# Hacked SDMB **URL:** \ **Category:** About This Message Board\ **Created:** [January 7, 2014, 9:47pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170 "2014-01-07T21:47:45Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [January 7, 2014, 11:07pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/21 "2014-01-07T23:07:55Z")
I just changed my password. The old one wasn’t used elsewhere, and certainly not for my email. ---
**Author:** ![Exapno\_Mapcase](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/exapno_mapcase/32/1051_2.png) [@Exapno\_Mapcase](https://boards.straightdope.com/u/Exapno_Mapcase)\ **Post date:** [January 7, 2014, 11:08pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/22 "2014-01-07T23:08:49Z")
> [@choie](#): > > VB passwords are md5, but have been hashed and salted since at least 2006. The version SDMB uses was released some point after April 2008. All passwords at the Dope since the solstice of 2013 have been lightly sautéed in truffle oil over a bed of artisanal arsenic and sprinkled with unicorn down before being placed in a nitrogen foam canister and squeezed onto individual crisps of quadrotriticale. At least that’s what Ed told me. ---
**Author:** ![Peter\_Morris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/peter_morris/32/359_2.png) [@Peter\_Morris](https://boards.straightdope.com/u/Peter_Morris)\ **Post date:** [January 7, 2014, 11:10pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/23 "2014-01-07T23:10:54Z")
> [@Kareeser](#): > > … are the admins looking to switch forum softwares instead? … > > My favourite by far is NodeBB ([http://nodebb.org](http://nodebb.org)) Is it compatible with VBulletin? Would they be able to transfer the entire message archive to the new software? Would links to other posts still be guaranteed to work? If it ain’t broke … ---
**Author:** ![Mops](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mops/32/16494_2.png) [@Mops](https://boards.straightdope.com/u/Mops)\ **Post date:** [January 7, 2014, 11:12pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/24 "2014-01-07T23:12:59Z")
I first thought the e-mail announcement was a phishing e-mail because it contains two links purporting to point at URLs at [boards.straightdope.com](http://boards.straightdope.com) and [www.straightdope.com](http://www.straightdope.com), respectively, but really pointing at URLs under [click.suntimesmail.com](http://click.suntimesmail.com) - this kind of thing usually is a hallmark of phishing. ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 7, 2014, 11:14pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/25 "2014-01-07T23:14:15Z")
The email I got about this displays a different URL than what it links to - that usually screams Phishing. What’s with that? Link shows - [noparse][http://boards.straightdope.com/sdmb/profile.php?do=editpassword[/noparse]](http://boards.straightdope.com/sdmb/profile.php?do=editpassword%5B/noparse%5D) Link actually points to - [noparse][http://click.suntimesmail.com/?ju=fe2015787d600d7e751377&ls=fdcd15717266007d7210747665&m=feef1178706c02&l=fe8f17767d64017474&s=fdf61571716d017b75157873&jb=ffcf14&t=[/noparse]](http://click.suntimesmail.com/?ju=fe2015787d600d7e751377&ls=fdcd15717266007d7210747665&m=feef1178706c02&l=fe8f17767d64017474&s=fdf61571716d017b75157873&jb=ffcf14&t=%5B/noparse%5D) Also, having changed my password - what’s to say it won’t happen again? ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 7, 2014, 11:17pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/26 "2014-01-07T23:17:21Z")
> [@Shalmanese](#): > > I would also like to know more details about exactly how the passwords were stored. So would the hackers. Publicizing this information isn’t a good security practice. ---
**Author:** ![Raider\_Duck](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@Raider\_Duck](https://boards.straightdope.com/u/Raider_Duck)\ **Post date:** [January 7, 2014, 11:17pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/27 "2014-01-07T23:17:37Z")
> [@Measure\_for\_Measure](#): > > …or to grab a username/pswd combo and try it elsewhere. Exactly. I cannot emphasize this enough: USE A PASSWORD MANAGER. I use LastPass, and it took me 30 seconds to get and save a new password for this site. And since I use a different password on every site, I don’t have to worry about anywhere else being hacked. Note that this is not a shill for LastPass. I understand Roboform, KeePass and others work just as well. ---
**Author:** ![Keeve](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@Keeve](https://boards.straightdope.com/u/Keeve)\ **Post date:** [January 7, 2014, 11:21pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/28 "2014-01-07T23:21:40Z")
> [@Mops](#): > > I first thought the e-mail announcement was a phishing e-mail because it contains two links purporting to point at URLs at [boards.straightdope.com](http://boards.straightdope.com) and [www.straightdope.com](http://www.straightdope.com), respectively, but really pointing at URLs under [click.suntimesmail.com](http://click.suntimesmail.com) - this kind of thing usually is a hallmark of phishing. Ditto. If it was [chicagoreader.com](http://chicagoreader.com) I would’ve believed it. But suntimesmail made me VERY suspicious. I’m still trying to change my password directly, WITHOUT using that link. ---
**Author:** ![Chris42163](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@Chris42163](https://boards.straightdope.com/u/Chris42163)\ **Post date:** [January 7, 2014, 11:22pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/29 "2014-01-07T23:22:58Z")
Good for them! Well done, boys! You got me! ---
**Author:** ![Yaxche](https://avatars.discourse-cdn.com/v4/letter/y/8dc957/32.png) [@Yaxche](https://boards.straightdope.com/u/Yaxche)\ **Post date:** [January 7, 2014, 11:24pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/30 "2014-01-07T23:24:11Z")
So when exactly did this take place? I literally changed my password last night, is it at risk? Interestingly enough, I had some unauthorized charges from WalMart (which I haven’t ordered from in a few years) show up, prompting me to change passwords pretty much across the board yesterday. ---
**Author:** ![Raider\_Duck](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@Raider\_Duck](https://boards.straightdope.com/u/Raider_Duck)\ **Post date:** [January 7, 2014, 11:25pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/31 "2014-01-07T23:25:21Z")
> [@Keeve](#): > > Ditto. If it was [chicagoreader.com](http://chicagoreader.com) I would’ve believed it. But suntimesmail made me VERY suspicious. > > I’m still trying to change my password directly, WITHOUT using that link. A WHOIS search for [suntimesmail.com](http://suntimesmail.com) revealed that it is owned by the Chicago Sun Times, Inc. In other words, it’s legit. ---
**Author:** ![Giraffe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/giraffe/32/129_2.png) [@Giraffe](https://boards.straightdope.com/u/Giraffe)\ **Post date:** [January 7, 2014, 11:25pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/32 "2014-01-07T23:25:59Z")
> [@choie](#): > > VB passwords are md5, but have been hashed and salted since at least 2006. The version SDMB uses was released some point after April 2008. Check out this [really interested Wired article on password cracking](http://www.wired.co.uk/news/archive/2013-05/28/password-cracking). Salting helps a little, but not nearly as much as it used to since they’re not using rainbow tables any more, they’re brute force attacking using GPUs. (Also, I believe vBulletin stores the salts in the database in plain text, so if they got the database, they got the salts as well.) The success rate in that article is pretty astonishing: they cracked some seemingly strong passwords in minutes. The biggest problem with vBulletin’s security is the use of MD5: you want something that takes a lot longer to process (relatively speaking), e.g. SHA512 with a bunch of iterations. It might take each user a second longer to log in, but it will reduce the number of guesses the cracker can make by several orders of magnitude. ---
**Author:** ![Thudlow\_Boink](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thudlow_boink/32/320_2.png) [@Thudlow\_Boink](https://boards.straightdope.com/u/Thudlow_Boink)\ **Post date:** [January 7, 2014, 11:27pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/33 "2014-01-07T23:27:56Z")
I guess now’s my chance to post something jerkish and claim it was really from someone else who hacked into my account. 🙂 ---
**Author:** ![Keeve](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@Keeve](https://boards.straightdope.com/u/Keeve)\ **Post date:** [January 7, 2014, 11:28pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/34 "2014-01-07T23:28:29Z")
> [@Keeve](#): > > I’m still trying to change my password directly, WITHOUT using that link. done 🙂 ---
**Author:** ![Giraffe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/giraffe/32/129_2.png) [@Giraffe](https://boards.straightdope.com/u/Giraffe)\ **Post date:** [January 7, 2014, 11:28pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/35 "2014-01-07T23:28:37Z")
> [@TroutMan](#): > > So would the hackers. Publicizing this information isn’t a good security practice. Neither is security through obscurity. I guarantee you any would-be hackers already know far more about vBulletin password storage than anyone here. I’ll second the use of a password manager – I recommend DashLane. It’s easy to set up, it will automatically grab all your stored passwords and guide you through changing them to something more secure. And they have relatively good apps for mobile devices, in addition to a good web interface and their main program. ---
**Author:** ![Si\_Amigo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/si_amigo/32/2877_2.png) [@Si\_Amigo](https://boards.straightdope.com/u/Si_Amigo)\ **Post date:** [January 7, 2014, 11:30pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/36 "2014-01-07T23:30:04Z")
I would never use a link in an email to change a password. It’s easy enough to just go to the site as you normally would and change it. Took two minutes tops. ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [January 7, 2014, 11:30pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/37 "2014-01-07T23:30:18Z")
**Mr. Briston,** please return to the Customer Service Desk. Your new excuse is ready for pick-up. ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 7, 2014, 11:30pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/38 "2014-01-07T23:30:19Z")
I can’t help feeling like using a password manager is storing all your eggs in one basket. ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 7, 2014, 11:31pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/39 "2014-01-07T23:31:41Z")
> [@Si\_Amigo](#): > > I would never use a link in an email to change a password. It’s easy enough to just go to the site as you normally would and change it. Took two minutes tops. Niether would I, but I always have a look at what’s ‘underneath’ any links in emails I get that I’m even slightly suspicious about. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 7, 2014, 11:32pm UTC](https://boards.straightdope.com/t/hacked-sdmb/678170/40 "2014-01-07T23:32:51Z")
> [@Raider\_Duck](#): > > A WHOIS search for [suntimesmail.com](http://suntimesmail.com) revealed that it is owned by the Chicago Sun Times, Inc. In other words, it’s legit. Correct, you’re OK to follow the links in the email. But I note that this level of paranoia and verifying links in emails is quite healthy and a good practice to follow for everyone. Just get in the habit of taking the few extra seconds to type in a URL no matter how it looks. The dangerous ones are links with a subtle misspelling or things like switching a lowercase l and uppercase i, and you are likely to miss that with visual inspection. [Previous page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=1) [Next page](https://boards.straightdope.com/t/hacked-sdmb/678170.md?page=3)