Data Breach Update: One of the hackers has come forward

Post anything related to the game here!

Data Breach Update: One of the hackers has come forward

Postby SirRainbowTortoise » Fri Jan 04, 2019 8:52 am

Original post from the hacker: https://www.reddit.com/r/TownofSalemgame/comments/acdnsc/data_breach_what_actually_happened_edited/

I am writing this to clear up what actually happened during the breach because there is a lot of misinformation going around and this "hack" was a lot simpler than everyone thinks it is. I was there in the group call helping export the database while we had admin account access.

TL;DR = Admin password reuse + phpBB being shitty forum software

You know what we did? We literally looked up the usernames of admins in data breaches. Sure enough, an admin and the site owner reused passwords and we logged in.

<DATA REMOVED>

Above are the credentials we used. phpBB being the shitty forum software it is, allows anyone with an admin account to export the entire database. However, we ran into a little issue. The theme had a bug causing the database export not to work. We kept trying to figure out what was wrong, but we couldn't because we didn't have enough phpBB knowledge. We tried selecting new themes, but it still didn't work. After that, we got another buddy who knows a method and gave him the credentials. He was about to work his magic, but unfortunately the admin credentials were reset by the admins themselves. Why? Because we selected a theme, forgot about it and left it enabled. It's kinda funny since the theme was a pretty nice custom theme, but for some reason, the owner prefers to use the default phpBB theme which to me is very stupid. I saw some users make memes about it as well which was hilarious.

The above incident happened on December 13th 2018. Our friend silently did his own work days to weeks earlier. The admins clearly knew about it because they reset their credentials and saw the theme change. On top of this, the admin panel doesn't allow logs to be erased. This means that the admins should've seen about 4 logins from different TOR IPs, but yet they chose not to do anything until some retard gave the database to DeHashed/HIBP.

Anyway, so you might be wondering, if the admins reset credentials, how did you breach the database? Well, we talked about this to a different friend and it turns out, he did the same thing that we did, but a few days prior to our logins. Unlike us, this guy knows phpBB well. I will not say exactly how it was done, but it's possible to make a theme that will backdoor the server. He did just that and got access to the entire server on which the database was stored. He downloaded all the files, including the database. He gave us the database for free and said he sold a few copies for $500 BTC each to others.

Just like most phpBB databases, the structure of this one is: Username:Email:IP:Hash. I have no idea why people are saying there are md5 hashes in it, because there aren't. Every hash is a phpass hash. These hashes are kinda annoying to decrypt, but they certainly aren't too hard. Personally, I decrypted 2 million out of 7.6 million hashes.

These credentials have been excellent for trying against many games and we've made tens of thousands from checking these combos and selling copies of the database. The disclosure was too late, we've already made swift use of the credentials. We don't care about your Town Of Salem accounts, those are of no value whatsoever to us, we care about other sites.

Also, I should add that we do have addresses of some users who paid (Hey admins, check your wordpress account)

Here is a data sample:

<DATA REMOVED>

The above data is from the address logs. I will also post a data sample from the actual phpBB database everyone is speaking of:

<DATA REMOVED>

There was no big server breach, you literally reused passwords and used a shitty forum software which allows database exporting and server access via theme exploits. Literally all you have to do is just not reuse passwords and use semi-decent software. Wait no, scratch that. If you didn't reuse passwords, none of this would've happened. But using better forum software would be nice anyway. phpBB? What is this, 2005? Use Xenforo. It looks very nice, you can make great themes and it's modern. On top of this, it's very secure. Just find how to migrate your database to Xenforo. Being lazy will cause your data to get leaked.

I made this to clear up all the bullshit spreading around. This data breach was super easy and frankly we're very surprised that everyone thinks it was some super big hacker shit. Any ol' script kiddie could've done this.

Moral of the story: If you own a multi-million game company, don't reuse passwords and for Christ's sake, use modern forum software instead of outdated crap.

EDIT: I meant MODULES, not a THEME. Some module shit was installed by my friend which is how the breach was done. (My phpBB knowledge is minimal, but I know it was 100% done via admin credentials + admin panel)
SirRainbowTortoise
Newbie
Newbie
 
Posts: 2
Joined: Tue Apr 28, 2015 12:49 pm

Re: Data Breach Update: One of the hackers has come forward

Postby TheDebil » Sat Jan 05, 2019 7:07 am

they always come up with bullshit like this
"well don't do that it's bad im just teaching you"
to give themselves a moral highground when there is nothing
Image
User avatar
TheDebil
St. Patrick's 2019 Winner
St. Patrick's 2019 Winner
 
Posts: 212
Joined: Sat Nov 18, 2017 11:16 am
Location: dog, GMT +2

Re: Data Breach Update: One of the hackers has come forward

Postby jucktropy » Sat Jan 05, 2019 8:29 am

It's Time To Hack BACK! 8-)
This is Me Teeeeeeeee

Spoiler: Ranked Elo 2500 Fav Town/NE Roles:
Investigator,Jester,Jailor,Transporter,VampireHunter,Witch

Fav Mafia/Coven/NK Roles:
Godfather,Blackmailer,Consort,WereWolf,Necromancer,PotionMaster

Spoiler: stertlitza
Image
User avatar
jucktropy
St. Patrick's 2019 Winner
St. Patrick's 2019 Winner
 
Posts: 96
Joined: Mon Mar 27, 2017 9:31 am
Location: Mars

Re: Data Breach Update: One of the hackers has come forward

Postby GuardianOverkill » Sat Jan 05, 2019 8:47 am

See this is all well and good.

But how do you say phpBB is “shitty forum software” and then admit to not having enough knowledge about said software in the same breath?
Bangladesh and Japan established formal diplomatic relations on February 10, 1972.
"He is scaring me again, with his gruff voice and farmer hands."
White Canary wrote:"Put on your Sunday best because we are going to church!"

Kid Flash wrote:"Get your hands off that hard body."
GuardianOverkill
Civilian
Civilian
 
Posts: 64
Joined: Sat May 12, 2018 11:19 am

Re: Data Breach Update: One of the hackers has come forward

Postby ThisIsDark » Sat Jan 05, 2019 6:48 pm

Are you retarded?

Something doesn't have to be good software for you to not know it.

Cobol is fucking old and outdated and 90% of software devs have no idea about it.
ThisIsDark
Jester
Jester
 
Posts: 12
Joined: Sat Aug 06, 2016 6:05 pm

Re: Data Breach Update: One of the hackers has come forward

Postby Magnasword2 » Sat Jan 05, 2019 7:30 pm

Yeah this forum software is extremely out of date. I do wish they'd fix it but past has shown these developers are adverse to change as if it's something to be scared of. Turns out that might have been good in terms of the game. I've seen some Social deduction games get bad raps for changing things too often.

But yeah. It's time the system was updated. I mean even the devs have to admit it's better than facing a massive legal case after player info was taken and stolen.
https://www.youtube.com/user/magnasword2evo
twitch.tv/magnasword2

Youtuber,Streamer and lover of all strategy games

Names in game: Too many to count.
User avatar
Magnasword2
Benefactor
Benefactor
 
Posts: 526
Joined: Wed Mar 12, 2014 4:32 pm
Location: Stockton-on-tees, UK

Re: Data Breach Update: One of the hackers has come forward

Postby ICECLIMBERS » Sat Jan 05, 2019 9:11 pm

xenforo is good
User avatar
ICECLIMBERS
[Forum Mafia VII] Winner
[Forum Mafia VII] Winner
 
Posts: 3134
Joined: Wed Nov 19, 2014 11:50 pm
Location: Eastern Time

Re: Data Breach Update: One of the hackers has come forward

Postby ICECLIMBERS » Sat Jan 05, 2019 9:33 pm

the biggest tragedy is that the hacker thought that the dark theme is good
User avatar
ICECLIMBERS
[Forum Mafia VII] Winner
[Forum Mafia VII] Winner
 
Posts: 3134
Joined: Wed Nov 19, 2014 11:50 pm
Location: Eastern Time

Re: Data Breach Update: One of the hackers has come forward

Postby GuardianOverkill » Wed Jan 16, 2019 6:35 pm

ThisIsDark wrote:Are you retarded?

Something doesn't have to be good software for you to not know it.


Calm down, fool. You obviously lack the comprehension skills necessary to comprehend the adult language being used here.

You can't say you don't have enough data to evaluate something immediately after you tried to evaluate it.
Bangladesh and Japan established formal diplomatic relations on February 10, 1972.
"He is scaring me again, with his gruff voice and farmer hands."
White Canary wrote:"Put on your Sunday best because we are going to church!"

Kid Flash wrote:"Get your hands off that hard body."
GuardianOverkill
Civilian
Civilian
 
Posts: 64
Joined: Sat May 12, 2018 11:19 am

Re: Data Breach Update: One of the hackers has come forward

Postby Ben4lyfe » Wed Jan 16, 2019 8:54 pm

The hacker, however reasonable his intentions seem, made us all change our passwords and compromised the security of, what could have been hundreds of thousands of users. So he is a dick, even if he did nothing about it. Cost the company a lot of money and risked the security of all of us.
toz means fart in Arabic.

Just thought everyone should know.
User avatar
Ben4lyfe
Benefactor
Benefactor
 
Posts: 103
Joined: Tue Aug 19, 2014 11:13 pm

Re: Data Breach Update: One of the hackers has come forward

Postby kyuss420 » Fri Jan 18, 2019 2:27 am

lmao @ multi million dollar gaming company
goosegoosegoosegoosegoose
Spoiler: Image Spoiler: Image Spoiler: Image
User avatar
kyuss420
Investigator
Investigator
 
Posts: 262
Joined: Sat Aug 19, 2017 1:33 am
Location: Im here

Re: Data Breach Update: One of the hackers has come forward

Postby Helicooler » Fri Jan 18, 2019 1:58 pm

ICECLIMBERS wrote:the biggest tragedy is that the hacker thought that the dark theme is good

you what

Ben4lyfe wrote:The hacker, however reasonable his intentions seem, made us all change our passwords and compromised the security of, what could have been hundreds of thousands of users. So he is a dick, even if he did nothing about it. Cost the company a lot of money and risked the security of all of us.

from what I've heard they only knew how many digits the password was, although I might of been given false info.
Call Me Duck.
Need Anything? PM Me.

COME JOIN HELL!
User avatar
Helicooler
Veteran
Veteran
 
Posts: 446
Joined: Sat Aug 06, 2016 4:55 am
Location: This Forum, Duh! *Laugh Track*

Re: Data Breach Update: One of the hackers has come forward

Postby Ben4lyfe » Fri Jan 18, 2019 9:13 pm

Helicooler wrote:from what I've heard they only knew how many digits the password was, although I might of been given false info.


I believe that even though that was just the information that they were able to gather, that is still more than they should have done and it has cost the company money to send out an e-mail to all of it's users explaining that there has been a breach. They did that because it is the law to do so. It's still a mess that this thing happened in the first place, so we really should not be giving any positive attention to this hacker.
toz means fart in Arabic.

Just thought everyone should know.
User avatar
Ben4lyfe
Benefactor
Benefactor
 
Posts: 103
Joined: Tue Aug 19, 2014 11:13 pm

Re: Data Breach Update: One of the hackers has come forward

Postby kyuss420 » Tue Jan 22, 2019 3:44 am

Fuck this guy, reasonable intentions my arse..... he stole our info and sold it to scammers, probly to support a drug habit. I hope he gets scammed out of every dollar he ever makes and dies alone in the cold. Karma coming back at him X 7 million.

So the devs fucked up.... At least the devs arent selling our info to career criminals
goosegoosegoosegoosegoose
Spoiler: Image Spoiler: Image Spoiler: Image
User avatar
kyuss420
Investigator
Investigator
 
Posts: 262
Joined: Sat Aug 19, 2017 1:33 am
Location: Im here

Data Breach Update One of the hackers has come forward

Postby Timothytak » Tue Jan 29, 2019 8:29 pm

Could I get some examples because when I get voted up and claim Investigator as Consigliere I get guiltied and when Im Investigator people believe me? with no spies
User avatar
Timothytak
Newbie
Newbie
 
Posts: 3
Joined: Sun Jan 27, 2019 12:33 pm
Location: Denmark

Re: Data Breach Update: One of the hackers has come forward

Postby itaicool » Sun Feb 10, 2019 3:50 pm

This site and game security is shit, Of course it doesn't make the hacker right to breach it. But here is the same logic: It's not ok to breach into someone house but just incase you always lock the door. Hell this site even says "Not secure" in red. They need to update their security so things like that won't happen. Some users(Including me) have paid money for this game and it's really bad feeling when something like that happens.
Image
itaicool
Bodyguard
Bodyguard
 
Posts: 237
Joined: Tue Jul 31, 2018 1:15 am

Re: Data Breach Update: One of the hackers has come forward

Postby Derpierknight » Mon Feb 11, 2019 9:46 am

itaicool wrote:This site and game security is shit, Of course it doesn't make the hacker right to breach it. But here is the same logic: It's not ok to breach into someone house but just incase you always lock the door. Hell this site even says "Not secure" in red. They need to update their security so things like that won't happen. Some users(Including me) have paid money for this game and it's really bad feeling when something like that happens.


Paying $$$ For this shit game, lol ur dumb.
Derpierknight
Jester
Jester
 
Posts: 13
Joined: Fri Aug 10, 2018 10:45 am

Re: Data Breach Update: One of the hackers has come forward

Postby id10ts » Mon Feb 11, 2019 5:40 pm

Derpierknight wrote:
itaicool wrote:This site and game security is shit, Of course it doesn't make the hacker right to breach it. But here is the same logic: It's not ok to breach into someone house but just incase you always lock the door. Hell this site even says "Not secure" in red. They need to update their security so things like that won't happen. Some users(Including me) have paid money for this game and it's really bad feeling when something like that happens.


Paying $$$ For this shit game, lol ur dumb.


...he said, furiously rubbing disinfectant into his anal abrasions.
id10ts
Escort
Escort
 
Posts: 77
Joined: Sat Dec 03, 2016 12:08 pm

Re: Data Breach Update: One of the hackers has come forward

Postby eriel9 » Wed Apr 10, 2019 10:06 am

Derpierknight wrote:
itaicool wrote:This site and game security is shit, Of course it doesn't make the hacker right to breach it. But here is the same logic: It's not ok to breach into someone house but just incase you always lock the door. Hell this site even says "Not secure" in red. They need to update their security so things like that won't happen. Some users(Including me) have paid money for this game and it's really bad feeling when something like that happens.


Paying $$$ For this shit game, lol ur dumb.


Just keep sitting on that high horse of your saved money instead of spending it on something that you enjoy like we did.
Image
Make food your friend, not your enemy
My dragons exist here until I figure out something better to put.
Image
Image
User avatar
eriel9
Jester
Jester
 
Posts: 13
Joined: Sat Aug 06, 2016 11:23 am


Return to Town of Salem Discussion

Who is online

Users browsing this forum: No registered users and 3 guests