Safety alert [12/19/2016]: Ethereum.org Boards Database Compromised

On December 16, we have been made conscious that somebody had lately gained unauthorized entry to a database from discussion board.ethereum.org. We instantly launched an intensive investigation to find out the origin, nature, and scope of this incident. Here’s what we all know:

• The knowledge that was lately accessed is a database backup from April 2016 and contained details about 16.5k discussion board customers.
• The leaked info contains
  
  • Messages, each private and non-private
  • IP-addresses
  • Username and e-mail addresses
  • Profile info
  • Hashed passwords
    
    • ~13k bcrypt hashes (salted)
    • ~1.5k WordPress-hashes (salted)
    • ~2k accounts with out passwords (used federated login)

• The attacker self-disclosed that they’re the identical individual/individuals who lately hacked Bo Shen.
• The attacker used social engineering to realize entry to a cell phone quantity that allowed them to realize entry to different accounts, certainly one of which had entry to an previous database backup from the discussion board.

We’re taking the next steps:

• Discussion board customers whose info could have been compromised by the leak shall be receiving an e-mail with extra info.
• Now we have closed the unauthorized entry factors concerned within the leak.
• We’re implementing stricter safety tips internally reminiscent of eradicating the restoration telephone numbers from accounts and utilizing encryption for delicate knowledge.
• We’re offering the e-mail addresses that we consider have been leaked to https://ift.tt/40681Av, a service that helps talk with affected customers.
• We’re resetting all discussion board passwords, efficient instantly.

If you happen to have been affected by the assault we suggest you do the next:

• Be sure that your passwords are usually not reused between providers. If in case you have reused your discussion board.ethereum.org password elsewhere, change it in these locations.

Moreover, we suggest this wonderful weblog publish by Kraken that gives helpful details about how you can shield towards a majority of these assaults.

We deeply remorse that this incident occurred and are working diligently internally, in addition to with exterior companions to handle the incident.

Questions might be directed to safety@ethereum.org.

Supply hyperlink

from Ethereum – My Blog https://ift.tt/GBAvcIg
via IFTTT