Have I been hacked here?

[Fred Bloggs]

Did you ever log on to CUK from a computer other than your own?

Not since about end of April when I would previously log in on a work computer but that was also only used by me. Recently, only my laptop and my android tablet have been used. Both auto log me in.

[vwdan]

What's stored is the MD5 hash of the logged in user's password. It's extremely difficult to recover the password from the hash alone.

I've passed Fred Blogg's concern to admin.

Pure MD5 is a piece of piss to reverse nowadays.

[NotAllThere]

Pure MD5 is a piece of piss to reverse nowadays.

I don't have access to any admin functions so I can't say for user but it's likely to be at least double MD5 with salt.

[administrator]

Cheers for the heads up NAT, only just seen your PM. I have had a couple of these come through recently:

Subject: MyName - ******

I am well aware ****** one of your password. Lets get straight to the purpose. Not one person has compensated me to investigate about you. You do not know me and you are probably thinking why you are getting this mail?

In fact, I installed a software on the X video clips (porn) web site and there's more, you visited this website to experience fun (you know what I mean). While you were viewing videos, your internet browser began working as a Remote Desktop with a key logger which provided me accessibility to your display screen as well as webcam. Immediately after that, my software program gathered every one of your contacts from your Messenger, Facebook, as well as e-mailaccount. Next I made a double video. 1st part displays the video you were viewing (you've got a nice taste : )), and 2nd part shows the recording of your web cam, yea it is u.

You have not one but two options. We will read up on each of these choices in details:

1st option is to neglect this email. In this situation, I most certainly will send your actual tape to each of your your contacts and also visualize concerning the shame you will definitely get. And definitely in case you are in an affair, just how it will certainly affect?

Latter choice will be to give me $6000. Let us refer to it as a donation. As a result, I most certainly will immediately erase your videotape. You will continue on with your daily life like this never happened and you would never hear back again from me.

You will make the payment via Bitcoin (if you do not know this, search for "how to buy bitcoin" in Google search engine).

BTC Address: 196V1q5ewBcDxTfeiTGdbQYBtNZWseM7g5
[case-SENSITIVE, copy and paste it]

In case you are looking at going to the police, okay, this email cannot be traced back to me. I have dealt with my moves. I am also not looking to charge you so much, I just want to be rewarded. I've a unique pixel within this email, and at this moment I know that you have read this email message. You now have one day to pay. If I do not get the BitCoins, I will certainly send out your video recording to all of your contacts including close relatives, coworkers, and so on. However, if I do get paid, I will erase the recording right away. It's a non-negotiable offer that being said please do not waste my personal time & yours by responding to this message. If you really want proof, reply with Yup! then I definitely will send your video recording to your 12 contacts.=

The desire to watch porn died with my boyish good looks and the elasticity of my sack so I know it's a scam. Plus I never use that six digit unsecure password any more. The one site that I know of that was hacked that used that email and password combo was LinkedIn - are you sure you didn't have the same combo on there, Fred? Go to https://haveibeenpwned.com/ and see what sites your email address was grabbed from, some of the email addresses I use online have been grabbed from a big collection of 711 million record cache found on a server in the Netherlands, if yours is in that dump then it could have been got from here.

As others have said, this site definitely doesn't have plain text passwords - but the encryption is easy to bust so if someone got the DB then your details could have been nabbed.

Hand on heart I have never seen a full on break in to the forum in the whole time that I have hosted it. I have had a couple of client sites (Wordpress) that only had the admin accounts on them zipped up and downloaded via WeShare or some other tulipe. Usually there are tell-tale signs when you are hackable, some will just pinch all the details but others will run spam through the server or use it to host DoS attacks etc, so when you are that vulnerable you tend to get hit more than once, I have never seen anything like this with the forum. Nothing ever written to the filesystem, no amended files etc. So while I am not saying that the DB hasn't been pinched at some time I am not aware of it ever having happened or I would have told you about it, to secure your passwords if nothing else. They do say the best hackers leave no trace though...

I have all the sites I run in Git repos and every so often I download the production sites over the top and run git status to see if any of the files have changed and to put user generated content in to the repo as a back up method. Like I said, nothing on the forum has led me to believe it has been compromised at any time.

[administrator]

Had a bit of think about this, I know some people are ultra careful and will use a wildcard email address and sign up to places like this with things like cuk@ or cukforum@ - so did a quick wildcard query on the email records in the user database on the forum and checked 10 of them on https://haveibeenpwned.com/ - they have all come up as having never been hacked. And the oldest record I checked was from 2005. So I am claiming not guilty for loss of data. On this occasion

[Fred Bloggs]

Thanks. I am guessing the LinkedIn connection is most likely. I use it daily. By the sound of it CUK is unlikely to have been compromised. I will change my details at LinkedIn. Cheers.

Edited to add - At one point, yes the password would have been the same as here and LinkedIn. I did change the password now that I think about it but at LinkedIn, but not here. It would be historical data then, most likely from a leak at LinkedIn published on one of the sources you identified.

[Fred Bloggs]

Thanks to admin, I have determined that indeed it is either LinkedIn or Avast where my data has been leaked to.

As I said, thinking about it, my LinkedIn in password was changed and two factor authentication enabled. I am wondering now if I ought to dump my Gmail account? Obviously, the password on there is unique and I have two factor authentication enabled, but I really do not want anyone poking around in the associated Gdrive, photos etc. Should I dump my Gmail account?

Thanks again, this has been very enlightening for me. I take identity theft seriously, hence my tightening up my LinkedIn and Facebook accounts, not using real data where possible etc.

To be honest, my biggest concern on line is companies house and the data held there.

[Lance]

Thanks for thoughts. Though cannot be a key logger? I haven't keyed my PW in for ages, CUK auto logs me in. I immediately deleted the mail, but yes, passwords are changed. Edited to add - It was gmail that had automatically sent the mail to the spam folder, if that is of any significance.

there's some new malware that extracts passwords from your browser. I've not read into it too much yet as been busy.

https://www.us-cert.gov/ncas/alerts/TA18-201A

[administrator]

Thanks to admin, I have determined that indeed it is either LinkedIn or Avast where my data has been leaked to.

As I said, thinking about it, my LinkedIn in password was changed and two factor authentication enabled. I am wondering now if I ought to dump my Gmail account? Obviously, the password on there is unique and I have two factor authentication enabled, but I really do not want anyone poking around in the associated Gdrive, photos etc. Should I dump my Gmail account?

Thanks again, this has been very enlightening for me. I take identity theft seriously, hence my tightening up my LinkedIn and Facebook accounts, not using real data where possible etc.

To be honest, my biggest concern on line is companies house and the data held there.

I wouldn't dump the Gmail account, it will create you work you don't really need IMO. You can check logins to your Google account and see what devices have accessed your content and from what locations so worth having a look at that. My Google account always emails me if I log in from somewhere new as well so unless you have had an alert of that nature then I would assume that you have not been compromised at all.

The issue came about when LI got hacked, this was an early one I signed up with and just used my usual 6 character password that I also used on Facebook and lots of other sites at the time, I now use random ones for every site I use and a password manager to remember them all. Sounds like you were the same, LI was originally hacked in 2012 according to the hibp site, encrypted passwords but no salt so short, dictionary words etc were quickly cracked. The new development of these emails, and I must admit to a sneaking admiration to whoever came up with it, is just using that LI dump to email people with the password they had at that time with the hope that a few suckers will cough up.

So, unless you some extremely filthy phots of yourself that would kill you if they got into the public realm, then I would not worry about changing your Gmail account, even if at some point it had the same password as here and your LI account. Mind you, if you do have photos that you don't ever want to get compromised, or anything else that is so sensitive that you would worry about anyone else ever seeing it, the best thing is to never put it anywhere near a web server at all. Ever.

[vwdan]

Had a bit of think about this, I know some people are ultra careful and will use a wildcard email address and sign up to places like this with things like cuk@ or cukforum@ - so did a quick wildcard query on the email records in the user database on the forum and checked 10 of them on https://haveibeenpwned.com/ - they have all come up as having never been hacked. And the oldest record I checked was from 2005. So I am claiming not guilty for loss of data. On this occasion

Guilty! And you're right, it's clean