MacRumors Forums: Security Leak

[Hyper-X]

We sold the SonicWall devices. I've heard people having good luck with WatchGuard and the low end Cisco ASA5505. From experience, the SonicWall was easier to install and setup and came 'full on' out of the box. Adding 'pin holes' was a little awkward as well as setting up port forwarding/etc. I have no experience with the WatchGuards. The Cisco ASA needs to be setup by someone with a very good knowledge of Cisco IOS, and your network layout. There are some IOS setups that can be found on the web, but altering them can be a daunting task and someone who isn't good with IOS can easily lock themselves out of their firewall, out of the internet, and out of their network...

And most important is to check your logs periodically. You don't need to worry about what's blocked, but what traverses the device. Charter, we were getting hit on average 80 times an hour. All 'script kiddie' stuff. Every now and then, we'd get a more nuanced attack...

As far as 'home/personal use', I guess it depends... I always had a firewall, just in case. I kept information like bank records and such, and then business records. Pretty blasé stuff; but so is my underwear drawer, and I'd rather not have people in either one...

Are you referring to home use or SOHO/business?

 

[larrylaffer]

I saw that discussed before on the forums for the now abandoned Camino browser, and one of the developers replied that they weren't going to do it because if they did, banking sites and the like would block Camino users from using their site.

If you really want to change that behavior, you can learn to program and then modify an open source browser such as Firefox, Chromium, or the WebKit rendering engine used by Safari. You would also need to maintain those modifications, reapplying and possibly altering them as new browser updates are released. Failure to keep sufficiently up to date with the normal version of the browser would be a big security risk.

It wouldn't be super easy, but with an open source browser it is technically possible. Probably all you'd have to do is comment out the code that handles those HTML restrictions (extremely easy), but the trick would be finding the right portion of code, ensuring that you don't accidentally break another part of the browser, and repeating that effort whenever new browser versions are released.

I would just create a Firefox or Chrome extension that filters out the HTML that tells browsers this.

 

[Peace]

Nonsense! I did not get an email sooner because you initially didn't bother to send it. It took ages for you to inform users what was going on, and then it took comments from users to get you to post this thread on the front page rather than the feedback section of the forum, and then another comment that there should be some global notice to raise attention to it.

Hiding behind a 'technical bottleneck' is a weak argument. Poor form Arn!

While I don't disagree with part of your statement it only took about 12 hours after the hack ended. It did not take "ages".

 

[DamnDJ]

If anyone has any sense of personal security, the password you use here is unique and not used anywhere else. Otherwise, you share the blame if you're in an uproar.

 

[Mercifull]

November 14th now and still no email. I've changed my password to something more secure and, crucially, unique to this website.

I'd already moved 55 other accounts to LastPass but I'd forgotten I had this account until I heard about the breach on another tech blog.

 

[Psycho Mantis]

Did anyone else have their email spammed 200+ times? I also found out my PayPal account had sent $160 to some guy I've never done business with. Currently talking with PayPal at the moment and was wondering if anyone else had this happened?

I've already begun changing emails and passwords, didn't really think it could happen to me but hey it did.

----------

If anybody else encountered strange activity with their accounts (before they changed their passwords), please post it here. I'm trying to figure out if lol actually logged into anything.

I already made a post above, but the guy logged into my PayPal and bought $160 worth of bitcoins. I have his full name, seller ID, and email. Not sure what else to do, but I've already contacted PayPal.

 

[David29]

.

Just get 1Password.

One of the best software purchases I have ever made.

 

[DramaLLama]

Is there a time on Nov 12 that this data was breached? I happened to have changed my password around 8pm eastern on Nov 12.. not sure if it would have been taken then or afterwards.

 

[shnn2011]

They don't even need the passwords with such a weak hash.

Honestly, it probably does not matter that they know the password with a weak hash as used by v-bulletin especially if it is unsalted.

All they need is something that they plug into the formula to get that hash.

In order to be seriously adversely affected, you would have had to use the same password on other sited that use the same hashing system and have had the same account login name, which is a security risk in itself.

If you used a different unique password like you should have, then you could easily audit your posts to MacRumors and report any strange behavior or posts to be corrected.

I would like to know:

1. If the hashes are salted
2. How the attack was discovered
3. Why it is announced as potential "security leak" is there some chance that this was a false alert?

Thank you

more information look at the Birthday attack: http://en.wikipedia.org/wiki/Birthday_attack
Also Salt cryptography: http://en.wikipedia.org/wiki/Salt_(cryptography)
Fing MD5 hashed passwords quickly: http://md5.gromweb.com/?md5=dfb55031417e64e7dd358e9d70cb7641

 

[Slinkwyde]

Honestly, it probably does not matter that they know the password with a weak hash as used by v-bulletin especially if it is unsalted.

[...]

vBulletin default code:

return md5($password . $salt);

Source

 

[NeoStuey]

Only got my email about an hour ago, and whilst I would have liked to have been informed sooner, my password was unique to this site and I have minimal personal data stored, so hopefully no harm done.

On a side note I had to use my iPad to change my password using the keychain password generator in Safari.

Safari on my MacBook Pro was generating a new password but not updating it on my keychain, helped to get me locked out, rather helpful that.

 

[shnn2011]

Well, whatever, everything is hackable given enough time. . .

Well, whatever, everything is hackable given enough time. . .
The question is how can we improve the security.

 

[Ledgem]

Is there a time on Nov 12 that this data was breached? I happened to have changed my password around 8pm eastern on Nov 12.. not sure if it would have been taken then or afterwards.

Change it again regardless, and if you used the same password on any other services, change those as well.

 

[Nerdy Keith]

Thanks for letting me know, I have already changed my password. As it happens MacRumors is the only site I had used that password with.

 

[T-Bob]

This is VBulletin's fault, unless they patched the vulnerability immediately and it was not applied to this forum. What do they say about it?

 

[Nerdy Keith]

The question is... Who dun it?

It was an Android fan boy jk

 

[dysamoria]

When creating your new passwords, please keep this XKCD comic in mind and maybe we'll all have secure, easy to remember passwords:
Image

Whether it's neurology (dyslexia) or something else, mnemonics don't work for me. I'll store the wrong data and remember the wrong thing. Account info recollection is already a huge problem for me, then there's the fact that I have to keep track of more than 83 accounts all over the Internet. This whole system is stupid. There's good damn reason that human beings use easy passwords and that they reuse them all over the place. It's called being human. Using a third party service/tool to store them is no better, since they can be compromised too, and are targets. Might as well keep a spreadsheet on my own computer. I know others who do exactly that.

----------

If anyone has any sense of personal security, the password you use here is unique and not used anywhere else. Otherwise, you share the blame if you're in an uproar.

Because people like you are superior and can remember a hundred different and unique log in credentials. [insert middle finger here]

 

[troutmouth]

disgrace

i want my $ back.

 

[dysamoria]

Well, I think this thread has gone on WAY longer than it should have. Let's all agree on one thing, NEVER use the same password on more than one website, and always use a very strong password. Well, that's two things, but let's just agree. I'm pretty much done with this thread. If it hits 50 pages, I may come back and read the last few. I'd rather talk about Apple.

And how do you remember all those unique credentials? How many accounts do you have all over the Internet?

----------

Are you being serious? The whole point of a password manager is that it remembers your passwords for you. For most passwords you generate with it (exceptions being things like OS logins), you don't need to memorize them. The only password you really need to know is your 1Password master password. 1Password has browser add-ons available so that it can autofill your passwords on websites, and it can sync with your other computers and mobile devices.

Maybe you were being sarcastic, but sometimes it's hard to tell with text on the Internet.

And when the password manager is hacked? Where does it store that master password? Where does it store all the others? What if it breaks or you need to log in through another device without the plugin?

 

[Seevee]

Yea, I thing this sucks, and should have been notified right away....

 

[PinkyMacGodess]

Are you referring to home use or SOHO/business?

Having been in the service of both businesses, home businesses and home residential users, We have recommended not using software firewalls nearly the entire time. For a total home user that doesn't have anything on their computer that is sensitive, no bank records, no personal information like passwords, etc, some of the really low end firewalls might be a good fit, but I have always had a hardware firewall of some kind. We sold what we used, and what clients requested where available. We never had a problem with that stand. For very nervous, and security conscious residential customers, we had a few SonicWall and Cisco ASA devices installed. The early SonicWall SOHO series with and without wireless were popular with residential and small business customers. They were more expensive than copies of software firewalls, but were a lot more secure in the long run, and for a small business, when you reached a certain level, the software firewalls were actually more expensive. Plus with no central management at the time, there was not much control over what havoc a user could cause with the settings. It may have gotten better, and I hope it did, but to this day nothing compares to a properly setup hardware firewall. They can also provide secure remote access to someone's home network also without monkeying around with shims and finicky client software through SSL/VPN capabilities found in many of them. I'd recommend one to any user that takes their security seriously...

But there are differing opinions out there on all of this... Whatever... A home user doesn't need an ASA 5580, but a medium business doesn't need an ASA 5505 either, or a software firewall that might not play with their other software well.

 

[furi0usbee]

And how do you remember all those unique credentials? How many accounts do you have all over the Internet?

----------



And when the password manager is hacked? Where does it store that master password? Where does it store all the others? What if it breaks or you need to log in through another device without the plugin?

First, I use 1Password to remember all those passwords. I only need to remember my master password. My password vault is encrypted AES-256 bit. Nobody is going to hack that. I can use the 1Password app to view all those passwords offline, don't need the plugin. I can also view them in my iOS app.

The 1Password app would need to stop working for me not to be able to get to my passwords. I also have my 1Password vault backed up (encrypted). Even if 1Password went belly up and the app didn't work with some future version of Mac OS, I would just boot from my clone (on the older OS) and have to find a new password manager.

To save them so I can always see them, I could always created an encrypted disk 256 bit, and put them in clear text in that file, and give that a very hard password as well. But I don't think the guys at 1password are going away any time soon.

 

[TheChemist]

Are you being serious? The whole point of a password manager is that it remembers your passwords for you. For most passwords you generate with it (exceptions being things like OS logins), you don't need to memorize them. The only password you really need to know is your 1Password master password. 1Password has browser add-ons available so that it can autofill your passwords on websites, and it can sync with your other computers and mobile devices.

Maybe you were being sarcastic, but sometimes it's hard to tell with text on the Internet.

I was joking! Although, you're right. We can't put anything past anyone now a days.

 

[AidenShaw]

I'm the same as you. Now I'm panicking since I try and use one same password for all websites.

Are you being serious? The whole point of a password manager is that it remembers your passwords for you. For most passwords you generate with it (exceptions being things like OS logins), you don't need to memorize them. The only password you really need to know is your 1Password master password. 1Password has browser add-ons available so that it can autofill your passwords on websites, and it can sync with your other computers and mobile devices.

Maybe you were being sarcastic, but sometimes it's hard to tell with text on the Internet.

Exactly.

My PayPal password is "m@$35$3y%hl*FG#5Er&" - generated and remembered by my password manager (RoboForm).

 

[abhibeckert]

The password itself may not be cracked, but with the hashing algorithm and the salt available, it is possible to find something that will create the same hash.

No. Finding the password is fairly easy if it's a weak password and hard if it's a good password. Finding a hash collision is all but impossible.

MD5 has been completely broken. It isn't a secure hashing algorithm any more.

It's not "completely broken" at all. It's just not as good as other available options.