# Hacked SDMB **URL:** \ **Category:** About This Message Board\ **Created:** [January 7, 2014, 9:47pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170 "2014-01-07T21:47:45Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 7, 2014, 9:47pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/1 "2014-01-07T21:47:45Z")
Did they get only usernames and passwords? ---
**Author:** ![Peter\_Morris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/peter_morris/32/359_2.png) [@Peter\_Morris](https://boards.straightdope.com/u/Peter_Morris)\ **Post date:** [January 7, 2014, 9:49pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/2 "2014-01-07T21:49:27Z")
Edit - just seen the announcement. ---
**Author:** ![Inner\_Stickler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/inner_stickler/32/318_2.png) [@Inner\_Stickler](https://boards.straightdope.com/u/Inner_Stickler)\ **Post date:** [January 7, 2014, 9:50pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/3 "2014-01-07T21:50:49Z")
If I had to guess, I’d assume they got > [@](#): > > This resulted in the illegal acquisition of message board users’ information, namely usernames, email addresses, and Straight Dope message board passwords. . There’s nothing else really to get except anything you might have in your profile and, of course, your posts. edit: [Link to relevant announcement.](http://boards.straightdope.com/sdmb/announcement.php?f=2) ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 7, 2014, 9:56pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/4 "2014-01-07T21:56:05Z")
I thought they tortured my Mama’s PIN from me when I registered. ---
**Author:** ![ptr2void](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ptr2void/32/3406_2.png) [@ptr2void](https://boards.straightdope.com/u/ptr2void)\ **Post date:** [January 7, 2014, 9:59pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/5 "2014-01-07T21:59:45Z")
So the passwords were hashed, but were they salted and hashed? And were they hashed with a cryptographically strong hash algorithm? Given the age of vBulletin in use here it wouldn’t be surprising to find out they were hashed without a salt and using md5. :rolleyes: ---
**Author:** ![Oakminster](https://avatars.discourse-cdn.com/v4/letter/o/77aa72/32.png) [@Oakminster](https://boards.straightdope.com/u/Oakminster)\ **Post date:** [January 7, 2014, 10:08pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/6 "2014-01-07T22:08:36Z")
Changed my password, as suggested in the announcement. Otherwise, doesn’t really appear to be much to be worried about. The email address associated with my account here has a different password. ---
**Author:** ![snowthx](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowthx/32/10660_2.png) [@snowthx](https://boards.straightdope.com/u/snowthx)\ **Post date:** [January 7, 2014, 10:14pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/7 "2014-01-07T22:14:03Z")
> [@Oakminster](#): > > Changed my password, as suggested in the announcement. Otherwise, doesn’t really appear to be much to be worried about. The email address associated with my account here has a different password. Same here. But, why would someone want to hack this message board, if there is not any financial or personal info stored here? ---
**Author:** ![August\_West](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/august_west/32/18069_2.png) [@August\_West](https://boards.straightdope.com/u/August_West)\ **Post date:** [January 7, 2014, 10:15pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/8 "2014-01-07T22:15:40Z")
Nice, turns out I had an ancient Earthlink email address associated with my account. Maybe I’ll just leave it that way. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [January 7, 2014, 10:15pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/9 "2014-01-07T22:15:49Z")
> [@Oakminster](#): > > Changed my password, as suggested in the announcement. Otherwise, doesn’t really appear to be much to be worried about. The email address associated with my account here has a different password. But is it the same as your Amazon email address/password or any other accounts across the internet? Something nice about Amazon, though, is that anytime you change the shipping address you have to reenter your credit card number. It was annoying at first, but it makes sense. ---
**Author:** ![Peter\_Morris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/peter_morris/32/359_2.png) [@Peter\_Morris](https://boards.straightdope.com/u/Peter_Morris)\ **Post date:** [January 7, 2014, 10:25pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/10 "2014-01-07T22:25:14Z")
> [@snowthx](#): > > Same here. But, why would someone want to hack this message board, if there is not any financial or personal info stored here? Some people hack just for the fun of it. Just the challenge of beating someone’s security. Or to practise their skills before attacking some other site. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [January 7, 2014, 10:32pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/11 "2014-01-07T22:32:48Z")
> [@snowthx](#): > > Same here. But, why would someone want to hack this message board, if there is not any financial or personal info stored here? > [@Peter\_Morris](#): > > Some people hack just for the fun of it. Just the challenge of beating someone’s security. Or to practise their skills before attacking some other site. …or to grab a username/pswd combo and try it elsewhere. ---
**Author:** ![MsWhatsit](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@MsWhatsit](https://boards.straightdope.com/u/MsWhatsit)\ **Post date:** [January 7, 2014, 10:34pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/12 "2014-01-07T22:34:27Z")
> [@Measure\_for\_Measure](#): > > …or to grab a username/pswd combo and try it elsewhere. Bingo. Lots of people use the exact same username and password on pretty much every site they need a login for. The SDMB isn’t such a big deal, but their Gmail or eBay or Apple accounts might be. ---
**Author:** ![MEBuckner](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mebuckner/32/2896_2.png) [@MEBuckner](https://boards.straightdope.com/u/MEBuckner)\ **Post date:** [January 7, 2014, 10:37pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/13 "2014-01-07T22:37:05Z")
So, any recent posts I made here that are factually incorrect, in poor taste, or contain embarrassing grammatical errors, I get to blame on the hackers, right? ---
**Author:** ![Amateur\_Barbarian](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@Amateur\_Barbarian](https://boards.straightdope.com/u/Amateur_Barbarian)\ **Post date:** [January 7, 2014, 10:38pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/14 "2014-01-07T22:38:18Z")
I pity any other Amateur Barbarian out there who used my password. (My username is unique to this board, and the email is a disposable one.) ---
**Author:** ![Shalmanese](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shalmanese](https://boards.straightdope.com/u/Shalmanese)\ **Post date:** [January 7, 2014, 10:52pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/15 "2014-01-07T22:52:23Z")
> [@ptr2void](#): > > So the passwords were hashed, but were they salted and hashed? And were they hashed with a cryptographically strong hash algorithm? Given the age of vBulletin in use here it wouldn’t be surprising to find out they were hashed without a salt and using md5. :rolleyes: I would also like to know more details about exactly how the passwords were stored. ---
**Author:** ![Kareeser](https://avatars.discourse-cdn.com/v4/letter/k/858c86/32.png) [@Kareeser](https://boards.straightdope.com/u/Kareeser)\ **Post date:** [January 7, 2014, 10:54pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/16 "2014-01-07T22:54:09Z")
I too am interested in how the passwords were stored… are the admins looking to switch forum softwares instead? vBulletin is aging, and there are lots of new solutions out there. My favourite by far is NodeBB ([http://nodebb.org](http://nodebb.org)) ---
**Author:** ![choie](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/choie/32/7829_2.png) [@choie](https://boards.straightdope.com/u/choie)\ **Post date:** [January 7, 2014, 10:58pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/17 "2014-01-07T22:58:54Z")
> [@ptr2void](#): > > So the passwords were hashed, but were they salted and hashed? And were they hashed with a cryptographically strong hash algorithm? Given the age of vBulletin in use here it wouldn’t be surprising to find out they were hashed without a salt and using md5. :rolleyes: VB passwords are md5, but have been hashed and salted since at least 2006. The version SDMB uses was released some point after April 2008. ---
**Author:** ![Ashley\_Pomeroy](https://avatars.discourse-cdn.com/v4/letter/a/c68b51/32.png) [@Ashley\_Pomeroy](https://boards.straightdope.com/u/Ashley_Pomeroy)\ **Post date:** [January 7, 2014, 11:01pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/18 "2014-01-07T23:01:37Z")
On a tangent, how does the engine generate a new password when you request one? E.g. if you’ve forgotten your password, you can opt to have it reset, in which case Straight Dope emails you a new one. I assume it’s randomly-generated but could hackers “turn” the engine and make it send out passwords they choose? ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [January 7, 2014, 11:01pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/19 "2014-01-07T23:01:38Z")
> [@Shalmanese](#): > > I would also like to know more details about exactly how the passwords were stored. Relevant thread: [http://www.vbulletin.org/forum/showthread.php?t=178091](http://www.vbulletin.org/forum/showthread.php?t=178091) I see no reason why TPTB should divulge such info though. I trust that such discussion could go on for pages. Thanks to the admins for giving us a heads up. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [January 7, 2014, 11:04pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/20 "2014-01-07T23:04:34Z")
I just got an email from the SDMB essentially saying the same thing in Ed’s post. It has a phone number! Does it ring in the Moderators Dungeon, or Fortress of Solitude or dungeon? [Next page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=2)