Are we exposed?
- Thread starter ncted
- Start date
- Latest activity Latest activity:
- Replies 36
- Views 3K
- Status
I don't see SatelliteGuys, but AVS seems affected.
You can check your exposure here: https://www.leakedsource.com/
You can check your exposure here: https://www.leakedsource.com/
I doubt it considering that they used earlier versions of Vbulletin for the hack and this site runs XenForo.
Nope (Thank God!) Another great vBulletin bug...
In fact the security issues that software had (and them not fixing them) was one of the MAIN reasons why we moved to XenForo.
In fact the security issues that software had (and them not fixing them) was one of the MAIN reasons why we moved to XenForo.
AVS has posted something but has not admitted they were hacked.
http://www.avsforum.com/forum/305-s...-security-update-all-members-please-read.html
http://www.avsforum.com/forum/305-s...-security-update-all-members-please-read.html
Holy crap... here are the new AVS Password requirements.... (Which does NOTHING to fix the vBulletin security issues)
Must be at least 10 characters
Must contain lower-case characters
Must contain upper-case characters
Must contain numbers
Must contain symbols
10 characters? Come on folks its a forum not a bank.
10 characters? Come on folks its a forum not a bank.
Holy crap... here are the new AVS Password requirements.... (Which does NOTHING to fix the vBulletin security issues)
Must be at least 10 characters
Must contain lower-case characters
Must contain upper-case characters
Must contain numbers
Must contain symbols
10 characters? Come on folks its a forum not a bank.
While true, password reuse is such a problem that even low-risk sites should start treating people like banks do to make sure they are using strong passwords. Of course, keeping your passwords in an md5 hash makes it a moot point.
The compromise was limited to verticalscope.com sites (magazine websites) that were suspected of having stored their user data in a single database. Having hashes for multiple sites can make cracking passwords a whole lot easier.
Whether the passwords are un-salted MD5 or bcrypt, they can be cracked -- its just a matter of time (days per password given the latest technology). If the hackers aren't allowed to get their hands on the user data, they can't crack the passwords therein.
Whether the passwords are un-salted MD5 or bcrypt, they can be cracked -- its just a matter of time (days per password given the latest technology). If the hackers aren't allowed to get their hands on the user data, they can't crack the passwords therein.
I had forgotten I had an AVS Forum account. I haven't been there in almost five years. At least I now have a new password! It looked like they are also implementing a one-year maximum password lifetime.
Yeah, password complexity does make it harder to crack, but with modern credential management systems like LastPass or Apple's KeyChain, having unique passwords for each and every site is much easier to live with.
Yeah, password complexity does make it harder to crack, but with modern credential management systems like LastPass or Apple's KeyChain, having unique passwords for each and every site is much easier to live with.
They still have not acknowledged the breach just sent out new passwords
And they sent out the new passwords along with the username of the user out in email via plain text. Another big security boo boo, that shows me they don't know what they are doing.
Sent from my iPhone using SatelliteGuys mobile app
And they sent out the new passwords along with the username of the user out in email via plain text. Another big security boo boo, that shows me they don't know what they are doing.
Sent from my iPhone using SatelliteGuys mobile app
It gets a bad rep because of the nature of what it does, but that doesn't mean it is not a safe site to visit. If it loads in Google Chrome, it is probably safe. From the WOT reviews:
"It is a good site, the purchasable features are legit you DO get what you pay for, the reason this site has a bad review i because of the nature of the site, it is based around stealing passwords"
Holy crap... here are the new AVS Password requirements.... (Which does NOTHING to fix the vBulletin security issues)
Must be at least 10 characters
Must contain lower-case characters
Must contain upper-case characters
Must contain numbers
Must contain symbols
10 characters? Come on folks its a forum not a bank.
I do that with all my passwords and 97% of them are different at each site that requires a username and/or password. I try to keep my usernames unique to each site too and I also use a multiple e-mail system that puts up some additional roadblocks.
I really should try out something like LastPass. I am one of those people that re-uses passwords more than I should. However, I do use 2 factor authentication whenever available.
I have thought about trying LastPass in the past but I didn't like the idea of putting all of my account passwords in one central location on the internet. It seems like they would be a high priority target for hackers just because of what they are storing. It sounds like LastPass has a very good track record with this and they have their own 2 factor authentication so someone doesn't automatically get all of your passwords even if the get your LastPass master password.
I do have an AVS Forum account so I guess today is as good a day as any to sign up for LastPass and start changing all my passwords.
Last year I was using one, I think it was called 1pass or something like that...
Stopped using it when they got hacked themselves.
Stopped using it when they got hacked themselves.
It seems likely that the forum passwords are separate and apart from the magazine site passwords (used primarily for commenting on articles). They claim 600+ sites in their ranks. I can't imagine they could have a common database for hundreds of forums given the complexity of the data stored and the frequent accesses (not just a one-and-done cookie deposit).
Grrr™ The Ford Escape Forum reset everybody's passwords (since they were exposed like most other Car Owner forums). So, I've reset my password there, again, since they didn't check to see when your password was last changed. Thanks, hackers, for making the on-line world just that much annoying for no valid reason.
- Status
