It appears probable that plaintext passwords were stolen as well, so be aware of that. My and geekboy's accounts elsewhere were both attempted compromised elsewhere. Change your password.

Edit: It's also worth pointing out that if plaintext passwords were stored or logged somewhere, you should NOT change your password to anything you use elsewhere, because nothing about password storage has changed.

We shouldn't have had any plaintext passwords. It looks like SMF doesn't salt+hash their passwords in a very secure way. Sorunome is looking into cleaning that up.

Given how quickly my account was attacked last night (with my Omnimaga password), and geekboy's account was attacked today (ditto), I'm concerned.

Luckily it looks like the damage was contained to Omnimaga's database itself and they didn't get at any of our other databases or anything. There is a lot of data they can sort through though and possibly some personal information.

Geekboy said that nothing in the admin forum was particularly sensitive, but I guess PMs and the Private Matters subforum are of concern?

Quote from: Eeems on December 05, 2015, 06:36:13 pm

We shouldn't have had any plaintext passwords. It looks like SMF doesn't salt+hash their passwords in a very secure way. Sorunome is looking into cleaning that up.

Given how quickly my account was attacked last night (with my Omnimaga password), and geekboy's account was attacked today (ditto), I'm concerned.

Quote from: Eeems on December 05, 2015, 06:36:13 pm

Luckily it looks like the damage was contained to Omnimaga's database itself and they didn't get at any of our other databases or anything. There is a lot of data they can sort through though and possibly some personal information.

Geekboy said that nothing in the admin forum was particularly sensitive, but I guess PMs and the Private Matters subforum are of concern?

Correct, lots of PMs and private posts.
I'm not that happy with how easy it is for them to get the passwords from how SMF stores them.

Sorununome, would you mind opening an issue on SMFs stuff complaining about it?

No one attempted anything on any of my accounts as far as I know other than the usual "there was security breaches on some other website that isn't ours and we think your account may be compromised so we've reset your password" (last one in date was Netflix btw, got one on Patreon and Adobe too, these breaches seems to be everywhere). Thankfully, nothing happened on CodeWalrus as the attacker could easily have tried there a well. Anyway, if you guys know the IP of the offender, please tell me so I can check on my side.

Seriously, plain text passwords in 2015 ?

Not plain text, sha1 hashes, which are VERY weak.
And yeah, I was thinking the same "Seriously? Why would SMF even do that?"

I'm working right now on a thing so that the passwords will be stored using bcrypt

The attachments should be all up now, if something is missing please tell me! Still need to upload the downloads

why would they even use md5......you should report it to phpBB devs ^.^