamp: July 26, 2013, 10:24:27 am
content: Just had an email telling me that the SMF database has been hacked, and that they are 100% sure that their user database has been stolen..."On the 22nd of July 2013, it was discovered that unauthorized access to our website and database has been obtained on the 20th of July.The method is similar to the hacks that were recently conducted at other websites, even though those sites used other software.One of the admin accounts password was discovered, and from there further escalation wasn't too difficult considering admin privileges can do just about anything.Unfortunately, we are 100% sure that our user database has been stolen.As such we HIGHLY RECOMMEND, even implore you, to:1.) Change your password on other websites you are using, if you use the same password there. This is very important to do, as it also will help prevent other websites being hacked through your compromised password, if it is compromised.2.) Change your password here on our website.3.) If you use the password you use here anywhere else, say for example to login to your webhost, it is highly urged to change it.4.) Please note that personal messages may have also been compromised. We don't know for sure if the hacker only downloaded the user tables or not, although that's the only thing he/she is after. If they did: keep in mind that passwords you shared through PM should now be considered vulnerable. It's best not to take the risk and gamble, and just change any password you shared through PM as well.5.) Charter members, current and past, are encouraged to change ALL passwords if they ever sent any in to us. That would include FTP.Please keep in mind:This is !!NOT!! a security issue with the SMF software. If you are running the latest SMF version you have nothing to fear from this hack if you use different passwords.The method used by the hacker is that a database is downloaded from another hacked website, the passwords are attempted to be decrypted and if it is successful: they try to login to other websites using that username & password, or try to cross-reference by using password reset links.Unfortunately for us, a Administrator used the same password elsewhere on another site and access to our site was obtained when the password from the other hacked site was successfully decrypted. As a result, the hacker was able to login here with admin rights.Hundreds of websites have been hacked lately by using this method, so you are highly encouraged to change your passwords...... And remember: don't use the same password on multiple sites!It helps to prevent hacks like this.Thank you for your consideration and we deeply apologize for any inconvenience this causes for you.By changing your passwords, you will help ensure that other sites do not fall victim to this method of hacking and help put a halt to the hacking spree that has affected hundreds, if not thousands, of websites already."

author: Unknown
author_rank: Unknown
timestamp: July 26, 2013, 10:33:35 am
content: Why post this in the blog specific category? I guess some people (eg. Dave) might also be registered at the SMF forum, but I assume he got the exact same e-mail. The group of people both interested in electronics and SMF is probably fairly small, so I fail to see the point of posting this here. To quote from the message you posted:QuoteOf course reusing passwords for important (eg. admin, e-commerce) accounts is always a bad idea for this exact reason. Just use a password manager that makes it easy to maintain numerous complex passwords.

author: EEVblog
author_rank: Unknown
timestamp: July 26, 2013, 10:37:27 am
content: Quote from: alm on July 26, 2013, 10:33:35 amI don't recall if I am or not. I think I've used there forum before. But didn't get an email.

author: orbiter
author_rank: Frequent Contributor
timestamp: July 26, 2013, 10:44:49 am
content: I posted it here for the benefit of ALL EEVBee's, as I'm sure they (and Dave) would be interested to know that.. SMF themselves are 100% sure thattheir user database has been stolen. And PM's etc have also been compromised.Feel free to move the topic if required.

author: ablacon64
author_rank: Frequent Contributor
timestamp: July 26, 2013, 01:43:36 pm
content: Can they recover passwords from the stolen database itself? I mean, aren't passwords encrypted within it?

author: GeoffS
author_rank: Unknown
timestamp: July 26, 2013, 02:02:58 pm
content: It's only of concern if you have an account at simplemachines.org.

author: nitro2k01
author_rank: Frequent Contributor
timestamp: July 26, 2013, 02:32:15 pm
content: Quote from: GeoffS on July 26, 2013, 02:02:58 pm'cactly.Quote from: ablacon64 on July 26, 2013, 01:43:36 pmThe password is almost certainly hashed, and if the software is worth its salt, (pun intended) each user has an individually salted password. In the former scenario, if you have a dictionary password, it can easily be cracked. In the latter scenario, it's still feasible to run checks for weak passwords for individual users, say running a password against the 1000 most common passwords and hoping for a match. The target of such an attack would be to try that password on other services that the user might have, say Paypal, or even just the associated e-mail account, for sending spam.If you have a strong password, you have nothing to worry about because the password would be difficult to crack. If you use a different password for each service, you also have nothing to worry about because any cracked password would be useless.

author: Unknown
author_rank: Unknown
timestamp: July 26, 2013, 04:06:07 pm
content: Quote from: nitro2k01 on July 26, 2013, 02:32:15 pmI wouldn't rely on this. Especially because their announcement didn't mention either hashing or salt. I would recommend anyone registered on simplemachines.org to change their password at any place where they reused the same password.

author: nitro2k01
author_rank: Frequent Contributor
timestamp: July 26, 2013, 05:05:24 pm
content: Quote from: alm on July 26, 2013, 04:06:07 pmIt does however mention:"The method used by the hacker is that a database is downloaded from another hacked website, the passwords are attempted to be decrypted and if it is successful: ..."This is probably non-IT speak for cracking the hashes.I don't actually disagree with the advice to change the password on other sites as a precaution if you were using the same password on different sites, but if they stored passwords anywhere in plaintext or a recoverable form, they shouldn't be asking people to take preventative measures, but explain to the world why they are incompetent twats.

author: MacAttak
author_rank: Unknown
timestamp: July 26, 2013, 06:50:37 pm
content: Just to be clear on this - the simplemachines.org user database is *not* the same as the eevblog forum user database, correct?I have no idea how SMF is structured and whether this is some kind of multi-tenant system or self-hosted/co-hosted.

author: rkupka
author_rank: Regular Contributor
timestamp: July 26, 2013, 07:23:31 pm
content: Quoteif the supposed "hack" is based on stolen admin account, then it's not a break-in at all. It's a legitimate "misuse" of admin account. period.Accounts get stolen. Even admin accounts. If you let trojan infect your computer with keyloggers etc....

author: M. András
author_rank: Super Contributor
timestamp: July 26, 2013, 07:56:36 pm
content: and when a firewall on the OS is not configured for ask every process permission to acces the network then its another fail on the users end

author: benemorius
author_rank: Regular Contributor
timestamp: July 26, 2013, 09:52:42 pm
content: Quote from: MacAttak on July 26, 2013, 06:50:37 pmThat is correct. There is no relationship whatsoever.The title of this thread is indeed misleading and really ought to be changed to avoid confusing and frightening users.

author: orbiter
author_rank: Frequent Contributor
timestamp: July 26, 2013, 10:01:16 pm
content: Quote from: benemorius on July 26, 2013, 09:52:42 pmTitle changed!I wish I hadn't bothered now to be honest. I only posted the info here is this is the only SMF related forum I belong to, so if it doesn't affect ushere, why did I get the quoted email?

author: benemorius
author_rank: Regular Contributor
timestamp: July 26, 2013, 10:13:51 pm
content: Quote from: orbiter on July 26, 2013, 10:01:16 pmIf you received the email then there must be an account registered at simplemachines.org with your email address. So it would appear that you have an account there whether you realize it or not.http://www.simplemachines.org/community/index.php?topic=508232.0

author: orbiter
author_rank: Frequent Contributor
timestamp: July 26, 2013, 10:30:01 pm
content: I certainly can't remember having signed up for anything regarding SMF (well apart from here.) So I've been through the email/password book I used to use(before creating a LastPass account) and tried logging-in to the SMF website. However no go.OK.. Assuming I am wrong then... I'll hold my hands up and apologise for causing widespread panic on the blogRequesting thread deletion please?