advertisement


The Steve Hoffman forum looks to have been hacked

Tony L

Tony L

Administrator
Currently offline and I received an email notification earlier, allegedly from Steve via the forum mail system:

“This website has been hacked, make sure to get better passwords, maybe some 2fa”

As such if you are a member there using a password you use for anything else important I’d suggest changing it right now!

Always scary when this sort of thing happens, I feel sorry for whoever is the forum admin who has to put it right, but hopefully they can get up and running again soon.
 
I go on my teams forum everything on it was changed to chinese writing its happened twice now.
 
Yes, I got the same email. The Steve Hoffman forums sites are still down.

Hopefully, there is not too much damage done and it can be repaired and be back up and running soon. Are the hackers hoping to get a ransom or such? Steve Hoffman Forums are hardly the Bank of England, Wall Street or the FTSE etc.
 
Stuart Frazer said:
Are the hackers hoping to get a ransom or such? Steve Hoffman Forums are hardly the Bank of England, Wall Street or the FTSE etc.
Click to expand...
Sometimes the hack is just to show off that you can...Or to point out a vulnerability, a proper white hat would notify the Admin privately and not show off.

Although these days hacks are usually financially motivated, ‘tis the way of things now
 
If you haven't used a password that you have for anything important I wouldn't worry. Not really sure why someone would target that other than to prove they can.
 
mikemusic said:
That is a *lot* of work to put right
Click to expand...

It depends entirely on what happened, e.g. was it a breach of Xenforo or the (I assume Linux) server? Hopefully it is as simple as applying a server patch, changing some passwords and restoring the whole thing from a backup. As I understand it user Xenforo passwords are encrypted in the MySQL database, I certainly know I can’t access them as site admin. Also bare in mind Steve isn’t an IT guy so he may well be playing it safe with the email announcement whist other try and figure out what exactly has happened (which is actually the hard part). I wish them luck whatever it is. I have to admit this sort of thing is way over my current expertise level, if this site got the same I’d just pay someone to sort it out as I’d not be confident in my own ability to make things fully secure. It is a key reason I pay for a managed server. All I do is the XenForo side, the rest I just buy as a service.
 
There's what appears to be a tweet from Steve which came up on Google saying the forum hasn't been hacked but a moderators account was and he did not send an email.
 
Paraheadache said:
There's what appears to be a tweet from Steve which came up on Google saying the forum hasn't been hacked but a moderators account was and he did not send an email.
Click to expand...

The email was a result of a personal message on the forum from Steve. A PM automatically triggers an email. Fingers crossed he gets things sorted out.
 
Paraheadache said:
There's what appears to be a tweet from Steve which came up on Google saying the forum hasn't been hacked but a moderators account was and he did not send an email.
Click to expand...
...
Stunsworth said:
The email was a result of a personal message on the forum from Steve. A PM automatically triggers an email. Fingers crossed he gets things sorted out.
Click to expand...

I’m pretty sure you need full XenForo admin control panel access to send a bulk email to the whole userbase, i.e. you can’t do it from a moderator account (at least I don’t think you can!).
 
very sad , we lost the cyrusunofficial forum to hackers , totally shut down now with loss of much valuable info
 
why would users need to change their passwords if an admin level hack? most likely an SQL level hack so they might not even have access to user passwords. im not sure i might care even IF someone had my password for that forum ... whats the worst that could happen? assuming its a pw unique to that forum, say?
 
Jonathan said:
whats the worst that could happen? assuming its a pw unique to that forum, say?
Click to expand...
That’s the issue - many folk use stupid simple passwords and the same one or two everywhere...Bit of social engineering and some clever phone calls/emails and you’re onto ID theft.
 
You must log in or register to reply here.


advertisement


Back
Top