Firstones Server: Dreamhost Hacked

Comments

• Stingray Elite Ranger

  January 2012

  So all this hoopla to tell us that nothing happened?
  
  Thanks... I guess. Nothing to see, move along.
• WORF The Burninator

  January 2012

  After a potential security breach, nothing to see strikes me as a good thing.
• Stingray Elite Ranger

  January 2012

  Considering that all computers connected to the internet are being probed automatically and continuously for security breaches by bots, I'm not sure how this is relevant.
  
  That's like telling us we didn't get sick today because our immune system fought off a virus or a pesky germ.
  
  I suppose that's a good thing, but hardly worth crying wolf about or putting up an ad in the Wall Street Journal.
  
  The folks at DreamHost did their job and all appears to be ok. Unless Anonymous is targeting FirstOnes!! :nervous:
• Random Chaos Actually Carefully-selected Order in disguise

  January 2012

  Stingray, per Dreamhost:
  
  [QUOTE]Our Security and Software teams have been investigating if any customer sites, apps or blogs have been affected as a result of the intrusion. As yet we have not identified any major issues – potentially as a result of the swift action to force a password reset.[/QUOTE]
  
  That statement means that while they have seen nothing yet, it doesn't mean there is nothing. The whole point is we need to keep our eyes open too because something could have gotten inside.
• sinclair Ranger

  January 2012

  I continue to trust that the Firstones forum passwords are protected with appropriate manner.
• Lord Refa Creepy, but in a good way

  January 2012

  Run to the hills! Its the borg! They are working for ******* and after our precious bodily fluids!
  
  Damn space communists!
• Stingray Elite Ranger

  January 2012

  :D
• Random Chaos Actually Carefully-selected Order in disguise

  January 2012

  Sinclair: I wouldn't trust password security on any forum, any website.
  
  vBulletin, the most popular forum software (and that which we use) stores passwords with an MD5 hash. Unfortunately MD5 is a really insecure and easily cracked storage engine that dates from 1991. There are a ton of open source tools to exploit weaknesses in the methodology. However, actually reversing a password is fairly hard (mainly because multiple passwords result in the same hash). Additionally, to start you have to get the database. vBulletin does a good job of preventing that, with good code auditing and security measures. Most likely and exploit to get the database would have to come through other software on the same server, or a server compromised through a means other than the web.
  
  Generally if you're looking for security of your database passwords, you want to store passwords with SHA-2 (generally SHA256 or better), which was developed in 2006 as the result of security holes found in SHA1, which itself was a replacement for MD5 and its security holes.
  
  AES is acceptable for password storage, but AES is an encryption not a hash, so if you know the key you can read the password.
  
  --
  
  You may be wondering about other bulletin boards. The most common open source board is PHPBB. Unfortunately PHPBB takes security as a secondary idea, and their code is full of tons of SQL vulnerabilities. It is the most hacked bulletin board around, often resulting in server compromise. No idea what password hash they use, though.
  
  Hope this helps!
• sinclair Ranger

  January 2012

  By appropriate I meant the best possible method the software allows.
  
  I understand what you mean about the passwords, thus I leave Firefox to remember those for me. Most of the passwords are gibberish, some very clear and even easy. Easy because I don't like to check my password wallet when logging in outside my home computer.
  
  The password basically just protects one thing, the email.. Even though it can be fetched directly from the database as well if its not encrypted...
  
  But I've taken some measures to cover the email. The email which I use is protected by three levels with all different passwords.
  
  Level 3 = Some made account with message forwarding.
  Level 2 = Other account with message forwarding
  Level 1 = The email I use.
  Level 0 = COE (Continuity plan of E-mail)
  
  Level1 email is only provided to those which I can trust, basically network banking and related services. All the other messaging happens either via Level2 or Level3, which both levels have multiple different mailboxes. Eventually everything just leads into one.
  
  "Losing" one of level3 or 2 email address to bad guys is not a world end. Losing Level1 account would cause direct harm, thus Level 0 is maintained for emergency situations. A copy, with slightly different email address.
  
  Purpose for all of this, I suppose I was just bored that day.
• Random Chaos Actually Carefully-selected Order in disguise

  January 2012

  I used to use a different email for every website. Now I use a different email for each block of several websites.
  
  There are reasons why:
  
  1. Each site with a unique email address lets me identify if that site allowed my email address to be mined, or they sold it improperly. So far, I have had no corporation sell my email address outside their privacy policy, which is damned good in the 10+ year period I've been doing this.
  
  2. By having a different email address for each website, not only do you have to know what my password is, but since many websites login username is your email address, an attacker also has to know which email address I associated with that website.
  
  In all cases, these are forwarding emails to my main account.
• Stingray Elite Ranger

  January 2012

  I know people who use a different pen for every character they write. :D
  
  [URL="http://www.youtube.com/watch?v=cj2Gwb-Ph2g"]And no, they are not insane.[/URL] ;)
  
  Talk about security!