Password reset: 45 million creds leak from popular .com forums

complex

Are they system generated passwords issued to new users and then never changed (or the user accounts were simply fake and never used)?

Are they MD5 collisions?

Automated Registrations - Bots

Ok, I am now leaning towards this being more a case of the forums managed here are just drowned in bot registrations.

A quick search for yagjecc826 (as an example) points to lots of password dumps with user names like:

brigiduuihleinu

valerydrighettid

christelfcostinef

Further checks associate these passwords / usernames with gmail accounts such as:

brig.idu.uihlen44@gmail.com

e.lz.a.h.w.an.g.32@gmail.com

li.nn.i.ed.0s6@gmail.com

d.el.ain.a.a.ho.60@gmail.com

l.y.n.n.sr9.8@gmail.com

cl.ai.r.eti.m.3.sa.i@gmail.com

This strongly points towards the forums being swamped with bazillions of bot-users.

Hi, it's 18atcskd2w here...

Who's taking my name in vain?

Reported this to AG publically on one of their forums they run with UK coverage yesterday and their whole attitude seems completely meh and are blaming it on a 3rd party plugin. I'm not that bothered I'm in the dump because I don't reuse passwords so meh myself.

They've half heartedly started to run through a password reset proceedure today and they've managed to reset mine and not tell me the new credentials. That's one way to shut up exposure!

What gets me the most is this breach happened in feb 2016, and yet now only after public prompting are they even telling people to reset their passwords. And they are not even advising people to reset them elsewhere. Lackluster response so far...

One of the forums I'm active on was breached. The company (Verticle Scope if you are interested) controls multiple forums (they went on a buying splurge starting a few years ago) and they have not contacted any of their forum users with the breach news (and they've known for quite awhile now) and they are not resolving the base issue of poorly secured registration db's. Fail.

Probably...

Due to the number, this has to do with an application poorly written to provide a 10 digit password which is semi-complex, for either initial registration or password reset.

I'd go with the latter, if the programmer was lazy. Instead of putting in a random generator to come up with something complex to add it to the database, send out an email, etc. He used a wordlist of around 20-30 preset passwords, which probably rotated.

This is why you have an independent person check out code before release!

Statement On one of the affected forums

I'm a member of CBRXX.com which is a VerticalScope Forum and the following was posted there by "Admin" last night

+++++++

Hey Team,

Over the 2 weeks we will be implementing some changes to our forum password strength and password expiration policies. To make sure you continue having the best experience possible on the community, we regularly monitor the site and the Internet to keep everyone's account information safe. We've recently become aware of a potential risk to some accounts coming from outside of this community. Just to be safe, we are implementing the following changes to improve security even further:

1) We are asking everyone to change their passwords (and will force a onetime reset). Along with every user on the forum, new passwords will need to be more complex, and can't be simple words (sorry, you can't have "fluffy" as your password anymore!). Please use a password unique to this community. Reusing passwords can expose your account indirectly when other websites (Twitter, Linkedin, Badoo, etc) are compromised; and

2) Your passwords will expire on a 180 day basis. When you login on the 181st day, you will have to change it. You guys and girls all have the highest level of access in our communities and this will help protect your accounts.

All other users on the community will have 365 day expirations. We'll also be sending out an email to users to let them know about the changes, in upcoming weeks.

We are testing and rolling out the changes slowly to ensure that they do not cause unforeseen issues with current plug-ins and products on the site, we will let you all know the day before it goes live.

I also ask that you help us with ensuring all users are being heard and we are answering everyone’s questions. We will be posting an announcement up to the community shortly and want to keep all chatter about this issue and any potential security issues in one place. If you see a user talking about this topic in a section outside of the announcement, please either move the post, or remove it and direct the user to the original thread. We greatly appreciate your help in this. If you have any questions please post them below.

Thanks all,

Helena Barclay

Community Management

http://www.cbrxx.com/site-help-suggestions-comments/29182-attention-security-issue.html