RealGM

RealGM Users and Viewers,

Overnight, an individual seemingly located in Russia was able to guess a password of an admin. They were spotted and stopped by RealGM's host administrator in minutes. Then we did a survey of everything and performed maintenance with the boards offline (the boards are entirely separate in database and hosting from any other area of RealGM). Nobody's accounts were accessed but this one, and the person did not get any backend access to RealGM's systems so it was not a hack in that way. The person basically logged in like a user (the admin user) would from their computer and played around. They sent a mass email that many received, announcing their feat, and then changed some names of the forums (not usernames), etc., powers that are given to admins but that don't involve deeper access -- essentially the person did some criminal mischief. We restored everything to the most recent backup so some topics and posts are missing. We've made changes on the one user account they accessed so that it has a new password. Pardon the inconvenience and thank you for reading.

Let this be a lesson: B4NTH3M4LL might be a satisfying password for an admin, but it's a mite too obvious.

Wondered what happened

How could Neato do this to us?

People often treat social media passwords as "not significant" - dangerous.
People often use the same password for everything in the world --- understandable, but dangerous.

There are means of being more cautious (password managers) -- not always intuitively obvious but can be learned and become easy to use over time.

NuggetsWY wrote:People often treat social media passwords as "not significant" - dangerous.
People often use the same password for everything in the world --- understandable, but dangerous.

There are means of being more cautious (password managers) -- not always intuitively obvious but can be learned and become easy to use over time.

I use to have access to highly sensitive/secure systems. I used a password generator and a password safe. The password was never easy but after about a week of using it daily, I was able to remember it. The ones I used only once a week, I could never remember which is why I used a password safe also.

Buzzard wrote:

NuggetsWY wrote:People often treat social media passwords as "not significant" - dangerous.
People often use the same password for everything in the world --- understandable, but dangerous.

There are means of being more cautious (password managers) -- not always intuitively obvious but can be learned and become easy to use over time.

I use to have access to highly sensitive/secure systems. I used a password generator and a password safe. The password was never easy but after about a week of using it daily, I was able to remember it. The ones I used only once a week, I could never remember which is why I used a password safe also.

It is kind of ironic that it was an admin, one of those likely responsible for site security, had their password "guessed".

Howard Mass wrote:RealGM Users and Viewers,

Overnight, an individual seemingly located in Russia was able to guess a password of an admin. They were spotted and stopped by RealGM's host administrator in minutes. Then we did a survey of everything and performed maintenance with the boards offline (the boards are entirely separate in database and hosting from any other area of RealGM). Nobody's accounts were accessed but this one, and the person did not get any backend access to RealGM's systems so it was not a hack in that way. The person basically logged in like a user (the admin user) would from their computer and played around. They sent a mass email that many received, announcing their feat, and then changed some names of the forums (not usernames), etc., powers that are given to admins but that don't involve deeper access -- essentially the person did some criminal mischief. We restored everything to the most recent backup so some topics and posts are missing. We've made changes on the one user account they accessed so that it has a new password. Pardon the inconvenience and thank you for reading.

Dont admins not use multi-factor authentication for their accounts?

bwgood77 wrote:

Buzzard wrote:

NuggetsWY wrote:People often treat social media passwords as "not significant" - dangerous.
People often use the same password for everything in the world --- understandable, but dangerous.

There are means of being more cautious (password managers) -- not always intuitively obvious but can be learned and become easy to use over time.

I use to have access to highly sensitive/secure systems. I used a password generator and a password safe. The password was never easy but after about a week of using it daily, I was able to remember it. The ones I used only once a week, I could never remember which is why I used a password safe also.

It is kind of ironic that it was an admin, one of those likely responsible for site security, had their password "guessed".

it likely wasnt guessed. that admins username/email + password combination was probably part of one of the larger breaches and broadcoast on the internet (Collection 1, Collection 2, linkedin breach, equifax breach, etc...)

The admin probably used the same password for realgM as they did for another site that was compromised. (referred to as "password resuse"). this is the most common cause of compromised credentials. In todays landscape, it is not a matter of "if" but "when" your credentials will be compromised on one, or many websites. and if you use a common password for multiple sites, attackers use automation to try that leaked passsword on millions of websites in a matter of minutes/hours and get reported on "hits" and then log in to see what damage they can do or what money they can extract

Anything at an admin level, or that houses critical info/access should at a MINIMUM employ:

1) multi-factor authentication (a code sent to a mobile device or token based code required post login for access)
2) a password management system that prohibits password resuse (LastPass is popular)
3) Geo-fencing (Restricts location based logons. prevent logons from russia even if they ahve the correct password)

Prokorov wrote:

bwgood77 wrote:

Buzzard wrote:I use to have access to highly sensitive/secure systems. I used a password generator and a password safe. The password was never easy but after about a week of using it daily, I was able to remember it. The ones I used only once a week, I could never remember which is why I used a password safe also.

It is kind of ironic that it was an admin, one of those likely responsible for site security, had their password "guessed".

it likely wasnt guessed. that admins username/email + password combination was probably part of one of the larger breaches and broadcoast on the internet (Collection 1, Collection 2, linkedin breach, equifax breach, etc...)

The admin probably used the same password for realgM as they did for another site that was compromised. (referred to as "password resuse"). this is the most common cause of compromised credentials. In todays landscape, it is not a matter of "if" but "when" your credentials will be compromised on one, or many websites. and if you use a common password for multiple sites, attackers use automation to try that leaked passsword on millions of websites in a matter of minutes/hours and get reported on "hits" and then log in to see what damage they can do or what money they can extract

Anything at an admin level, or that houses critical info/access should at a MINIMUM employ:

1) multi-factor authentication (a code sent to a mobile device or token based code required post login for access)
2) a password management system that prohibits password resuse (LastPass is popular)
3) Geo-fencing (Restricts location based logons. prevent logons from russia even if they ahve the correct password)

Right, and not using the same password on multiple sites. But my "guessed" in quotes basically meant that it was hacked (I just used that in quotes since that is what Howard said). I didn't truly think someone was sitting around racking their brain trying to guess an admin's password.

Prokorov wrote:3) Geo-fencing (Restricts location based logons. prevent logons from russia even if they ahve the correct password)

Geo-fencing was effective back when VPNs were not so easy to have/use.

These days attacks like this usually come through a VPN provider like NordVPN. Some hosts block VPN providers specifically due to this issue, but there are many legitimate uses of VPNs like those that are being state-monitored. As such just like geo-fencing, blocking VPN providers is a band-aid fix at best and won't stop a determined attacker.

Usually, these attacks originate in Russia/China but are proxied through other compromised hosts in "trusted" countries, as such any form of Geo-Fencing is nothing more than a bit of an annoyance to the attacker, and a lot of annoyance to legitimate users that are blocked that should not be.

Full disclosure: Please note while I am an Administrator here I am not a RealGM employee, as such my views/opinions are my own and do not reflect the views and/or opinions of RealGM.

gnif wrote:

Prokorov wrote:3) Geo-fencing (Restricts location based logons. prevent logons from russia even if they ahve the correct password)

Geo-fencing was effective back when VPNs were not so easy to have/use.

These days attacks like this usually come through a VPN provider like NordVPN. Some hosts block VPN providers specifically due to this issue, but there are many legitimate uses of VPNs like those that are being state-monitored. As such just like geo-fencing, blocking VPN providers is a band-aid fix at best and won't stop a determined attacker.

Usually, these attacks originate in Russia/China but are proxied through other compromised hosts in "trusted" countries, as such any form of Geo-Fencing is nothing more than a bit of an annoyance to the attacker, and a lot of annoyance to legitimate users that are blocked that should not be.

Full disclosure: Please note while I am an Administrator here I am not a RealGM employee, as such my views/opinions are my own and do not reflect the views and/or opinions of RealGM.

Security is about layers. Conditional Access is an important part of that. Geo fencing can be worked around as can most other measures. There is a strong use case for it, as it will block out a ton of volume of attacks that are non-VPN based. The goal isnt to stop 1 attacker, but as many as possible.

We list this as a minimum requirement, because it blocks out such a large volume with such a low cost for implementation. its like an umbrella, you will still get wet, but its blocking a ton of rain drops.

Again, these are just the minimums so you are not guaranteeing a hack (although the assumed breach mentality is ideal anyway). there are tons of better ways to minimize your risk closer to 0 and improve your methods of recovery and mitigation.

but not everyone has 10K a month to dump into a SOC/SIEM

This is unacceptable imo.

Did anybody else get a weird message that said "Hacked by Arthur Sergeevich Trusov"?

Is our personal information secure?

azcatz11 wrote:Is our personal information secure?

No, it never is, but not because of RealGm.

buffbrian wrote:Did anybody else get a weird message that said "Hacked by Arthur Sergeevich Trusov"?

Yes, a lot of people. I did.

buffbrian wrote:Did anybody else get a weird message that said "Hacked by Arthur Sergeevich Trusov"?

I did!

I received an identity monitoring alert this morning from my credit monitoring software that my information was on the dark web. It included my realGM login name, password, and email address. Has anyone else gotten this kind of alert?

NightbreeD wrote:I received an identity monitoring alert this morning from my credit monitoring software that my information was on the dark web. It included my realGM login name, password, and email address. Has anyone else gotten this kind of alert?

I get an alert sometimes from a credit company telling me my realgm password is compromised but it has never been hacked. I have also changed it.