Database Breach - An Update

[MichaelK3143]

In response to post #34833170.

ninjakreborn wrote: You are one of the most thorough website administrators I've seen in a long time.

lol i know right

[KingOzky]

In response to post #34833170. #34844010 is also a reply to the same post.

ninjakreborn wrote: You are one of the most thorough website administrators I've seen in a long time.

MichaelK3143 wrote: lol i know right

I just got the message right now. But I think I am a little safer than other people since I joined in 2014 january.

[Cacticat]

I got this message just now, and thank you for being amazing admins!

However, it was a pain to change the password due to Edge thinking the forums being an unsafe website :( And Firefox didn't want to load my profile that fast either :( But I got it done :)

[Surazal]

Apologies for posting this publically, but I am having problems with access to nexus.com (for PM's and Forum access).

 

Your reminder regarding this breach prompted me to change my password just in case. However, MS's smartcreen now displays a message that this site (nexus.com) is unsafe. If I try to continue anyway, I get gateway timeouts.

 

I wanted to let you know in case you were not aware and would welcome any advice you have to give or any feedback regarding this issue.

 

Many thanks

[jyang0910]

thanks for the updates.

[Morgwynn]

I get a 504 timed out error when trying to change my password. I've tried about 6-7 times now and it keeps giving me a 504 timed out error but I'm guessing that is a problem on my part.

[Harr138]

Thanks for the news

 

[Deleted159543User]

Got the message just now, luckily I've already recently changed my password around a couple weeks ago (forget exactly when). Pretty much all of my passwords are long, random jumbles of letters (both cases) and numbers generated by LastPass, so not even I know what they are, and I made my master password hard to crack as well.

[ALL55555]

How many? In this month I logged in my accont and everything was file. But when I login into my account today, it cannot work. I changed password and it is the same problem. I have my e-mail correct (I checked).
Oh man. Unlucky day.
1st EDIT: Log out does not work. View your profile does not work. I have my account after 2013 year.

Edited March 21, 2016 by ALL55555

[Rormysta]

I promised I'd update you all on the possibility of a database breach on Nexus Mods that I announced yesterday morning and I am here with relatively "good" news.

 

I am now in possession of the database dump, that was first reported on Reddit, via university security networks, and I can confirm several things. First, the database dump is "old", with the last member in the database having registered on July 22nd 2013. If you're one of the 4.2 million users who registered on Nexus Mods after this date, your details are not included in this database dump and are therefore considered "safe". Second, the database dump isn't a complete database rip. The dump contains user IDs, usernames, email addresses, hashes and salts, and that's it. It does not contain cracked passwords i.e. anyone with access to the dump would need to attempt to crack the hashes and salts themselves in order to get any sort of use out of them on the site.

 

From this we can conclude a further two things. Firstly, that it's relatively safe to assume that whoever made this dump no longer has access to our database. Why? Because if they did, they'd have released a much more up-to-date dump of our member database. It would make sense they no longer have any access, considering we've patched up a lot of holes, applied countless security updates and switched to a far more secure database cluster system since July of 2013.

 

Second, if you've updated your password since July 2013, your account on the Nexus sites should be safe and secure, as they will not have your new hashes/salts/password information. If you have not updated your password recently, please do so now as I am now personally confident that there have been no recent breaches of our network or databases. Similarly, if you still use the password you were using in July 2013, or before that date, on any other sites or services you should update them immediately.

 

I would like to thank the HPE Security Research team who have personally helped me with this investigation and who securely provided me with the database dump as part of this investigation. Their help has been invaluable.

 

My previous news post also mentioned three compromised mod author accounts that had uploaded a suspicious file in place of legitimate mods on the site. I have been in contact with one of the owners of the compromised accounts personally, along with another individual who I know was compromised recently, and both were using extremely simple passwords. Passwords that would take a simple cracker mere seconds to crack. This helps to confirm that whoever is using this information is going for high-profile, but extremely easy accounts to crack.

 

To my knowledge, we have not seen any further suspicious activity in the file database at this time.

 

The malicious file that was uploaded, "dsound.dll", has been sent away to the malware research team at HPE Security Research to find out what it does and, hopefully, spread the word so it can be flagged by anti-virus software appropriately. Once again, a big thank you to the HPE Security Research team. They've provided an excellent service.

 

While we would like to force everyone to update their passwords so we can be completely in the clear when it comes to this breach, the only way we could force a password update is to make everyone's password invalid on the site and force you to do a password recovery via your email address. While that might be OK for our newer members (who this doesn't even affect), I imagine there are thousands, if not hundreds of thousands of users on this site who have signed up with email addresses they no longer have access to and would, instantly, become completely locked out of their accounts with no way of gaining entry back. So we have a bit of a conundrum in this respect, and I'm not entirely sure what to do.

 

In spite of the fact we think that we're "in the clear" on the possibility of a recent breach, we're not going to sit back and pretend like we couldn't be doing more. This scare has given us a real kick up the backside, so we're putting aside our work on the front-end for our NMM Profile Sharing at this time so we can focus on some improvements.

 

In the short-term, we've already begun work on more verbose logging of user actions on the site, especially in regards to logging the IP addresses you login with and use when performing major actions, such as uploading or removing files to the database. This should allow us to more easily analyse and spot suspicious activity on the sites when it occurs. If someone who previously used a static IP address for years starts making wild changes to all their files using IP addresses traced back to TOR, it's safe to say we're going to find that suspicious and will react accordingly.

 

We're also working on a system that will allow us to notify you, the users, when something as important as this comes up again. As it is, we have the functionality to send "full page notifications" to individual users when we want to make sure a user gets a message. Imagine a Private Message, but one you're forced to view and tick a box saying you've read the message, before you can browse the site again. While we can send these to individual users, we can't send this en-masse to every user of the sites, so we're going to modify this system so I can send out site-wide alerts and notifications for these important matters. You'll know when this system is finished because you will receive a notification (hopefully in the next few days) with information contained in these news posts and a reminder to change your password.

 

Following on from that, beginning next week we're going to bring forward work we had planned for the middle of next year in regards to our forum system. We aim to devolve more functionality away from our off-the-shelf Invision Board forums and into our own custom coded system that will allow us to have complete control over the member database and login security. Essentially, transitioning away from account security being controlled via the forums to account security being controlled via our own custom coded systems. Not only will this mean you no longer need to visit the forums to change your details, but it will also allow us to implement much stronger encryption of user data, Two-Factor authentication (no details as yet, but right now we're leaning towards Google Authenticator that will allow you to generate secure codes from your smart phones) and lots of our own custom touches that should make things a lot more secure in the backend. Idea being that even if the worst were to happen and another dump was released to the public, we'd make it absolute hell for anyone looking to crack the data.

 

And lastly, I'd like to thank you all for your response to this mini-crisis. Your words of understanding, support and encouragement, both publicly and via the outpour of private messages I've received have helped to stem the horrible feelings of disappointment in the announcement of this leak and provided me with added resolve to work my absolute hardest to get this sorted. I've said it plenty of times before, but I'll say it again; it really does make a massive difference when the people you're looking to do good by are as understanding and supportive as this community is.

 

i just login for the first time in ages and now i can't even get passed the page which you put up telling us about this hack thing any suggestions?