Topic: About the recent server compromise - page 13. (Read 15388 times)
You got a lot done for only a few days of down time. Have you slept yet?
it must be someone internal, i can't believe everytime there is someone from the outside, that can hack a forum like this, and like nothing
i still think someone gave to him the info for login
i still think someone gave to him the info for login
Disgraceful that it's happened again imo.
We're having to change passwords & change email addresses.
I've just closed down the email account I first used as it has some sensitive info on.
Not the first time this has happened either.
Heads need to roll over this
Hope nobody had any coins stolen over this.
We're having to change passwords & change email addresses.
I've just closed down the email account I first used as it has some sensitive info on.
Not the first time this has happened either.
Heads need to roll over this
Hope nobody had any coins stolen over this.
so where is our update on Twitter about that "all is fine" ?!
Prove that you are real Theymos ?
Prove that you are real Theymos ?
Well i sure hope thats that, and we can just reset our pass, and leave this behind us. Good thing that there's not more damage done.
Nicely done, Theymos
cheers
Nicely done, Theymos
cheers
Thanks for your hard work to keep this forum safe from hackers
Hats off
Hats off
Thank you Theymos for your hard work
On May 22 at 00:56 UTC, an attacker gained root access to the forum's server. He then proceeded to try to acquire a dump of the forum's database before I noticed this at around 1:08 and shut down the server. In the intervening time, it seems that he was able to collect some or all of the "members" table. You should assume that the following information about your account was leaked:
- Email address
- Password hash (see below)
- Last-used IP address and registration IP address
- Secret question and a basic (not brute-force-resistant) hash of your secret answer
- Various settings
As such, you should change your password here and anywhere else you used that same password. You should disable your secret question and assume that the attacker now knows your answer to your secret question. You should prepare to receive phishing emails at your forum email address.
While nothing can ever be ruled out in these sorts of situations, I do not believe that the attacker was able to collect any personal messages or other sensitive data beyond what I listed above.
Passwords are hashed with 7500 rounds of sha256crypt. This is pretty good, but certainly not beyond attack. Note that even though SHA-256 is used here, sha256crypt is different enough from Bitcoin's SHA-256d PoW algorithm that Bitcoin mining ASICs almost certainly cannot be modified to crack forum passwords.
I will now go into detail about how well you can expect your password to fare against a determined attacker. However, regardless of how strong your password is, the only prudent course of action is for you to immediately change your password here and everywhere else you used it or a similar password.
The following table shows how long it will take on average for a rather powerful attacker to recover RANDOM passwords using current technology, depending on the password's alphabet and length. If your password is not completely random (ie. generated with the help of dice or a computer random number generator), then you should assume that your password is already broken.
It is not especially helpful to turn words into leetspeak or put stuff between words. If you have a password like "w0rd71Voc4b", then you should count that as just 2 words to be safe. In reality, your extra stuff will slow an attacker down, but the effect is probably much less than you'd think. Again, the times listed in the table only apply if the words were chosen at random from a word list. If the words are significant in any way, and especially if they form a grammatical sentence or are a quote from a book/webpage/article/etc., then you should consider your password to be broken.
Each password has its own 12-byte random salt, so it isn't possible to attack more than one password with the same work. If it takes someone 5 days to recover your password, that time will all have to be spent on your password. Therefore, it's likely that only weak passwords will be recovered en masse -- more complicated passwords will be recovered only in targeted attacks against certain people.
If your account is compromised due to this, email [email protected] from the email that was previously associated with your account.
For security reasons, I deleted all drafts. If you need a deleted draft, contact me soon and I can probably give it to you.
A few people might have broken avatars now. Just upload your avatar again to fix it.
Unproxyban fee processing isn't working right now. If you want to register and you can't, get someone to post in Meta for you and you'll be whitelisted.
Searching is temporarily disabled, though it won't be disabled for as long as last time because I improved the reindexing code.
If you changed your password in the short time when the forum was online a little over a day ago, the change didn't stick. You'll have to change it again.
How the compromise happened:
The attacker was able to acquire KVM access credentials for the server. The investigation into how this was possible is still ongoing, so I don't know everything, and I don't yet want to publish everything that I do know, but it seems almost certain that it was a problem on the ISP's end.
After he got KVM access, the attacker convinced the ISP NFOrce that he was me (using his KVM access as part of his evidence) and said that he had locked himself out of the server. So NFOrce reset the server's root password for him, giving him complete access to the server and bypassing most of our carefully-designed security measures. I originally assumed that the attacker gained access entirely via social engineering, but later investigation showed that this was probably only part of the overall attack. As far as I know, NFOrce's overall security practices are no worse than average.
To reduce downtime and avoid temporarily-broken features, I was originally going to stay in NFOrce's data center. However, some things made me suspicious and I moved everything elsewhere. That's where the extra day+ of downtime came from after a short period of uptime. No additional data was leaked.
The forum will pay up to 15 XAU (converted to BTC) for information about the attacker's real-world identity. Exact payment amounts will depend on the quality and usefulness of information as well as what information I've already acquired, but if for example you're the first person to contact me and your info allows me to successfully prosecute this person, then you will get the full 15 XAU. You need to actually convince me that your info is accurate -- just sending me someone's name is useless.
The attacker used the following IPs/email:
37.48.77.227
66.172.27.160
[email protected]
- Email address
- Password hash (see below)
- Last-used IP address and registration IP address
- Secret question and a basic (not brute-force-resistant) hash of your secret answer
- Various settings
As such, you should change your password here and anywhere else you used that same password. You should disable your secret question and assume that the attacker now knows your answer to your secret question. You should prepare to receive phishing emails at your forum email address.
While nothing can ever be ruled out in these sorts of situations, I do not believe that the attacker was able to collect any personal messages or other sensitive data beyond what I listed above.
Passwords are hashed with 7500 rounds of sha256crypt. This is pretty good, but certainly not beyond attack. Note that even though SHA-256 is used here, sha256crypt is different enough from Bitcoin's SHA-256d PoW algorithm that Bitcoin mining ASICs almost certainly cannot be modified to crack forum passwords.
I will now go into detail about how well you can expect your password to fare against a determined attacker. However, regardless of how strong your password is, the only prudent course of action is for you to immediately change your password here and everywhere else you used it or a similar password.
The following table shows how long it will take on average for a rather powerful attacker to recover RANDOM passwords using current technology, depending on the password's alphabet and length. If your password is not completely random (ie. generated with the help of dice or a computer random number generator), then you should assume that your password is already broken.
It is not especially helpful to turn words into leetspeak or put stuff between words. If you have a password like "w0rd71Voc4b", then you should count that as just 2 words to be safe. In reality, your extra stuff will slow an attacker down, but the effect is probably much less than you'd think. Again, the times listed in the table only apply if the words were chosen at random from a word list. If the words are significant in any way, and especially if they form a grammatical sentence or are a quote from a book/webpage/article/etc., then you should consider your password to be broken.
Code:
Estimated time (conservative) for an attacker to break randomly-constructed
bitcointalk.org passwords with current technology
s=second; m=minute; h=hour; d=day; y=year; ky=1000 years; My=1 million years
Password length a-z a-zA-Z a-zA-Z0-9
8 0 3s 12s 2m
9 0 2m 13m 3h
10 8s 2h 13h 13d
11 3m 5d 34d 1y
12 1h 261d 3y 260y
13 1d 37y 366y 22ky
14 43d 1938y 22ky 1My
15 1y 100ky 1My 160My
-------------------------------------------------------
1 word 0
2 words 0
3 words 0
4 words 3m
5 words 19d
6 words 405y
7 words 3My
Each password has its own 12-byte random salt, so it isn't possible to attack more than one password with the same work. If it takes someone 5 days to recover your password, that time will all have to be spent on your password. Therefore, it's likely that only weak passwords will be recovered en masse -- more complicated passwords will be recovered only in targeted attacks against certain people.
If your account is compromised due to this, email [email protected] from the email that was previously associated with your account.
For security reasons, I deleted all drafts. If you need a deleted draft, contact me soon and I can probably give it to you.
A few people might have broken avatars now. Just upload your avatar again to fix it.
Unproxyban fee processing isn't working right now. If you want to register and you can't, get someone to post in Meta for you and you'll be whitelisted.
Searching is temporarily disabled, though it won't be disabled for as long as last time because I improved the reindexing code.
If you changed your password in the short time when the forum was online a little over a day ago, the change didn't stick. You'll have to change it again.
How the compromise happened:
The attacker was able to acquire KVM access credentials for the server. The investigation into how this was possible is still ongoing, so I don't know everything, and I don't yet want to publish everything that I do know, but it seems almost certain that it was a problem on the ISP's end.
After he got KVM access, the attacker convinced the ISP NFOrce that he was me (using his KVM access as part of his evidence) and said that he had locked himself out of the server. So NFOrce reset the server's root password for him, giving him complete access to the server and bypassing most of our carefully-designed security measures. I originally assumed that the attacker gained access entirely via social engineering, but later investigation showed that this was probably only part of the overall attack. As far as I know, NFOrce's overall security practices are no worse than average.
To reduce downtime and avoid temporarily-broken features, I was originally going to stay in NFOrce's data center. However, some things made me suspicious and I moved everything elsewhere. That's where the extra day+ of downtime came from after a short period of uptime. No additional data was leaked.
The forum will pay up to 15 XAU (converted to BTC) for information about the attacker's real-world identity. Exact payment amounts will depend on the quality and usefulness of information as well as what information I've already acquired, but if for example you're the first person to contact me and your info allows me to successfully prosecute this person, then you will get the full 15 XAU. You need to actually convince me that your info is accurate -- just sending me someone's name is useless.
The attacker used the following IPs/email:
37.48.77.227
66.172.27.160
[email protected]
Jump to: