New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

MacRumors Forums: Security Leak

macrumorslogoYesterday, the MacRumors Forums were targeted and hacked in a similar manner to the Ubuntu forums in July. We sincerely apologize for the intrusion, and are still investigating the attack with the help of a 3rd party security researcher. We believe that at least some user information was obtained during the attack.

In situations like this, it's best to assume that your MacRumors Forum username, email address and (hashed) password is now known. While the passwords are "hashed" (which is a one-way conversion from your actual password to a scrambled version), given computing power these days, if your password isn't very complex, they could brute force figure it out by trying lots of combinations.

What this means for you, if you have a MacRumors Forums account, is the following:

1. Change your password on our forums. If you have any problems, please contact us.

2. If you used the same password on any other site, change it there also.

There are several guides online for how to choose a good password. Also, you should generally keep separate passwords for every service, for situations just like this. To help manage distinct passwords for every website, you can use a password manager such as Lastpass or 1Password.

Canonical provided a post-mortem of the Ubuntu forums attack on their blog. Our case is quite similar, with a moderator account being logged into by the hacker who then was able to escalate their privileges with the goals of stealing user login credentials.

We are still working to get the forums fully functional and more secure. Again, we are very sorry for the breach.


Why did I not get an email sooner?

According to our email service, sending such a large burst of email in one day to all of our users will result in many of those emails getting automatically blocked. As such, we are sending emails out over time to ensure they reach your inbox.

Top Rated Comments

(View all)

12 months ago
You could have ****ing told us as soon as it happened, the forum had been in maintenance mode for ages, why not tell us as soon as you put it like that?
Rating: 187 Votes
12 months ago
Why were you storing our passwords in the first place?

You are supposed to store an irreversible hash of them instead.
Rating: 123 Votes
12 months ago
When creating your new passwords, please keep this XKCD comic in mind and maybe we'll all have secure, easy to remember passwords:
Rating: 48 Votes
12 months ago

Password security level please?


Were passwords hashed, salted, plain text...?


They are vBulletin's standard md5 hashed and salted. Which is not that strong, so assume that your password can be determined with time.

arn
Rating: 46 Votes
12 months ago
Probably a very clever ad for iCloud Keychain
Rating: 46 Votes
12 months ago
Ok so some people are being overly aggressive here:

1) the article clearly states "... and (hashed) password is now known." HASHED. The second highest uprated comment as of now is complaining that the passwords have *edit: not* been hashed. They have been. Learn to read. They certainly aren't stored in plaintext.

2) Others are complaining about MacRumors leaving far too long before telling us; they have only left a day. In terms of what a hacker can do with any data in one day, given the passwords are hashed, this is somewhat limited.

3) Its not as if MacRumors asked to be hacked, or didn't take any measures to prevent hacking - now clearly those measures have been proven to be ineffective but of all the forums in the world I would imagine MacRumors is pretty up to date on the security software used to protect it. Certain I worry much more about the forums I am members of using old front-ends to host their forum where the interfaces have been updated for known security flaws - in those cases hacking is really much more trivial since the flaw is public knowledge.

4) If you are stupid enough to use the same password for everything then shame on you for blaming MacRumors, and if you aren't that stupid then you have nothing to worry about hackers gaining access to your MacRumors password. Just change it and they now have a redundant password and very limited information on you. Sure, I use my MacRumors password for a few sites but only sites with few personal details where the risk of data loss in a hack is minimal and I want the convenience of a single password. Only an idiot uses one password for everything between their computer root and the least secured of connections.

tl;dr grow up and stop all blaming MacRumors for a load of things they didn't do. If you hate it that much, move to a different forum.
Rating: 40 Votes
12 months ago
Just checked and my old password was qwerty. Looks like I wasn't too concerned with security to begin with.
Rating: 37 Votes
12 months ago
I just wanted to say that the transparent way you dealt with the unfortunate situation and the response you posted speaks highly of your site.

I've always enjoyed this site, and while I rarely post in the forum, I have found the comments and discussion to be very valuable.

Keep up the good work!
Rating: 36 Votes
12 months ago
Wow, the best rumour ever. :eek::D
Rating: 27 Votes
12 months ago
Oh damn. Picking HorseBatteryStaple for sure now.
Rating: 24 Votes

[ Read All Comments ]