lfnetwork.com mark read register faq members calendar

Thread: LF security breach
Thread Tools Display Modes
Post a new thread. Add a reply to this thread. Indicate all threads in this forum as read. Subscribe to this forum. RSS feed: this forum RSS feed: all forums
Old 08-21-2011, 03:35 PM   #1
stoffe
Network Caretaker
 
stoffe's Avatar
 
Status: Administrator
Join Date: Apr 2002
Posts: 5,833
Helpful! 10 year veteran! Notable contributor 
LF security breach

It came to our attention a couple of days ago when some friendly neighborhood hacker paid a visit with a stolen supermod account, that Lucasforums had a security breach that resulted in at least parts of its usernames and passwords being downloaded, including the login/password of a few staff members.

As far as I've been able to determine this breach seems to have happened over 3 years ago, before the forum was upgraded, though at least some of the account information stolen at the time is still valid.

From what I've been able to determine after a couple of days of frantic searching and code reading the SQL injection security vulnerability exploited to do this is no longer present in the version of vBulletin we currently use. I've also taken a few extra security precautions just in case.

The Blog feature has been disabled until I've had the time to check it thoroughly for vulnerabilities as well. No time table on how long that will take, but from what I've seen it wasn't used that much anyway, so it's pretty low priority at this point.

So, if you haven't changed your password in a while, now would probably be a good time to do it, just to be safe.

Apologies for the downtime over the past few days, but I felt it was better to play it safe and take the forum offline until this could be more thoroughly investigated and remedied.
stoffe is offline   you may: quote & reply,
Old 08-21-2011, 03:44 PM   #2
Bob Lion54
Jr. Malkavian Detective
 
Bob Lion54's Avatar
 
Join Date: Jan 2005
Location: On the case! Both my minds!
Posts: 2,103
Forum Veteran Helpful! 
Damnit! What is it lately with these hackers?!

Good to know you are on it, stoffe! Thanks for the great work you do to keep these forums going!

I am a bit sad to see that I won't be able to not blog for a while, though, but I wasn't in a great hurry to not blog anyway. Still, hopefully it doesn't turn into too big a hassle for you.


Bob Lion54 is offline   you may: quote & reply,
Old 08-21-2011, 04:34 PM   #3
Liverandbacon
I'm only worth a piano?
 
Liverandbacon's Avatar
 
Join Date: Feb 2005
Posts: 651
Forum Veteran LF Jester Folder extraordinaire 
Quote:
Originally Posted by Bob Lion54 View Post
Damnit! What is it lately with these hackers?!
It happened over 3 years ago.

Oh well, I'm glad it got resolved, and luckily my account here has never contained information that would cause any big problems for me if used or spread across the internet.



--Too Dumb to Quit--
Liverandbacon is offline   you may: quote & reply,
Old 08-21-2011, 04:57 PM   #4
Bob Lion54
Jr. Malkavian Detective
 
Bob Lion54's Avatar
 
Join Date: Jan 2005
Location: On the case! Both my minds!
Posts: 2,103
Forum Veteran Helpful! 
Quote:
Originally Posted by Liverandbacon View Post
It happened over 3 years ago.
Oh, well it's alright then.


Bob Lion54 is offline   you may: quote & reply,
Old 08-21-2011, 05:19 PM   #5
mimartin
TOR ate my KotOR
 
mimartin's Avatar
 
Status: Super Moderator
Join Date: Dec 2004
Location: Texas
Posts: 6,049
Current Game: TOR/FO:NV
Imperialist Meatbags Guild Officer The Walking Carpets Guild Officer Alderaan News Holopics contributor 
stoffe has about every badge imaginable on the forum, but she deserves a forum savior badge. She goes above and beyond to keep the place running and everyone that enjoys hanging around this place owes her a debt of gratitude. She regularly gives up her weekends and sleep keeping that place afloat. stoffe does most of her work out of sight, but she in my opinion is the most important staff member only important staff member… well besides lynk.

So please help her out by changing your password to something more complicated than…cat.

Last edited by mimartin; 08-21-2011 at 10:17 PM.
mimartin is offline   you may: quote & reply,
Old 08-21-2011, 07:08 PM   #6
Q
The one who knocks
 
Q's Avatar
 
Join Date: May 2006
Location: ABQ
Posts: 6,643
Current Game: Mowing down neos with my M60
LF Jester Forum Veteran Helpful! 
3 years ago? Wow. Was it found by mistake?

Thanks, stoffe.


"They should rename the team to the Washington Government Sucks. Put Obama on the helmet. Line the entire walls of the stadium with the actual text of the ACA.
Fix their home team score on the board to the debt clock, they can win every game 17,000,000,000,000 to 24. Losing team gets taxed by the IRS 100%, then droned."
-Toker
Q is offline   you may: quote & reply,
Old 08-21-2011, 07:25 PM   #7
Darth Avlectus
Your point?
 
Darth Avlectus's Avatar
 
Join Date: Dec 2006
Location: Attack on Titan
Posts: 4,255
Current Game: Soul Calibur 5
You know, I suspected something like this was going on but I had no way to prove it. I don't believe I ever used anything on here that would cause much a security concern. But um, yeah.

Thanks Stoffe. I hardly ever agree with mim anymore on a lot of things but yeah. I think there ought to be a Forum Savior badge specially made and given to her.


"I cant see S***! --YOU GO TO HELL!" --Tourettes guy
Darth Avlectus is offline   you may: quote & reply,
Old 08-21-2011, 08:29 PM   #8
mimartin
TOR ate my KotOR
 
mimartin's Avatar
 
Status: Super Moderator
Join Date: Dec 2004
Location: Texas
Posts: 6,049
Current Game: TOR/FO:NV
Imperialist Meatbags Guild Officer The Walking Carpets Guild Officer Alderaan News Holopics contributor 
Quote:
Originally Posted by GTA:SWcity View Post
I hardly ever agree with mim anymore on a lot of things but yeah.
Just proves; Even a blind squirrel finds a nut once in a while.
mimartin is offline   you may: quote & reply,
Old 08-21-2011, 09:02 PM   #9
purifier
Forumite
 
purifier's Avatar
 
Join Date: Apr 2009
Location: DisneyLand
Posts: 721
LF Jester 
Quote:
Originally Posted by mimartin View Post
Just proves; Even a blind squirrel finds a nut once in a while.
Well now that depends...which nut are we talking about here?


*Ahem!*

Anyway, I agree with Mimartin and GTA, she deserves a Forum Savior Badge. Good job Stoffe and everyone else that was involved, helping her.


SITH HAPPENS
purifier is offline   you may: quote & reply,
Old 08-21-2011, 09:45 PM   #10
Ulmont
Junior Member
 
Ulmont's Avatar
 
Join Date: Apr 2008
Location: Earth (Fight for her)
Posts: 383
Current Game: Natural Selection 2
Veteran Fan Artist Veteran Modder Helpful! 
Great job finding this! (Even it it was a bit late)

Four's company, you deserve a badge.





Last edited by Ulmont; 08-21-2011 at 09:51 PM.
Ulmont is offline   you may: quote & reply,
Old 08-22-2011, 01:07 PM   #11
acdcfanbill
..the wonders I have seen
 
acdcfanbill's Avatar
 
Status: Super Moderator
Join Date: Jun 2001
Location: Random Hell Wholes around the
Posts: 5,698
Imperialist Meatbags Guild Member The Walking Carpets Guild Member LFN Staff Member 10 year veteran! 
We believe the user database dump is 3+ years old. The 'hack' was recent in that an smod account was used by a 3rd party for some suspicious purposes.

acdcfanbill is offline   you may: quote & reply,
Old 08-23-2011, 11:09 AM   #12
Darth Avlectus
Your point?
 
Darth Avlectus's Avatar
 
Join Date: Dec 2006
Location: Attack on Titan
Posts: 4,255
Current Game: Soul Calibur 5
Quote:
Originally Posted by mimartin View Post
Just proves; Even a blind squirrel finds a nut once in a while.
Hmm, hunting aspirations for a blind rodent that is essentially a scavenger... I have a pretty good guess at the source of that bad taste in your mouth.


"I cant see S***! --YOU GO TO HELL!" --Tourettes guy
Darth Avlectus is offline   you may: quote & reply,
Old 08-23-2011, 03:37 PM   #13
Lynk Former
internet hate machine
 
Lynk Former's Avatar
 
Status: Administrator
Join Date: Sep 1999
Location: Australia
Posts: 18,978
10 year veteran! The Walking Carpets Guild Officer Imperialist Meatbags Guild Officer LF Jester 
Quote:
Originally Posted by GTA:SWcity View Post
You know, I suspected something like this was going on but I had no way to prove it.
That's stupid.

Lynk Former is offline   you may: quote & reply,
Old 08-23-2011, 06:03 PM   #14
Darth Avlectus
Your point?
 
Darth Avlectus's Avatar
 
Join Date: Dec 2006
Location: Attack on Titan
Posts: 4,255
Current Game: Soul Calibur 5
Quote:
Originally Posted by Lynk Former View Post
That's stupid.
Why is that stupid? I was referring to how the blog section recently kept getting the same sort of crap about "watches carpets houses cars jewelry". I suspected it all from the same spammer source based on its appearance and substance--which apparently doesn't mean much evidence wise. Not until people are getting hurt anyway.


"I cant see S***! --YOU GO TO HELL!" --Tourettes guy
Darth Avlectus is offline   you may: quote & reply,
Old 08-23-2011, 06:11 PM   #15
Lynk Former
internet hate machine
 
Lynk Former's Avatar
 
Status: Administrator
Join Date: Sep 1999
Location: Australia
Posts: 18,978
10 year veteran! The Walking Carpets Guild Officer Imperialist Meatbags Guild Officer LF Jester 
Spambots and hackers are two entirely different things.

Lynk Former is offline   you may: quote & reply,
Post a new thread. Add a reply to this thread. Indicate all threads in this forum as read. Subscribe to this forum. RSS feed: this forum RSS feed: all forums
Go Back   LucasForums > Network > Forum Help & Feedback Center > LF security breach

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -4. The time now is 08:08 PM.

LFNetwork, LLC ©2002-2011 - All rights reserved.
Powered by vBulletin®
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.