Ethereum.org Forums Database Compromised

https://blog.ethereum.org/2016/12/19/security-alert-12192016-ethereum-org-forums-database-compromised/

by uptown • 10 years ago

49 10 10 years ago

blog.ethereum.org

_audakel• 10 years ago

So glad that when they realized they made a mistake they immediately came out and said exactly what happened, and the detailed steps they are taking to fix it. Nothing but respect for them.

Haha in complete contrast to what Yahoo prob would have done. (Given that Yahoo is a much larger company with more legal and bureaucracy so they may be unable to do this. but still, 3 yrs???)

yankoff• 10 years ago

wow, what a terrible year for Ethereum.

qz_• 10 years ago

The attacker used social engineering to gain access to a mobile phone number that allowed them to gain access to other accounts, one of which had access to an old database backup from the forum.

Forgive me if I'm missing something blatantly obvious, but how was a hacker able to gain backup access with just a phone number? What kind of auth is that?

chmars• 10 years ago

2FA with SMS?

Something1234• 10 years ago

It's a thing. Google uses it, Paychex and Adp too. Just about every really big one uses it for two factor.

mastre_• 10 years ago

Are you asking what it means or disagree with it?

If a: 2-Factor Authentication with Short Message Service (called "text" in the US).

If b: It's how Google's 2FA works by default, falls back to SMS.

Basically, getting control of (i.e. stealing) the 2nd factor in the 2FA scheme, and bypassing the 1st factor, the password (by resetting it). Plausible.

azdle• 10 years ago

It looks like Google uses SMS for account recovery, could have been something like that.

https://support.google.com/accounts/answer/183723?hl=en

to3m• 10 years ago

Presumably something along these lines:

1. attempt to log in to target's email system

2. "I forgot my password"

3. get 2FA key via SMS

4. enter 2FA key and new password, gain access to email

5. attempt to log in to target's backup system

6. "I forgot my password"

7. get password reset key via email...

eximius• 10 years ago

To be fair to the Ethereum folks, this is the least embarrassing way to be compromised - that is, when it isn't your fault.

benchaney• 10 years ago

Yes, and also when it is unrelated to your main service.

Ethereum.org Forums Database Compromised

Related Stories