Author Topic: CHANGE YOUR PASSWORDS ASAP (Read 11615 times)

dgneo · « **on:** Tue, 20 December 2016, 08:11:08 »

A rash of accounts have been compromised over at r/mk, with some flowing over to here. LSB, jchan, mklovin/chucklingcumquat, rpeterclark. mklovin's paypal was also compromised.

This site was SSL'less for a little while, it's possible someone sniffed the traffic during logins at that time.

https://www.reddit.com/r/MechanicalKeyboards/comments/5jd62r/hue_hue_hue_hue_d/

Probable list of compromised accounts.

https://geekhack.org/index.php?action=profile;u=52917

MkLovin's compromised profile (scanning the QR code provides the script kiddie's public key).

Change your passwords to something unique from other sites, and strong.

xondat · « **Reply #1 on:** Tue, 20 December 2016, 08:13:39 »

+1 rep

LunarisDream · « **Reply #2 on:** Tue, 20 December 2016, 08:13:48 »

+1 rep

joey · « **Reply #3 on:** Tue, 20 December 2016, 08:15:15 »

Changed my password to **************.

FrostyToast · « **Reply #4 on:** Tue, 20 December 2016, 08:17:00 »

Can't fool me.
I tell people my password so it doesn't get compromised by these attacks.

Lokomotivet · « **Reply #5 on:** Tue, 20 December 2016, 08:20:41 »

12345horse

rainb1ood · « **Reply #6 on:** Tue, 20 December 2016, 08:25:19 »

changing pass now

rpeterclark · « **Reply #7 on:** Tue, 20 December 2016, 08:28:27 »

Yikes, I'm on that list! Fortunately, I use a password manager, so I'm pretty sure that was a single use password. Changing it...

/edit ****, looks like my account over there was deleted or disabled or something. I can't sign in and trying to reset the password tells me that my username no longer exists.

dgneo · « **Reply #8 on:** Tue, 20 December 2016, 08:33:55 »

Quote from: rpeterclark on Tue, 20 December 2016, 08:28:27

Yikes, I'm on that list! Fortunately, I use a password manager, so I'm pretty sure that was a single use password. Changing it...

/edit ****, looks like my account over there was deleted or disabled or something. I can't sign in and trying to reset the password tells me that my username no longer exists.

Get in touch with Reddit Admins as soon as you can. They should be able to assist with this, provide the links I did above as further proof.

Moistgun · « **Reply #9 on:** Tue, 20 December 2016, 08:57:50 »

Dgneo the protector

joey · « **Reply #10 on:** Tue, 20 December 2016, 09:01:23 »

Quote from: Moistgun on Tue, 20 December 2016, 08:57:50

Dgneo the protector

His job as IT admin is leaking through to GH.

Moistgun · « **Reply #11 on:** Tue, 20 December 2016, 09:18:01 »

Quote from: joey on Tue, 20 December 2016, 09:01:23

Quote from: Moistgun on Tue, 20 December 2016, 08:57:50
Dgneo the protector
His job as IT admin is leaking through to GH.

I always thought he was dancer

catweewee · « **Reply #12 on:** Tue, 20 December 2016, 09:18:12 »

Quote from: rpeterclark on Tue, 20 December 2016, 08:28:27

Yikes, I'm on that list! Fortunately, I use a password manager, so I'm pretty sure that was a single use password. Changing it...

/edit ****, looks like my account over there was deleted or disabled or something. I can't sign in and trying to reset the password tells me that my username no longer exists.

Was your password the same for both sites?

Nevermind you used a password manager.

romevi · « **Reply #13 on:** Tue, 20 December 2016, 09:20:50 »

Whew, laddy. Changed.

ruiqimao · « **Reply #14 on:** Tue, 20 December 2016, 09:24:23 »

It's not likely that this was an attack based on GH's lack of SSL. Here's why:

The only account we know of that was compromised on GeekHack was MkLovin. We also know that rpeterclark uses different passwords for Reddit and GeekHack, meaning that the attack was targeted towards Reddit users. MkLovin's GH and PayPal accounts can be explained with password reuse (MkLovin = ChucklingKumquat, for those who don't know).

As of right now, what I consider to be most likely is a social engineering attack, such as phishing. We can ask the victims if they've logged into "Reddit" recently to confirm or disprove this theory.

Basically, change your passwords and don't type passwords into websites without making sure the website is what you think it is.

livingspeedbump · « **Reply #15 on:** Tue, 20 December 2016, 09:32:50 »

Also use different PW on different site. All my other sites seem to be intact. No PP issues. use 2FA there.

Changed all PW just to be safe though.

SpAmRaY · « **Reply #16 on:** Tue, 20 December 2016, 09:36:28 »

Changed my GH password just in case.

HoffmanMyster · « **Reply #17 on:** Tue, 20 December 2016, 09:41:36 »

Oofta. :-/ Thanks for the heads up, dgneo.

tp4tissue · « **Reply #18 on:** Tue, 20 December 2016, 09:57:11 »

OH NOOooooooooooooooooooooooo!!!!!!!!!!

It's Rootwyrm aagain....

tp4tissue · « **Reply #19 on:** Tue, 20 December 2016, 10:01:41 »

wait... you mean REDDIT was compromised?

Not gh right ?

rpeterclark · « **Reply #20 on:** Tue, 20 December 2016, 10:04:51 »

Update!

I contacted the address that dgneo suggested and they got back to me promptly. I was able to recover the account and set up a new password.

I really don't know how it could have been compromised. I have not re-signed into reddit in forever, it just remembers me. My GH password is unique, so it wasn't related to the recent SSL stuff here. I use a password manager and I'm pretty sure the reddit account was unique as well, but I'm doubting myself a little because I can't imagine how else it could have been accessed, except it it had been a reused password from some old leak. :-/

ruiqimao · « **Reply #21 on:** Tue, 20 December 2016, 10:08:43 »

Quote from: tp4tissue on Tue, 20 December 2016, 10:01:41

wait... you mean REDDIT was compromised?

Not gh right ?

Everything points to nothing being compromised. Just a few unlucky individuals that might've clicked a bad link.

SpAmRaY · « **Reply #22 on:** Tue, 20 December 2016, 10:08:55 »

Could this be related to the recent yahoo breach??

rpeterclark · « **Reply #23 on:** Tue, 20 December 2016, 10:15:07 »

It's odd how it was so targeted at well known names in the community. It doesn't seem possible that random leaks from other sites could have been used to locate the reddit credentials for this specific group of people at r/mk. It's all very weird.

tp4tissue · « **Reply #24 on:** Tue, 20 December 2016, 10:52:09 »

Quote from: ruiqimao on Tue, 20 December 2016, 10:08:43

Quote from: tp4tissue on Tue, 20 December 2016, 10:01:41
wait... you mean REDDIT was compromised?

Not gh right ?

Everything points to nothing being compromised. Just a few unlucky individuals that might've clicked a bad link.

This is exactly what the h4(k3rz want us to think..

tp4tissue · « **Reply #25 on:** Tue, 20 December 2016, 10:52:59 »

Quote from: rpeterclark on Tue, 20 December 2016, 10:15:07

It's odd how it was so targeted at well known names in the community. It doesn't seem possible that random leaks from other sites could have been used to locate the reddit credentials for this specific group of people at r/mk. It's all very weird.

Hahhahahaa.. it's a good thing Tp4 = Destitute..

livingspeedbump · « **Reply #26 on:** Tue, 20 December 2016, 11:27:37 »

Got my reddit account back.

tp4tissue · « **Reply #27 on:** Tue, 20 December 2016, 11:35:41 »

Quote from: livingspeedbump on Tue, 20 December 2016, 11:27:37

Got my reddit account back.

did they stealz the $4 from ur paypal ?

zzyjayfree · « **Reply #28 on:** Tue, 20 December 2016, 16:29:31 »

I use a real good pw for anything involves my damn money : P

Sent from my iPhone using Tapatalk

rowdy · « **Reply #29 on:** Tue, 20 December 2016, 19:59:08 »

Quote from: SpAmRaY on Tue, 20 December 2016, 10:08:55

Could this be related to the recent yahoo breach??

Are you on reddit?

SpAmRaY · « **Reply #30 on:** Tue, 20 December 2016, 20:35:37 »

Quote from: rowdy on Tue, 20 December 2016, 19:59:08

Quote from: SpAmRaY on Tue, 20 December 2016, 10:08:55
Could this be related to the recent yahoo breach??

Are you on reddit?

Yes.

livingspeedbump · « **Reply #31 on:** Tue, 20 December 2016, 20:47:25 »

Quote from: tp4tissue on Tue, 20 December 2016, 11:35:41

Quote from: livingspeedbump on Tue, 20 December 2016, 11:27:37
Got my reddit account back.

did they stealz the $4 from ur paypal ?

The fact that I had $4 in my PP at the time makes this creepy.

And yeah, the yahoo breach did come to mind, but again, who knows.

tp4tissue · « **Reply #32 on:** Tue, 20 December 2016, 22:05:04 »

Quote from: livingspeedbump on Tue, 20 December 2016, 20:47:25

Quote from: tp4tissue on Tue, 20 December 2016, 11:35:41
Quote from: livingspeedbump on Tue, 20 December 2016, 11:27:37
Got my reddit account back.

did they stealz the $4 from ur paypal ?

The fact that I had $4 in my PP at the time makes this creepy.

And yeah, the yahoo breach did come to mind, but again, who knows.

Coreda · « **Reply #33 on:** Tue, 20 December 2016, 22:39:46 »

Is it even possible to remotely sniff non-SSL traffic on a network that isn't compromised? I know it can be done locally via packet sniffers like Wireshark.

Seems like there are other ways their accounts may have been stolen. At first I thought it was GH that was affected so I changed my pw here

tp4tissue · « **Reply #34 on:** Tue, 20 December 2016, 22:42:42 »

Quote from: Coreda on Tue, 20 December 2016, 22:39:46

Is it even possible to remotely sniff non-SSL traffic on a network that isn't compromised? I know it can be done locally via packet sniffers like Wireshark.

Seems like there are other ways their accounts may have been stolen. At first I thought it was GH that was affected so I changed my pw here

what if the remote sniffer was injected into that aquakeytest that we host here..

They know the keyboard people can't resist aquakeytest..

Selthor · « **Reply #35 on:** Tue, 20 December 2016, 23:28:09 »

Quote from: SpAmRaY on Tue, 20 December 2016, 10:08:55

Could this be related to the recent yahoo breach??

If they reused their passwords it could be. Keep in mind though, the Yahoo breach was not recent. It happened in 2013, and was only recently disclosed to the public.

fanpeople · « **Reply #36 on:** Wed, 21 December 2016, 00:03:23 »

I don't know about anyone else but I set my Papal a while ago to require a text message code to log on with. If you have money in there its probably a good idea to do this.

Das where I keep all my Mercian dollars.

thatsmrdoctortoyou · « **Reply #37 on:** Wed, 21 December 2016, 00:25:24 »

Quote from: fanpeople on Wed, 21 December 2016, 00:03:23

I don't know about anyone else but I set my Papal a while ago to require a text message code to log on with. If you have money in there its probably a good idea to do this.

Das where I keep all my Mercian dollars.

This is brilliant! I wasn't aware Paypal offered this service. Just added this to my account for sure

Fire Brand · « **Reply #38 on:** Wed, 21 December 2016, 04:42:47 »

Ohh so was this why my reddit account was locked yeterday, wonders why I got email saying they locked it due to suspicious activity

joey · « **Reply #39 on:** Wed, 21 December 2016, 04:43:47 »

Quote from: Fire Brand on Wed, 21 December 2016, 04:42:47

Ohh so was this why my reddit account was locked yeterday, wonders why I got email saying they locked it due to suspicious activity

Nah, you're just a suspicious dude.

Fire Brand · « **Reply #40 on:** Wed, 21 December 2016, 04:59:48 »

Quote from: joey on Wed, 21 December 2016, 04:43:47

Quote from: Fire Brand on Wed, 21 December 2016, 04:42:47
Ohh so was this why my reddit account was locked yeterday, wonders why I got email saying they locked it due to suspicious activity
Nah, you're just a suspicious dude.

Maybe but apparently I'm from China and Azerbaijan now

ygor · « **Reply #41 on:** Wed, 21 December 2016, 05:09:07 »

Blerg.

xtrafrood · « **Reply #42 on:** Wed, 21 December 2016, 06:47:59 »

Huh, I completely forgot that I have a Reddit account. Apparently, my last login was ten months ago $:-\$

tp4tissue · « **Reply #43 on:** Wed, 21 December 2016, 08:42:05 »

Quote from: csmertx on Wed, 21 December 2016, 06:47:59

Huh, I completely forgot that I have a Reddit account. Apparently, my last login was ten months ago $:-\$

Tp4 has a reddit account.. but i forgot the password..

DanielT · « **Reply #44 on:** Wed, 21 December 2016, 08:58:13 »

Reddit .... the source of all evil ....

Quote from: tp4tissue on Wed, 21 December 2016, 08:42:05

Tp4 has a reddit account.. but i forgot the password..

You're not missing much

livingspeedbump · « **Reply #45 on:** Wed, 21 December 2016, 09:17:38 »

Quote from: fanpeople on Wed, 21 December 2016, 00:03:23

I don't know about anyone else but I set my Papal a while ago to require a text message code to log on with. If you have money in there its probably a good idea to do this.

Das where I keep all my Mercian dollars.

Yeah, I use 2FA anytime I possibly have the option.

tp4tissue · « **Reply #46 on:** Wed, 21 December 2016, 13:10:41 »

Quote from: livingspeedbump on Wed, 21 December 2016, 09:17:38

Quote from: fanpeople on Wed, 21 December 2016, 00:03:23
I don't know about anyone else but I set my Papal a while ago to require a text message code to log on with. If you have money in there its probably a good idea to do this.

Das where I keep all my Mercian dollars.

Yeah, I use 2FA anytime I possibly have the option.

Tp4 haz p00r people cellphone service..

Cricket doesn't allow paypal shortcode sms..

rowdy · « **Reply #47 on:** Wed, 21 December 2016, 19:59:07 »

Quote from: SpAmRaY on Tue, 20 December 2016, 20:35:37

Quote from: rowdy on Tue, 20 December 2016, 19:59:08
Quote from: SpAmRaY on Tue, 20 December 2016, 10:08:55
Could this be related to the recent yahoo breach??

Are you on reddit?
Yes.

Hope you got it in time.

I'm not on Reddit, and use a different password for each site anyway.

rowdy · « **Reply #48 on:** Wed, 21 December 2016, 19:59:35 »

Also should this be in Site Announcements in case people miss it in off topic?

katushkin · « **Reply #49 on:** Fri, 23 December 2016, 18:21:26 »

Jagex blocks your password! Look: **********

News:

Author Topic: CHANGE YOUR PASSWORDS ASAP (Read 11615 times)