MacRumors Forums hacked: 860,000 logins exposed

Updated happygeek 3 407 Views

The popular MacRumors Forums site has confirmed that it was successfully hacked on Monday this week. The vBulletin powered forums fell victim to what it describes as a similar breach that hit the Ubuntu forums earlier in the year. "Our case is quite similar" says MacRumors founder Arnold Kim who continues "with a moderator account being logged into by the hacker who then was able to escalate their privileges with the goals of stealing user login credentials." Unlike the Ubuntu breach, no site defacement appears to have taken place though.

In the case of MacRumors, that means some 860,000 usernames, emails and hashed passwords were potentially compromised. The official advice is to assume that your login is now known and passwords should be changed immediately. Amichai Shulman, CTO of security outfit Imperva, warns other forums that when "you use third party components you expose your network to the threats faced by all those applications, significantly increasing your attack surface." vBulletin was, of course, found to be vulnerable to an exploit that enables an attack to create a secondary admin account and effectively take control of the target site. DaniWeb used to operate on a heavily customised vBulletin platform but replaced this with a totally in-house developed proprietary platform last year.

Here's that MacRumors Forum confirmation in full:

Yesterday, the MacRumors Forums were targeted and hacked in a similar manner to the Ubuntu forums in July. We sincerely apologize for the intrusion, and are still investigating the attack with the help of a 3rd party security researcher. We believe that at least some user information was obtained during the attack.

In situations like this, it's best to assume that your MacRumors Forum username, email address and (hashed) password is now known. What this means for you, if you have a MacRumors Forums account, is the following:

  1. Change your password on our forums. If you have any problems, please contact us.

  2. If you used the same password on any other site, change it there also.

There are several guides online for how to choose a good password. Also, you should generally keep separate passwords for every service, for situations just like this. To help manage distinct passwords for every website, you can use a password manager such as Lastpass, 1Password or iCloud keychain in Mavericks.

Canonical provided a post-mortem of the Ubuntu forums attack on their blog. Our case is quite similar, with a moderator account being logged into by the hacker who then was able to escalate their privileges with the goals of stealing user login credentials.

We are still working to get the forums fully functional and more secure. Again, we are very sorry for the breach.

Dani AI

Generated

As flagged on Nov 13, 2013, the MacRumors forums were breached via a compromised elevated account that allowed attackers to harvest user credential data. Treat any forum password tied to your email as exposed and act now — changing the forum password is the minimum.

Practical steps for users:

  • Change the forum password and any other account that used the same password or email/login pair.
  • Enable two-factor authentication (2FA) wherever available and prefer app-based or hardware 2FA over SMS.
  • Use a reputable password manager and unique, randomly generated passwords for each site.
  • Look for unusual activity tied to your email (password reset notices, unknown logins) and be extra cautious with phishing attempts claiming to be from the forum.
  • Check breach databases (search your email) and monitor for alerting on reused credentials.

Quick password tip (macOS/Linux):

# generate a random password you can copy into a password manager
openssl rand -base64 18

Advice for forum operators and moderators:

  • Patch or remove vulnerable forum software/components immediately, rotate all moderator/admin credentials, revoke active sessions, and force password resets for affected users.
  • Audit logs for creation of new privileged accounts and unusual admin actions; limit admin access with least-privilege rules and require 2FA for all privileged accounts.
  • Re-evaluate password storage: migrate to a modern, slow hash (bcrypt/Argon2) with unique salts and, if possible, engage a third-party forensics/security review.

Caveat: hashed passwords are safer than plaintext but can still be cracked if weak hashes or no salts were used — assume compromise until proven otherwise and prioritize forced resets and multi-factor protections.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview