Shit's Borked

hookemATL · July 10

10 minutes ago, Born Burnt said:

Not even an @ to credit me for the inspo?

Born Burnt · July 10

17 minutes ago, hookemATL said:

Not even an @ to credit me for the inspo?

TOR · July 10

21 minutes ago, Born Burnt said:

Them tittays...

farmersnotfighting · July 10

3 hours ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here.

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened.

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables.

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc.

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely.

@Rimbo

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up.

Can you force MFA on all the admin accounts to the Admin CP?
Didn't check what version of Invision this is, but there's exploit PoC for a SQLi out for versions 4.7.15 and under that involves resetting the admin account password. Let me know if you want any more details on the CVE or if you want me to test it tomorrow.

immamac · July 10

22 minutes ago, farmersnotfighting said:

Can you force MFA on all the admin accounts to the Admin CP?
Didn't check what version of Invision this is, but there's exploit PoC for a SQLi out for versions 4.7.15 and under that involves resetting the admin account password. Let me know if you want any more details on the CVE or if you want me to test it tomorrow.

yes. and we were on 4.7.15 and updated today.

TOR · July 10

Can you force EXWIFE not to be such a b1tch?

That version of crazy redhead has exploits, but I heard there was a patch.

Parliament · July 10

Did I forget to pay my tree fiddy? No not seeing new posts.

immamac · July 10

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it.

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account.

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.

TOR · July 10

We can have fun with this.

immamac · July 10

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password.

TOR · July 10

Sooo, my 'password' password is OK?

immamac · July 10

4 minutes ago, TOR said:

Sooo, my 'password' password is OK?

Should be fine.

royiv · July 10

14 minutes ago, immamac said:

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password.

Can you get some guys through the Aggy network to protect from this stuff?

TOR · July 10

4 minutes ago, royiv said:

Can you get some guys through the Aggy network to protect from this stuff?

IS THAT A PLEDGE PIN?!

TheBryMan81 · July 10

8 minutes ago, royiv said:

Can you get some guys through the Aggy network to protect from this stuff?

I hear Karen Key Largo knows some nice friendly Asians that do all of her computer- stuff that she can recommend

TheBryMan81 · July 10

50 minutes ago, immamac said:

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it.

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account.

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.

How do I enable 2FA on mobile? Not finding it in the settings

immamac · July 10

3 minutes ago, TheBryMan81 said:

How do I enable 2FA on mobile? Not finding it in the settings

Security. Under account settings. Same place as the PII request up top.

F250 · July 10

6 hours ago, Biff Tannen said:

Dude let’s be honest. You could make up just about anything here and 95% of this board, myself included, would just nod along like, “yeah fine, I mean, whatever you gotta do, I don’t know what the hell is going on here.”

I'm not sure he does either. lulz

Never trust an administrator to successfully run DFIR.

F250 · July 10

46 minutes ago, immamac said:

The encrypted password table was accessed, but still requires cracking

Bro, this is Incident Response 101. No fucking shit the attacker is going to start cracking passwords. You should have raised this flag a lot earlier.

If anyone has the same password here that they use with the email they registered with that might contain personal data. Change your fucking password now.

immamac · July 10

Just now, F250 said:

Bro, this is Incident Response 101. No fucking shit the attacker is going to start cracking passwords. You should have raised this flag a lot earlier.

If anyone has the same password here that they use with the email they registered with that might contain personal data. Change your fucking password now.

Not using password as your password is also pretty obvious and it's not even been 12 hours since the breach. Its ultimately on me that the breach happened, but you need to chill out. I have been transparent and active on this all day and I'm still up running through shit to make sure things aren't just going to get fucked again.

Michael Knight · July 10

Is this all cause you banned derka?

F250 · July 10

13 minutes ago, immamac said:

Not using password as your password is also pretty obvious and it's not even been 12 hours since the breach. Its ultimately on me that the breach happened, but you need to chill out. I have been transparent and active on this all day and I'm still up running through shit to make sure things aren't just going to get fucked again.

Not trying to be a dick but there are probably users here that registered with their personal email and some probably use the same password which puts their personal data at risk. I've seen this happen more times than I can count. This can have real world consequences.

Passwords are easy to crack and don't require a lot of hardware to do so. Standard complex passwords 10 characters and under can be cracked within the time frame you mentioned.

An immediate notification to change passwords should have happened hours ago.

Phase six of DFIR is lessons learned. Once again, not trying to be a dick but next time alert the community sooner.

52-80 · July 10

3 hours ago, immamac said:

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password.

How do we know this is the admin speaking and not the unsophisticated hacker?

farmersnotfighting · July 10

5 hours ago, immamac said:

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it.

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account.

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.

Classic.

Edited July 10 by farmersnotfighting

immamac · July 10

5 hours ago, F250 said:

Not trying to be a dick but there are probably users here that registered with their personal email and some probably use the same password which puts their personal data at risk. I've seen this happen more times than I can count. This can have real world consequences.

Passwords are easy to crack and don't require a lot of hardware to do so. Standard complex passwords 10 characters and under can be cracked within the time frame you mentioned.

An immediate notification to change passwords should have happened hours ago.

Phase six of DFIR is lessons learned. Once again, not trying to be a dick but next time alert the community sooner.

I didn't say anything about being a dick. I said you needed to chill out, stirring people up into a panic doesn't help them make rational decisions it freaks them out and makes them do stupid shit. Change your password, use security features made available to you, analyse the PII that could have been impacted and act like an adult.

Panic would introduce another attack vector. The actor made a follow on attack on a weak account with the password of literally "password". They are obviously still attacking the site and I was obviously still monitoring the situation very closely.

Upgrayedd · July 10

If I can’t remember my password should I ask the Inchworm guys?

immamac · July 10

3 minutes ago, Upgrayedd said:

If I can’t remember my password should I ask the Inchworm guys?

I laughed.

Captainant · July 10

6 hours ago, immamac said:

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password.

Definitely rotating my password and enabling 2FA, but out of curiosity did you salt your PW table? Its not gonna stop a rainbow table attack against the dumped PW's but it would buy a little time for getting things rotated.

Also, would you ever consider adding an OIDC or SAML federation option? It'd be one fewer piece of authentication that you would need to worry about in a breach

PvilleStang · July 10

So how long until Surly sits behind a WAF and all API access is cut?

Also, can you set up federated SSO access between Ashley Madison accounts and Surly. I feel like that might be the most secure method.

Pimphand · July 10

7 hours ago, immamac said:

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password.

I really want to know how in 2024 people don't use Bitwarden.....

TreatyOak · July 10

Did it!

Can everyone please avoid using the password texasextralong#2024

It's no longer available.

52-80 · July 10

If you’re the *real* immamac, name all 300 of hitby’s socks.

Vegas64 · July 10

6 hours ago, F250 said:

Not trying to be a dick but there are probably users here that registered with their personal email and some probably use the same password which puts their personal data at risk. I've seen this happen more times than I can count. This can have real world consequences.

Passwords are easy to crack and don't require a lot of hardware to do so. Standard complex passwords 10 characters and under can be cracked within the time frame you mentioned.

An immediate notification to change passwords should have happened hours ago.

Phase six of DFIR is lessons learned. Once again, not trying to be a dick but next time alert the community sooner.

People would use a real personal email and not their spam email account to sign up? Never dawned on me. Do you people use your real email for coupons and services as well?

JMFP · July 10

58 minutes ago, Upgrayedd said:

If I can’t remember my password should I ask the Inchworm guys?

I should of screenshotted it but I saw the post Inchworm made when they announced they broke in. First reply was "would you delete some posters? I'll pm you a list."

Viper · July 10

2 minutes ago, JMFP said:

I should of screenshotted it but I saw the post Inchworm made when they announced they broke in. First reply was "would you delete some posters? I'll pm you a list."

there's always a silver lining

markstanco · July 10

13 hours ago, UTGrad98 said:

Time to watch for any credit cards popping up under my name i guess.

@immamac is paying for Life Lock for all of us for a year.

miguelito · July 10

Per the instructions, my password is now "password2FA". Am I good to go?

Js1 · July 10

8 hours ago, immamac said:

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it.

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account.

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.

Fine, I changed my password.

But I am not doing 2FA, I am so tired of this bullshit for EVERYTHING.

Ps, on mobile, I was logged out after changing my password on desktop and the ads block the sign in button at the button.

immamac · July 10

14 minutes ago, JMFP said:

I should of screenshotted it but I saw the post Inchworm made when they announced they broke in. First reply was "would you delete some posters? I'll pm you a list."

They dropped the user table first. Then a few minutes later they dropped every table.

Dropping a table makes the data delete in an irrecoverable manner. There is no undelete button on databases so the data poofed out of existence and the tables and their metadata were emptied out.

It's really a bummer that the Invision folks knew about this and didn't disclose it in the updates and didn't put it in the release notes as a major security update. I always make sure to install those the day they are released. I hadn't installed this update because quite frankly the upgrade path for this software leaves a lot to be desired including mandatory downtime > 8 minutes and it being completely unable to rollback if it fails. It makes permantly borking the site a real possibility every upgrade.

They are coming out with version 5 soon which is supposed to be a major rewrite. I'm hoping they fixed some pretty glaring architectural issues they have in the software.

I'm still monitoring the situation closely, but the attack is confirmed to match the exact SQLi that was published in a POC for the CVE. This has been patched and outside of the actor reaching out via an account with the username "password" there hasn't been another successful attempt using the same method

gofuckyourself · July 10

I'm keeping my password. It's also "gofuckyourself"

That way when hackers find it and read it, I get 'em. Hoo boy, I get 'em good.

immamac · July 10

3 minutes ago, Js1 said:

Fine, I changed my password.

But I am not doing 2FA, I am so tired of this bullshit for EVERYTHING.

Ps, on mobile, I was logged out after changing my password on desktop and the ads block the sign in button at the button.

I'm aware, the ads are dismissable, but there's no other way to have an anchor unit not be ultra intrusive to the content. Thanks for the feedback though.

The safest thing to do without 2fa is set your password to something like 28 characters long. Then never use it and just sign in with Google, MSFT, discord. Those services are hardened authentication providers that use oauth2 implementations instead of passwords.

52-80 · July 10

30 minutes ago, Vegas64 said:

People would use a real personal email and not their spam email account to sign up? Never dawned on me. Do you people use your real email for coupons and services as well?

The best opsec is not using a fake identity. The best opsec is assuming the identity of a real person you dislike.

My email is kentonpaulino@yahoo.com

Jerry Callo · July 10

I would like a prorated refund of my July treefiddy tithe. Also, I am not happy about having to change my password from 2yutes.

Thanks @immamac for your shit unborking.

Buzzrock · July 10

Eh, AT&T already leaked all my personal info to the dark web so who cares.

PvilleStang · July 10

12 minutes ago, Buzzrock said:

Eh, AT&T already leaked all my personal info to the dark web so who cares.

This. At least they're stuck with the Equifax identity monitoring bill.

G650 · July 10

8 hours ago, immamac said:

Should be fine.

Where is 2FA in settings? The Google Authenticator?

immamac · July 10

1 minute ago, G650 said:

Where is 2FA in settings? The Google Authenticator?

yeah, or the security questions.

farmersnotfighting · July 10

1 hour ago, Captainant said:

Definitely rotating my password and enabling 2FA, but out of curiosity did you salt your PW table? Its not gonna stop a rainbow table attack against the dumped PW's but it would buy a little time for getting things rotated.

Also, would you ever consider adding an OIDC or SAML federation option? It'd be one fewer piece of authentication that you would need to worry about in a breach

salting is literally to stop a rainbow attack lol. but nobody sits around with rainbow tables anymore since basically everything is salting by default now. invision community moved from md5 which is fucking awful (164,000,000,000 password guesses per second on a 4090) to blowfish (184,000,000 guesses/second) for the hashing algorithm.
if you use a shit password like Summer2024! or Password1! or something that's on a common password list (check here: https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases ) then consider your username/email address and password compromised. make sure you don't reuse that password for any other site.

in general, use MFA where possible. and if you're too lazy to do that, make sure you have different passwords for every site that are randomly generated. no you aren't clever using "Password.Surly". if i see your email and "password.linkedin" or "password.gmail" or "password.facebook" in a breach, i'm damn sure gonna try "password.surly" if i'm targeting you.

but use a password manager like lastpass or 1pass to generate and keep track of your passwords for different sites. they have browser addons and phone apps so you can auto fill shit too.

immamac · July 10

1 minute ago, farmersnotfighting said:

salting is literally to stop a rainbow attack lol. but nobody sits around with rainbow tables anymore since basically everything is salting by default now. invision community moved from md5 which is fucking awful (164,000,000,000 password guesses per second on a 4090) to blowfish (184,000,000 guesses/second) for the hashing algorithm.
if you use a shit password like Summer2024! or Password1! or something that's on a common password list (check here: https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases ) then consider your username/email address and password compromised. make sure you don't reuse that password for any other site.

in general, use MFA where possible. and if you're too lazy to do that, make sure you have different passwords for every site that are randomly generated. no you aren't clever using "Password.Surly". if i see your email and "password.linkedin" or "password.gmail" or "password.facebook" in a breach, i'm damn sure gonna try "password.surly" if i'm targeting you.

but use a password manager like lastpass or 1pass to generate and keep track of your passwords for different sites. they have browser addons and phone apps so you can auto fill shit too.

Thanks for the post

gofuckyourself · July 10

11 minutes ago, G650 said:

Where is 2FA in settings? The Google Authenticator?

It's a new AI "call and response" video overlay of a Max Headroom-esque Immamac which will now guide you safely into the site.

It delivers an initial video word prompt, requiring you to speak the correct second word response in order to gain access.

"Dick" -- you of course respond "BUTT!" -- note that it must be yelled loud enough for the computer Max/Imma to hear you.

Fit -- LUMP!

Now -- THIS!

OU -- SUCKS!

Etc. Ironclad authorization in the modernest and surliest method.

Sign In

Shit's Borked

Recommended Posts

hookemATL 11712

Link to comment

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Popular Posts

immamac

hookemATL

immamac

Posted Images

Born Burnt 6177

Link to comment

Share on other sites

TOR 5533

Link to comment

Share on other sites

farmersnotfighting 97

Link to comment

Share on other sites

immamac 42838

Link to comment

Share on other sites

TOR 5533

Link to comment

Share on other sites

Parliament 14251

Link to comment

Share on other sites

immamac 42838

Link to comment

Share on other sites

TOR 5533

Link to comment

Share on other sites

immamac 42838

Link to comment

Share on other sites

TOR 5533

Link to comment

Share on other sites

immamac 42838

Link to comment

Share on other sites

royiv 9280

Link to comment

Share on other sites

TOR 5533

Link to comment

Share on other sites

TheBryMan81 2509

Link to comment

Share on other sites

TheBryMan81 2509

Link to comment

Share on other sites

immamac 42838

Link to comment

Share on other sites

F250 28766

Link to comment

Share on other sites

F250 28766

Link to comment

Share on other sites

immamac 42838

Link to comment

Share on other sites

Michael Knight 12977

Link to comment

Share on other sites

F250 28766

Link to comment

Share on other sites

52-80 19148

Link to comment