Jump to content

Shit's Borked


RPM

Recommended Posts

3 hours ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

Can you force MFA on all the admin accounts to the Admin CP?
Didn't check what version of Invision this is, but there's exploit PoC for a SQLi out for versions 4.7.15 and under that involves resetting the admin account password. Let me know if you want any more details on the CVE or if you want me to test it tomorrow. 

  • Hook 'Em 2
Link to comment
Share on other sites

22 minutes ago, farmersnotfighting said:

Can you force MFA on all the admin accounts to the Admin CP?
Didn't check what version of Invision this is, but there's exploit PoC for a SQLi out for versions 4.7.15 and under that involves resetting the admin account password. Let me know if you want any more details on the CVE or if you want me to test it tomorrow. 

yes. and we were on 4.7.15 and updated today.

  • Hook 'Em 1
Link to comment
Share on other sites

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it. 

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account. 

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.  

 

  • Hook 'Em 1
  • Like 1
  • Fuck Around and Find Out 1
Link to comment
Share on other sites

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password. 

  • Hook 'Em 1
  • Like 1
Link to comment
Share on other sites

14 minutes ago, immamac said:

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password. 

Can you get some guys through the Aggy network to protect from this stuff?

  • Hook 'Em 1
Link to comment
Share on other sites

50 minutes ago, immamac said:

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it. 

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account. 

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.  

 

How do I enable 2FA on mobile? Not finding it in the settings

  • Hook 'Em 1
  • Like 1
Link to comment
Share on other sites

6 hours ago, Biff Tannen said:

Dude let’s be honest. You could make up just about anything here and 95% of this board, myself included, would just nod along like, “yeah fine, I mean, whatever you gotta do, I don’t know what the hell is going on here.”

I'm not sure he does either. lulz

Never trust an administrator to successfully run DFIR.

  • Like 1
Link to comment
Share on other sites

46 minutes ago, immamac said:

The encrypted password table was accessed, but still requires cracking

Bro, this is Incident Response 101. No fucking shit the attacker is going to start cracking passwords. You should have raised this flag a lot earlier.

If anyone has the same password here that they use with the email they registered with that might contain personal data. Change your fucking password now.

  • Hook 'Em 1
Link to comment
Share on other sites

Just now, F250 said:

Bro, this is Incident Response 101. No fucking shit the attacker is going to start cracking passwords. You should have raised this flag a lot earlier.

If anyone has the same password here that they use with the email they registered with that might contain personal data. Change your fucking password now.

Not using password as your password is also pretty obvious and it's not even been 12 hours since the breach. Its ultimately on me that the breach happened, but you need to chill out. I have been transparent and active on this all day and I'm still up running through shit to make sure things aren't just going to get fucked again. 

  • Hook 'Em 7
Link to comment
Share on other sites

13 minutes ago, immamac said:

Not using password as your password is also pretty obvious and it's not even been 12 hours since the breach. Its ultimately on me that the breach happened, but you need to chill out. I have been transparent and active on this all day and I'm still up running through shit to make sure things aren't just going to get fucked again. 

Not trying to be a dick but there are probably users here that registered with their personal email and some probably use the same password which puts their personal data at risk. I've seen this happen more times than I can count. This can have real world consequences.

Passwords are easy to crack and don't require a lot of hardware to do so. Standard complex passwords 10 characters and under can be cracked within the time frame you mentioned.

An immediate notification to change passwords should have happened hours ago.

Phase six of DFIR is lessons learned. Once again, not trying to be a dick but next time alert the community sooner.

  • Hook 'Em 2
Link to comment
Share on other sites

3 hours ago, immamac said:

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password. 

How do we know this is the admin speaking and not the unsophisticated hacker?

  • Fuck Around and Find Out 1
Link to comment
Share on other sites

Posted (edited)
5 hours ago, immamac said:

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it. 

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account. 

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.  

 

Classic. 

Edited by farmersnotfighting
Link to comment
Share on other sites

5 hours ago, F250 said:

Not trying to be a dick but there are probably users here that registered with their personal email and some probably use the same password which puts their personal data at risk. I've seen this happen more times than I can count. This can have real world consequences.

Passwords are easy to crack and don't require a lot of hardware to do so. Standard complex passwords 10 characters and under can be cracked within the time frame you mentioned.

An immediate notification to change passwords should have happened hours ago.

Phase six of DFIR is lessons learned. Once again, not trying to be a dick but next time alert the community sooner.

I didn't say anything about being a dick. I said you needed to chill out, stirring people up into a panic doesn't help them make rational decisions it freaks them out and makes them do stupid shit. Change your password, use security features made available to you, analyse the PII that could have been impacted and act like an adult. 

Panic would introduce another attack vector. The actor made a follow on attack on a weak account with the password of literally "password". They are obviously still attacking the site and I was obviously still monitoring the situation very closely. 

 

  • Hook 'Em 3
Link to comment
Share on other sites

6 hours ago, immamac said:

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password. 

Definitely rotating my password and enabling 2FA, but out of curiosity did you salt your PW table? Its not gonna stop a rainbow table attack against the dumped PW's but it would buy a little time for getting things rotated. 

Also, would you ever consider adding an OIDC or SAML federation option? It'd be one fewer piece of authentication that you would need to worry about in a breach

Link to comment
Share on other sites

7 hours ago, immamac said:

To add further clarification the breach included access to admin views of PII, which is the same view you have by requesting PII from the link here: https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

The encrypted password table was accessed, but still requires cracking. Over time dictionaries are built on the hashing algorithms used and that's what is used to lookup your passwords against, it's possible to crack hashes not in the dictionaries but it takes a lot of compute and is time consuming. Easiest way to make that attack worthless is to just change your password. 

I really want to know how in 2024 people don't use Bitwarden.....
 

 

Link to comment
Share on other sites

6 hours ago, F250 said:

Not trying to be a dick but there are probably users here that registered with their personal email and some probably use the same password which puts their personal data at risk. I've seen this happen more times than I can count. This can have real world consequences.

Passwords are easy to crack and don't require a lot of hardware to do so. Standard complex passwords 10 characters and under can be cracked within the time frame you mentioned.

An immediate notification to change passwords should have happened hours ago.

Phase six of DFIR is lessons learned. Once again, not trying to be a dick but next time alert the community sooner.

People would use a real personal email and not their spam email account to sign up? Never dawned on me. Do you people use your real email for coupons and services as well?

Link to comment
Share on other sites

58 minutes ago, Upgrayedd said:

If I can’t remember my password should I ask the Inchworm guys?

I should of screenshotted it but I saw the post Inchworm made when they announced they broke in. First reply was "would you delete some posters? I'll pm you a list."

  • Hook 'Em 2
  • Haha 3
  • Drool 1
Link to comment
Share on other sites

2 minutes ago, JMFP said:

I should of screenshotted it but I saw the post Inchworm made when they announced they broke in. First reply was "would you delete some posters? I'll pm you a list."

there's always a silver lining 

Link to comment
Share on other sites

8 hours ago, immamac said:

Inchworm speaks! They got what they could and if your password is unsafe or you don't use 2FA I would recommend you enable it. 

Change your passwords as a fairly straightforward way to avoid unauthorized use of your account. 

They successfully cracked the password of "password" and found some other passwords like 123456 etc. using readily available hash dictionaries which cover quite a few passwords.  

 

Fine, I changed my password.

But I am not doing 2FA, I am so tired of this bullshit for EVERYTHING. 

Ps, on mobile, I was logged out after changing my password on desktop and the ads block the sign in button at the button.  

Link to comment
Share on other sites

14 minutes ago, JMFP said:

I should of screenshotted it but I saw the post Inchworm made when they announced they broke in. First reply was "would you delete some posters? I'll pm you a list."

They dropped the user table first. Then a few minutes later they dropped every table. 

Dropping a table makes the data delete in an irrecoverable manner. There is no undelete button on databases so the data poofed out of existence and the tables and their metadata were emptied out. 

It's really a bummer that the Invision folks knew about this and didn't disclose it in the updates and didn't put it in the release notes as a major security update. I always make sure to install those the day they are released. I hadn't installed this update because quite frankly the upgrade path for this software leaves a lot to be desired including mandatory downtime > 8 minutes and it being completely unable to rollback if it fails. It makes permantly borking the site a real possibility every upgrade. 

They are coming out with version 5 soon which is supposed to be a major rewrite. I'm hoping they fixed some pretty glaring architectural issues they have in the software. 

I'm still monitoring the situation closely, but the attack is confirmed to match the exact SQLi that was published in a POC for the CVE. This has been patched and outside of the actor reaching out via an account with the username "password" there hasn't been another successful attempt using the same method

  • Like 1
Link to comment
Share on other sites

3 minutes ago, Js1 said:

Fine, I changed my password.

But I am not doing 2FA, I am so tired of this bullshit for EVERYTHING. 

Ps, on mobile, I was logged out after changing my password on desktop and the ads block the sign in button at the button.  

I'm aware, the ads are dismissable, but there's no other way to have an anchor unit not be ultra intrusive to the content. Thanks for the feedback though. 

The safest thing to do without 2fa is set your password to something like 28 characters long. Then never use it and just sign in with Google, MSFT, discord. Those services are hardened authentication providers that use oauth2 implementations instead of passwords. 

  • Hook 'Em 2
  • Like 1
Link to comment
Share on other sites

30 minutes ago, Vegas64 said:

People would use a real personal email and not their spam email account to sign up? Never dawned on me. Do you people use your real email for coupons and services as well?

The best opsec is not using a fake identity. The best opsec is assuming the identity of a real person you dislike.

My email is kentonpaulino@yahoo.com

  • Haha 1
Link to comment
Share on other sites

1 hour ago, Captainant said:

Definitely rotating my password and enabling 2FA, but out of curiosity did you salt your PW table? Its not gonna stop a rainbow table attack against the dumped PW's but it would buy a little time for getting things rotated. 

Also, would you ever consider adding an OIDC or SAML federation option? It'd be one fewer piece of authentication that you would need to worry about in a breach

salting is literally to stop a rainbow attack lol. but nobody sits around with rainbow tables anymore since basically everything is salting by default now. invision community moved from md5 which is fucking awful (164,000,000,000 password guesses per second on a 4090) to blowfish (184,000,000 guesses/second) for the hashing algorithm.
if you use a shit password like Summer2024! or Password1! or something that's on a common password list (check here: https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases ) then consider your username/email address and password compromised. make sure you don't reuse that password for any other site. 

in general, use MFA where possible. and if you're too lazy to do that, make sure you have different passwords for every site that are randomly generated. no you aren't clever using "Password.Surly". if i see your email and "password.linkedin" or "password.gmail" or "password.facebook" in a breach, i'm damn sure gonna try "password.surly" if i'm targeting you. 

but use a password manager like lastpass or 1pass to generate and keep track of your passwords for different sites. they have browser addons and phone apps so you can auto fill shit too. 

  • Hook 'Em 4
  • Like 1
Link to comment
Share on other sites

1 minute ago, farmersnotfighting said:

salting is literally to stop a rainbow attack lol. but nobody sits around with rainbow tables anymore since basically everything is salting by default now. invision community moved from md5 which is fucking awful (164,000,000,000 password guesses per second on a 4090) to blowfish (184,000,000 guesses/second) for the hashing algorithm.
if you use a shit password like Summer2024! or Password1! or something that's on a common password list (check here: https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases ) then consider your username/email address and password compromised. make sure you don't reuse that password for any other site. 

in general, use MFA where possible. and if you're too lazy to do that, make sure you have different passwords for every site that are randomly generated. no you aren't clever using "Password.Surly". if i see your email and "password.linkedin" or "password.gmail" or "password.facebook" in a breach, i'm damn sure gonna try "password.surly" if i'm targeting you. 

but use a password manager like lastpass or 1pass to generate and keep track of your passwords for different sites. they have browser addons and phone apps so you can auto fill shit too. 

Thanks for the post :)

Link to comment
Share on other sites

11 minutes ago, G650 said:

Where is 2FA in settings? The Google Authenticator?

It's a new AI "call and response" video overlay of a Max Headroom-esque Immamac which will now guide you safely into the site.

It delivers an initial video word prompt, requiring you to speak the correct second word response in order to gain access.

"Dick" -- you of course respond "BUTT!" -- note that it must be yelled loud enough for the computer Max/Imma to hear you.

Fit -- LUMP!

Now -- THIS!

OU -- SUCKS!

Etc. Ironclad authorization in the modernest and surliest method.

  • Haha 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...