Receiving spam from anandtech smtp server?

[vshah]

how did that happen in the first place?

 

[zeruty]

I have nuked the Affiliate sub forum and removed all permissions from the account they were using.

Perk, can you get the IP they posted with to permaban the IP?

In another thread (in OT), Quintox posted links to other forums where the site was posted.

The user doing that used an account named Retrospector at the first forum, and the third one he signed his post as ~ Retrospector ~.

Maybe that can help you track down the bastard (ban if he has an account here)

http://forums.digitalpoint.com/showthread.php?t=1592769

http://www.v7n.com/forums/forum-lobby/157807-watch-movies-tv-shows-online-free.html



http://novatrading.net/content-4/183583-wts-online-tv-script-watch-any-channel.html

 

[Ken g6]

If it's any help, I notice that at least viewing single posts (showpost.php) is returning status code 500 (Internal Server Error), though the HTML is as normal. I wouldn't have noticed except that I'm working on a Greasemonkey script with AJAX.

This is still happening. And it wasn't happening before the short "scheduled maintenance" message last night. Something tells me he may have penetrated deeper than you thought. 🙁

 

[Crusty]

Disclaimer: IANAA(dmin)

Hate to say it, but consider this a FUCK YES. I'm not intentionally trying to set off a panic here, but if the admin accounts were hacked, and they were, you may as well consider all of your data here compromised, even if superficially it wasn't.

While I agree that changing your passwords is a good thing to do after an incident like this, don't forget that your passwords are stored encrypted in the database so it's not like the hacker has the plaintext password of all users here just from gaining access to the database.

Does anyone know if vB uses MD5 or SHA1? Also, are the passwords salted before they are hashed?

What IS worrisome is that if they hacker rooted the server and dropped in code to skim logins before they hit the actual forum code, which you won't really know unless you format/reinstall the server or audit every single line of php on the server.

Although if the server did actually get rooted I wouldn't expect them to be still running(they wouldn't be if I managed them).

 

[ViRGE]

While I agree that changing your passwords is a good thing to do after an incident like this, don't forget that your passwords are stored encrypted in the database so it's not like the hacker has the plaintext password of all users here just from gaining access to the database.

Does anyone know if vB uses MD5 or SHA1? Also, are the passwords salted before they are hashed?

What IS worrisome is that if they hacker rooted the server and dropped in code to skim logins before they hit the actual forum code, which you won't really know unless you format/reinstall the server or audit every single line of php on the server.

Although if the server did actually get rooted I wouldn't expect them to be still running(they wouldn't be if I managed them).

vB is MD5 + salt.

 

[cirrrocco]

Damm.. That was one sneaky mofo

 

[onza]

Omg locking my doors right now!

 

[hclarkjr]

have subscription updates been disabled because of this? i notice i am not getting them now for threads i have subscribed too

 

[ivan2]

vB is MD5 + salt.

why is it someone suggesting to change pw...

 

[Crusty]

why is it someone suggesting to change pw...

Just a precaution. If someone rooted the server you have no idea what information they are capturing in realtime from the servers(including passwords).

 

[SunnyD]

why is it someone suggesting to change pw...

Because, if the database itself was compromised, then the previously stored MD5 is all they need to replicate access to an account. The salt is readily available in the vB code.

Changing your password changes the MD5 stored in the database.

 

[robertk2012]

LOL I was wondering what that crap was last night. It gave me herpes.

 

[dmcowen674]

Folks, we were the victims of a serious forum breach early this morning, possibly from aliens

Hey, I resemble that remark.

Hope nothing was permanently compromised or ripped off.

That really blows.

Dealing with a lot of spammers lately over my way too but so far none as brazen as this one was.

 

[PlasmaBomb]

Is this why we have threads like "post you SS and credit card info"?

 

[wwswimming]

i think we been hacked
gotta love the big target vBulletin puts on us :/

not only that, to get to L&R you now have to do a search
to get to a link to L&R.

 

[FoBoT]

not only that, to get to L&R you now have to do a search
to get to a link to L&R.

or use the forum jump drop down at the bottom of the page or use the "Anandtech Forums" link at the top of the page

 

[Dualist]

May as well change our passwords after this latest attack on AT. I think otherwise our accounts could be their next target.

 

[Number1]

May as well change our passwords after this latest attack on AT. I think otherwise our accounts could be their next target.

What are they going to do with our accounts?

 

[ivan2]

Because, if the database itself was compromised, then the previously stored MD5 is all they need to replicate access to an account. The salt is readily available in the vB code.

Changing your password changes the MD5 stored in the database.

that won't be easy on any reasonable pw, with salt or not. just don't want to fuel the panic.

 

[SunnyD]

that won't be easy on any reasonable pw, with salt or not. just don't want to fuel the panic.

Let me fix that for you - it wouldn't be easy provided they have no access to the DB or web server. Given that it's already been compromised... The fact is if you have what's stored in the database, you don't need to decrypt anything. You use THAT as is to generate authentication.

Anyway, there shouldn't be any need to panic anyway. After all, you guys aren't realistically using the same password on some random internet forum as you are for, lets say... you BANK account, right?

 

[gorcorps]

May as well change our passwords after this latest attack on AT. I think otherwise our accounts could be their next target.

Oh my god... then they might post under my username. I'm so scared 🙄

 

[sandorski]

Let me fix that for you - it wouldn't be easy provided they have no access to the DB or web server. Given that it's already been compromised... The fact is if you have what's stored in the database, you don't need to decrypt anything. You use THAT as is to generate authentication.

Anyway, there shouldn't be any need to panic anyway. After all, you guys aren't realistically using the same password on some random internet forum as you are for, lets say... you BANK account, right?

😱😱😱😱

 

[PokerGuy]

Anyway, there shouldn't be any need to panic anyway. After all, you guys aren't realistically using the same password on some random internet forum as you are for, lets say... you BANK account, right?

No!... of course not! who would be so stupid. Certainly not me. <opens other window to change Citibank account info> 😀

 

[robertk2012]

The big question is whether or not they had their emails visible. Did they receive and infraction?

 

[VirtualLarry]

If it's any help, I notice that at least viewing single posts (showpost.php) is returning status code 500 (Internal Server Error), though the HTML is as normal. I wouldn't have noticed except that I'm working on a Greasemonkey script with AJAX.

It's doing that now for me.