• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

Cheapassgamer site hacked

shanafan

shanafan

Member
BY2K said:
I don't even remember ever creating Adobe and Moneybooker accounts. Why the HELL would I have one of those?
Click to expand...

The website said Final Fantasy Shrine was breached, and my e-mail address was included.

I don't play Final Fantasy, so why would I go there?
 
S

sensi97

Member
About CheapyD's post
1) Your passwords are combined with a random set of characters and then hashed to create a unique fingerprint, and only this is stored in our database.
This is impossible to reverse engineer, so if you use your CAG password on other sites, they would not be compromised.
Click to expand...

No. If a password is weak (CAG allow passwords with 3 characters), the hackers will find it (wordlist or bruteforce). Hash+salt doesn't protect weak passwords.
 
1

10k

Banned
Asgaro said:
My details have already leaked in (at least) 3 major hacks:



One can check their own email address at https://haveibeenpwned.com/
And it's possible to get notified automatically.


edit: entering my user name finds a 4th breach: Battlefield Heroes.
TOP KEK
Click to expand...
Wow. Just checked as Many of my emails and usernames I can remember. I'm all green across the board. Lucky me.
 
T

The_Inquisitor

Member
sensi97 said:
About CheapyD's post


No. If a password is weak (CAG allow passwords with 3 characters), the hackers will find it (wordlist or bruteforce). Hash+salt doesn't protect weak passwords.
Click to expand...

I did an experiment once. If your password is greater than 5 characters and you happen to have some sort of punctuation and/or a capital letter it takes a LONG time to brute force. Moreso on the order of several years depending on how much hardware you are paying for/using. If the encryption was good, most users should generally be okay. Ouch at those who thought a 3 character passy was safe.
 
S

skullmuffins

Banned
The_Inquisitor said:
I did an experiment once. If your password is greater than 5 characters and you happen to have some sort of punctuation and/or a capital letter it takes a LONG time to brute force. Moreso on the order of several years depending on how much hardware you are paying for/using. If the encryption was good, most users should generally be okay. Ouch at those who thought a 3 character passy was safe.
Click to expand...
Well, password crackers generally don't go straight for simple brute force. They'll do dictionary attacks and then permutations (like $ instead of S, etc). A shorter password that's truly random is more secure than a password that's generated from one word, two words combined, a pattern on your keyboard, etc. In any case,
1) Your passwords are combined with a random set of characters and then hashed to create a unique fingerprint, and only this is stored in our database. This is impossible to reverse engineer, so if you use your CAG password on other sites, they would not be compromised.
Click to expand...
is overstating it. Salts (the "random set of characters" your password is combined with) are stored somewhere on the DB, so if they got in, it's safe to assume they got the salts as well. It's not "impossible" to crack, just more difficult, and possibly not worth the time, depending on which hashing algorithm they used.
 
I

inm8num2

Member
Site and forums are working but the front page shows this:

L53UvOI.png
 
T

thenexus6

Member
The CAG cast was the first podcast I ever listened to back in 2007 and never missed an episode since. And although I live in the UK so never really get deals from the site I visit the forums very regularly.

Shout out to John getting the site back up so soon.
 
V

ViciousDS

Banned
the remarks make it sound like a childish kid using scripts at this point to just intercept the IP to display his garbage message. Which would explain why the main page.....actually loads sometimes and isn't always down.
 
L

low-G

Member
Adam Tyner said:
CAG uses IP.Board, and their documentation sez:

The salt is a random 5 character string that's stored in the same database table.
Click to expand...

md5 is completely broken now, no one should be using it. Might be how the kid is logging in as web admin.

To be clear, there are MULTIPLE passwords which may log you into a CAG account, if they're using md5, and md5'ing 2 md5 concatenated elements seems like a flawed cryptography method even if it wasn't md5 (I cannot mathematically prove this right now, but my crypto senses are tingling, something about using an even number of discrete elements)

At the very least, consider CAG passwords compromised.
 
T

tebunker

Banned
It's funny though because the forums over there are just plugging along again.

I wonder what this cmd person actually did or got? Because I would have thought that if he really cared he would have shut it all down and shut out everything.
 
C

Chris1

Member
Yeah, salts and hashed passwords don't mean your passwords are secure lol.

It's more likely that they aren't cracking the hashes/salts exactly, but instead using a dictionary attack to bruteforce the password. So if you have a difficult password you should be fine but if you have a relatively easy password you're fucked.

Bad password: 123456 (Guaranteed to be leaked/bruteforced)
Bad but "looks good" password: Bob73873873899 (Not guaranteed but highly possible with a list generator)
Good password: Bob834kjs82'2$$"!##£$^& (virtually impossible within a reasonable timeframe)
 
E

Ehker

Member
Not sure if cache issue, but I keep refreshing and it seems like they keep fixing it for awhile, until it keeps getting reverted back to the hacked page.
 
FantasticMrSnake

FantasticMrSnake

Member
This things are really annoying. Why do you have to hack a site or do something malicious because you think is not secure enough?
It's not your problem, and it's not yours, you are just bothering a lot of people thinking you are smart or doing them a favor but your are not.

Leave cheapassgamers alone!!
 
T

TheSeks

Blinded by the luminous glory that is David Bowie's physical manifestation.
oti xero said:
what's a jabber?
Click to expand...

An Instant Messenger client, similar to AIM/YIM/MSN/ICQ but less popular.

Nexus6 said:
Shout out to John getting the site back up so soon.
Click to expand...

I dunno about that...

"WHY ARE YOU BACK HERE!?" as a title along with them putting the "child molestor"'s e-mail out there apparently?

low-G said:
md5 is completely broken now, no one should be using it. Might be how the kid is logging in as web admin.
Click to expand...

Look at that Invision Board article: It's from 2010. So, not recent. It was only updated last in 2012.

That said, I'm wondering if they ever updated that code.
 
Dr. Zoidberg

Dr. Zoidberg

Member
This sucks but luckily my password there is pseudo-random gibberish so I'm not really concerned. I'll just change it when they finally get the site fixed.
 
You must log in or register to reply here.

Similar threads

Epic Games (Allegedly) Hacked in Ransomware Attack
2
60
4K
ssringo replied
Any suggestions for sites or channels to identify good PS5 indies?
2
156
AV replied
Do you frequent any specific sites for gaming news?
2
80
3K
justiceiro replied
Insomniac possibly got hacked?
2
86
13K
ReBurn replied
Udio Released, Generative AI for music - Lets prompt music for videogames that never existed
17
2K
CuNi replied
Top Bottom