Damage Incorporated has been discovered logging all user log ins since late 2006. This modification was added to the forums, for who knows what reason ...

 

http://www.youtube.com/watch?v=t0iSM-vt9eI

 

Discuss.

I have no idea what this is but that random user is my forum acc lol what are the odds >.<

Did you even watch it? They have been logging user/pass info and stored it away for who knows what reason. Basically if you log in there ever, they can use your password to hack you elsewhere.

Thats why most persons have different passwords for other sites

And now you've hacked/defaced the website, good job?

Yeah, alerting people that they have been compromised is bad.

Brian admitted he was storing passwords because of an exploit in the recovery system. He advised everyone to use different passwords aswell. If you need your password back you could just ask.

Edited March 20, 201115 yr by Twix

In the source code there is clearly a comment stating that Eric did it, and not to tell anyone about it.

Everyone still knew lol

I am sure all new members for the last 4 years were made aware.

It's common knowledge really that with IPB2 you can easily find people's login information. This problem was fixed in IPB3. Sure there's ways to go around that, but you'd need access to the database and the salts which make it more complicated.

 

It just goes to show to use different passwords for different sites. Not really a difficult concept to grasp to be honest.

Edited March 20, 201115 yr by Killerred005

So you exposed what exactly? That password & attempted logins were being stored...not exactly a thing that needs "exposing" really :unsure:

Edited March 20, 201115 yr by WeeMan1311

The odd thing is here that they were stored in plain text.

So you exposed what exactly? That password & attempted logins were being stored...not exactly a thing that needs "exposing" really :unsure:

Login information always has to be stored in the database - but this shows that DI was deliberately storing them in plain text in a way that could make them easily retrieved.

Lol I made an account in those forums just for the New Year's hack lulz. Can't remember the user and pass now though. :\

Edited March 20, 201115 yr by kuru72

It's also best to avoid registering on other clans' forums. :P

So you exposed what exactly? That password & attempted logins were being stored...not exactly a thing that needs "exposing" really :unsure:

 

Passwords are stored in databases but they're encrypted.. meaning that no one, including people who have access to the database, can crack your password. They exploited code to mess around with that.

 

Kinda disappointed here. Luckily I use a different password for everything, but damn, I can't help but think how many accounts were hacked this way. Really uncool.

Edited March 20, 201115 yr by Deltaer

You were probably the hacker, lol.

This is what passwords look like in a database in their encrypted form:

 

 

It is possible to unencrypt them, that is, make them legible - but it's difficult.

Ok, thanks for the update.

Everyone running 2.X.X did this back when it was relevant. :$

Oh, that's incredible useful.

exposing a dead clan, nice.

now I know everything.

I could have easily guessed they've been doing that lol but thanks for letting people know I suppose.