Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MacRumors Forums: Security Leak

HappyDude20 said:
I agree. We are all equal and equally screwed if Lol was to sell our info to someone else but we can't have assumed we were always protected to the fullest degree...
Click to expand...

actually, we're not all equally screwed if the info is sold or destined to be used in a malicious manner.

person A could have provided a hacker with their paypal acct & password.
person B could have provided a hacker with their forum use email acct & site specific password..

i don't condone what the hackers have done but they have clearly shown (and stated) that users who have done nothing to protect themselves are the ones who are at risk of being exploited..

blaming the site is stupid. if you had protected yourself better, there would be zero reason to complain "3 days for a damn email!!!1!"..

out of 800k members here, i do believe a small handful of people may have a secondary crime committed against them via the obtained data.

for the vast majority of us though (you know, the other 799,995), quit blaming other people and fix your interwebbing setup.
 
Well.. origin account was hacked.. (forgot to change that one)

Lost all my friends and have to deal w/EA x.x

Thank god i dont trust them enough to give them CC access..

All my stuff was changed to Russian and my friends blocked. Even a smaller company like Trion was able to properly detect fraudulent activity. I'm not asking for 2-factor but when suspicious changes like logging in from Russia, change a bunch of stuff, etc. Can't you just deny it until further verification?

There wasn't even an e-mail confirmation about the changes.
 
The worst part of this is that you suffered an attack similar to one that hit another forum over three months ago. Was nothing done to prevent such an exploit in the mean time?

The FAQ (which is of course not available right now) ironically says that there is not reason to want to delete an account. I think "not wanting my login information stored by somebody who doesn't take care of it" would quality as a reason, don't you?
 
Well, I'm logged in and can not get connected toy account anywhere. So, I will not be able to change my password st this time. Guess I will have to delete Mac Forums.
 
Shrink said:
But kudos for a very nice try...:D
Click to expand...

Thank you. That will be $250 and please see the lady on the way out.

++++++

Just to stay a bit on topic. This breach is a learning opportunity. Last night, 1PW's security audit reported that I had 121 weak passwords. Today, the same audit reports zero. Find the learning here for yourself and put the energy there instead of sending flames at the site. What's done is done, and I tend to think the owners have already learned their lessons, whatever they may be.
 
Don't blame Macrumors

We have seen and will keep seeing frequent hack incidents. That's where we find ourselves at the present time. We are up against the old guard crackers, newly educated netters, and our illustrious NSA. I wouldn't be surprised if they did it.

The main thing is to use a unique password for every site. Make sure it's at least 10 characters or more. Make sure it's complex. The bottom line is that passwords will not stop someone that's determined to get in.

Best thing you can do is keep calm and relax. Change your password too.
 
Stealing passwords from MacRumors has to be one of the stupidest, most unprofitable hacks ever.

Everyone here is probably using 1Password to generate random and unique passes. (At least I hope they do).
 
scrmtrey said:
Hmmm , hater gonna hate i think.

Password changing took me 1 and a half hour ( for all accounts like twitter, fb, iCloud etc), but i am feeling happy for refreshing my password (3 years old and so on).
Click to expand...
Web Security 101.

Don't use the same password for multiple accounts.
 
Jesus on OSX said:
Stealing passwords from MacRumors has to be one of the stupidest, most unprofitable hacks ever.

Everyone here is probably using 1Password to generate random and unique passes. (At least I hope they do).
Click to expand...

People will do things for their own reasons, profit may not necessarily be the driving factor for the recent MR's security breach. For example Turkish hackers have been known to exploit several other forums for whatever reason.
 
camomac said:
I realize this post is 33 pages in, so who knows who will actually read it, but I have a couple things to say about this.

I have been here since 01/2005, I just got an email TODAY.
If you send out notices in batches how come it took so many days, when I have been here for nearly 9 years. I should have been nearer the top of the list.

I read MR everyday, I have noticed it is different on my phone, so I am not sure why I missed the original post.
Regardless I think it is BS I wasn't emailed SOONER!

I have to say this is the first time I really feel disappointed in this site, and I would like an answer as to why it took so long to let me know about this.
Click to expand...

I posted this above. Apparently you missed this:

Everybody says this (not fast enough notification), and few have any idea what they are talking about.

Once a data breach occurs, the organization must assess the extent, scope and vector of attack. The first order of business is to mitigate the attack itself, then preserve any logs and other key information.

Only once that is complete, a forensic examination can begin to determine exactly what information may have been accessed and over what period of time, AND exactly who was affected.

Many times I have seen organizations that know they have had a data breach, but to tie in the names and addresses (physical or email) of their customers with the data that was breached can be very difficult and VERY time-consuming.

All of those steps generally take days, if not weeks to determine. Not to mention drafting the notifications to comply with the different laws in 47 states (that currently have such laws on the books). Also, there are regulatory notifications that sometimes take precedence over consumer notifications.

The worst thing an organization can do is issue a hasty notification and then find out:

1. There actually was not any unauthorized access to personal information, so no notification was necessary;

2. The breach involved more (or less) than originally thought, so the notifications were in error.

Most state laws provide NO specific time (other than reasonable) to notify affected individuals. Some states provide for 45 days. 30 days is generally considered to be "reasonable". Under HIPAA/HITECH, organizations have 60 days to notify affected patients when protected health information is accessed.

These time-periods are built into the laws, because it is not easy to make these determinations in a few days. Although everytime there is a breach, somebody always whines they weren't told fast enough. Believe me, it is much more difficult than you think.

And, by the way, under U.S. law, MacRumors had NO legal obligation to notify anybody of this event. MR is simply performing good customer service by notifying you at all. Why? Because under the applicable laws, no "personal information" was accessed in order to trigger notification obligations. Okay?
 
Come on MacRumors. I only use one password for every one of my website access(es) including Comcast and three bank accounts and most importantly PayPal. Darn. I just looked and all of the money Mom gave me for inheritance is now entirely gone to some bank account in Hong Kong. Damn you, MacRumors. :mad:

----------
caesarp said:
I posted this above.

And, by the way, under U.S. law, MacRumors had NO legal obligation to notify anybody of this event. MR is simply performing good customer service by notifying you at all.

Oh, so this is THE standard for MacRumors??? Really?
OK, all of us will now assume that NO NOTIFICATIONS will occur for any security breaches of our personal information. By the way, thanks.
Click to expand...
 
longtimelurker said:
Come on MacRumors. I only use one password for every one of my website access(es) including Comcast and three bank accounts and most importantly PayPal. Darn. I just looked and all of the money Mom gave me for inheritance is now entirely gone to some bank account in Hong Kong. Damn you, MacRumors. :mad:

-----

Oh, so this is THE standard for MacRumors??? Really?
OK, all of us will now assume that NO NOTIFICATIONS will occur for any security breaches of our personal information. By the way, thanks.
Click to expand...


It's not MR's standard. It's the current US (state) law. What was breached here does NOT meet the definition of "personal information" as defined by most state statutes. That doesn't mean some other breach won't qualify. If social security numbers or financial information are accessed, then there IS a legal duty to notify.
 
caesarp said:
It's not MR's standard. It's the current US (state) law. What was breached here does NOT meet the definition of "personal information" as defined by most state statutes. That doesn't mean some other breach won't qualify. If social security numbers or financial information are accessed, then there IS a legal duty to notify.
Click to expand...
\

Yes, I understand the legal standard to notify. Thanks. As with most "standards" there is an ethical standard that supersedes the legal requirements. The real issue here is whether there were adequate protections in-place to reasonably protect MacRumors passwords and identities. In your view, were there?
 
If I or anyone only uses a certain password for such sites like: MacRumors, Apple Support Community, and some off the wall type sites...example: App forum, TV show sites where it would seem no harm could come out of getting the password hacked. How might they relate them to each other? Plus, if someone only uses a certain password for "just MacRumors". How might that harm you?

Of coarse, If I used the same password for a bank account, eBay, utility or any kind of money involvement site, I'd understand the threat.

And another example: Even though this is quite simple, how is this considered NOT a difficult password? [LetMELoGN2MACrumors]
 
Man talk about over reaction..you guys reveal more than enough information through Facebook and other companies. You are seriously niave if you think tech companies like Yahoo, Microsoft and Google really give two turds about your rights to confidentiality. I remember these three immediately trying to save faced by trying to deny they willingly worked with the NSA prism program.

Even multi-(b)million dollar companies like Sony don't care about your credit card info or using modern encryption to protect customers. look at the PSN hack a few years ago, these jackasses left potentially millions of credit card numbers exposed and account passwords unencrypted. The month downtime was supposedly server maintenance only to find out they had hidden the real problem of a security breach and didn't inform the affected for days after.

Then Sony changed their terms of service in order to prevent users fom suing them in the future because apparently it's ok to half ass the credit card storage and passwords for millions of people.

.....anyway

I mean really what info here is so important that could potentially ruin your life? I know it would be the end of the world for some of you to lose your macrumor account to some scum hacker but I bet 95% of you already give social media sites this information.

You want true security and privacy then computers aren't for you.

I am not saying lack of security is fine, in fact I think these companies that hold true value like credit cards full names and social security numbers should be heavily fined on the basis of how much the company made during the year and take a third of the profit as a fine for failure to accurately.

It's actually pretty damn scary the way the internet works now that it is so tightly integrated with people. On a related subject this is a big reason why cloud services are a joke (amount having to rent space instead of buying it outright and giving companies your personal data. I really really hope these services don't take off they are bad news.
 
Last edited:
I'm thinking about 1password. Do I have to buy the iPhone/iPad/Mac app seperately? Or buying it at one place give me access throughout?

I want to have all my passwords synced through all devices

Thanks
 
NoooooooooooOOOOOooooo, now someone might after a lot of trouble find my favorited porn movies :D

Hope they at least have some fun then after all that trouble;)
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back