Was doom9 hacked in May 2016?

[manolito]

The German Hasso Plattner Institute offers an identity leak checker which returned the following result for my email address:

ACHTUNG

Ihre E-Mail Adresse taucht in mindestens einer gestohlenen und
unrechtmaessig veroeffentlichten Identitaetsdatenbank (so
genannter Identity Leak) auf. Folgende sensible Informationen
stehen im Zusammenhang mit Ihrer E-Mail-Adresse:

--------------------------------------------------------------
Betroffener Dienst: doom9.org
Datum: Mai. 2016
Verifiziert: Nein

Passwort: Betroffen
Vor- und Zuname: -
Kreditkarte: -
Bankkontodaten: -
Telefonnummer: -
Anschrift: -
Geburtsdatum: -
Sozialversicherungsnummer: -
IP-Adresse: Betroffen
--------------------------------------------------------------


The leak only contains my password and IP-Address, and since I do not use this password elsewhere the damage is very limited.

Can you confirm such an attack from last year?


Cheers
manolito

[Sharc]

If I remember this correctly Doom9 has informed some time ago about an incident and they advised to change the password. I'm however not sure that it was in 2016 or earlier.

[LoRd_MuldeR]

If I remember this correctly Doom9 has informed some time ago about an incident and they advised to change the password. I'm however not sure that it was in 2016 or earlier.

There was an incident in 2013, AFAIK.

[Swede]

Since I'm the one hosting the forum I always take these things seriously and whould therefore like to se a copy of the info you got, manolito. Drop me a PM please.
But, to my knowledge there has never been any hacks to the database and the incident Sharc refers to was probably the OpenSSL bug, named heartbleed, that was affecting *everyone* using OpenSSL 1.0.1 through 1.0.1f. https://forum.doom9.org/showthread.php?t=170457&highlight=heartbleed (http://forum.doom9.org/showthread.php?t=170457&highlight=heartbleed)

[sneaker_ger]

manolita seems to be talking about this check (https://sec.hpi.uni-potsdam.de/leak-checker/search) (yes, looks legit). It's currently overloaded because it appeared in the press after it incorporated new leaks found by German police.

There was another doom9 hack discovered in 2014 (https://forum.doom9.org/showthread.php?t=170842). But probably (hopefully?) only those users affected who viewed a certain thread.

[LoRd_MuldeR]

Yes, now that the HPI Leak Checker seems to be somewhat reachable again, I was able to verify that I'm affected too :scared:

(fortunately, I use a different pseudo-random password for each board/service)

[videoh]

Here is another useful checker:

https://haveibeenpwned.com/

Both this and HPI checker agree that I was affected by the LinkedIn hack. I deleted my LinkedIn account when it was taken over by Microsoft.

[Doom9]

Hmm.. what happens if they have no record of a compromise? No Email? Because that's what I get for the email I use for my account (on multiple checkers). But it's better to be safe than sorry so here goes another password change.

Even if the DB hat leaked, passwords are hashed and salted though - but I don't know what mechanisms they use.

@videoh: what do they services say about doom9 in your case?

[sneaker_ger]

It says I'm affected as well. But it also says the leak is not "verified" which in their words means the origin and legitimacy of the data is uncertain and it is possible the data may be from older leaks and/or combinations of other leaks or simply generated. It's not a certain indicator of an actual leak.

But the more doom9 users come forward with a positive test result the more likely the leak happened. Or still is.

[hBIkOa7m]

I joined Doom9 on 28th February 2016, with an email address exclusively for this forum, and my email address shows up in the leak checker shared above (https://sec.hpi.uni-potsdam.de/leak-checker/search) so the source of the leak is definitely after February 2016 and not one of the previous ones.


Result of Your Request for the HPI Identity Leak Checker
--------------------------------------------------------------

ATTENTION

Your e-mail address appears in at least one stolen and
illegally published identity data base (a so-called identity
leak). The following sensitive information was freely found
on the Internet in connection with your e-mail address:
REDACTED

--------------------------------------------------------------
Affected Service: doom9.org
Date: May. 2016
Verified: No

Password: Affected
First and last name: -
Credit card: -
Bank account details: -
Telephone number: -
Address: -
Date of birth: -
Social security number: -
IP Address: Affected
--------------------------------------------------------------

[Sharc]

It says I'm affected as well. But it also says the leak is not "verified" which in their words means the origin and legitimacy of the data is uncertain and it is possible the data may be from older leaks and/or combinations of other leaks or simply generated. It's not a certain indicator of an actual leak.
Exactly the same for me ....

[sneaker_ger]

In other news: last release of vBulletin v3 (https://www.vbulletin.com/forum/forum/vbulletin-3-8/vbulletin-3-8-questions-problems-and-troubleshooting/4349765-vbulletin-3-8-11?p=4369800#post4369800).

So, what's the future of the forum? Very likely hacked, no one knows how so it's still open to the same attack or maybe even ha trojan? No more forum updates. Admin only says "Even if the DB hat leaked, passwords are hashed and salted though".

[MediumRare]

same information as manolito and hBIkOa7m. Unverified like the other reports.

I use the affected e-mail address for only 3 forums, with different passwords in each case. I've just changed it here.

Hopefully swede and/or doom9 can track down the cause.

G

[dipje]

I only checked at 'haveibeenpwned', not going to enter it somewhere else :).

I see nothing special about doom9. There is the (quite known) unverified super combo list that floated around in 2016. 'HaveIBeenPwned' lists this:

Exploit.In (unverified): In late 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Exploit.In". The list contained 593 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated and used for "credential stuffing", that is attackers employ it in an attempt to identify other online systems where the account owner had reused their password

My address has been in some other pretty known and high profile leaks (Adobe, Dropbox, LinkedIn) so that I'm appearing on this combo list is nothing weird to me.

If indeed email addresses are appearing on this list that people used _only_ for this forum, then at least an account / email listing has been extracted.

If I read the explanation about Exploit.In, it was used primarily for 'cross-checking / cross-referencing' about other leaks. So the nasty people where collecting all kind of email addresses where they could, and started trying passwords and hashes they got from other leaks, to see if they work on different sites or not.

So Doom9 doesn't seem to be 'hit' really, but if what people in this thread are saying is true about unique email addresses (Really? Unique per forum / site?) then at least an account/email list has been extracted it seems (if you call that 'got hacked' or not I leave up to you).

My Doom9 password is from the end of june 2016.. seems I'm OK anyway.

[videoh]

@videoh: what do they services say about doom9 in your case? No, just the linked-in hack on both checkers.

[Doom9]

@sneaker_ger: we're going to upgrade to a version of vbb that's still under support.
Other than that.. we don't have an internal security department or the resources to have somebody run an independent security audit which kind of limits our options. I guess re-building the server from scratch would be something, though that only considers OS based attacks, not anything that could come from the web interface.

Plus nobody can tell if any actual passwords or IPs really made it out.. unless you have access to said list (and if I do, Swede and I would be very interested.. passwords could be re-hashed and compared, and IPs could be compared). Also.. is this doom9.org? The main website doesn't even have a database.

I know this is all very unsatisfactory to hear, but it's the best we have at this point.