Database Breach - An Update

[Dark0ne]

I promised I'd update you all on the possibility of a database breach on Nexus Mods that I announced yesterday morning and I am here with relatively "good" news.

 

I am now in possession of the database dump, that was first reported on Reddit, via university security networks, and I can confirm several things. First, the database dump is "old", with the last member in the database having registered on July 22nd 2013. If you're one of the 4.2 million users who registered on Nexus Mods after this date, your details are not included in this database dump and are therefore considered "safe". Second, the database dump isn't a complete database rip. The dump contains user IDs, usernames, email addresses, hashes and salts, and that's it. It does not contain cracked passwords i.e. anyone with access to the dump would need to attempt to crack the hashes and salts themselves in order to get any sort of use out of them on the site.

 

From this we can conclude a further two things. Firstly, that it's relatively safe to assume that whoever made this dump no longer has access to our database. Why? Because if they did, they'd have released a much more up-to-date dump of our member database. It would make sense they no longer have any access, considering we've patched up a lot of holes, applied countless security updates and switched to a far more secure database cluster system since July of 2013.

 

Second, if you've updated your password since July 2013, your account on the Nexus sites should be safe and secure, as they will not have your new hashes/salts/password information. If you have not updated your password recently, please do so now as I am now personally confident that there have been no recent breaches of our network or databases. Similarly, if you still use the password you were using in July 2013, or before that date, on any other sites or services you should update them immediately.

 

I would like to thank the HPE Security Research team who have personally helped me with this investigation and who securely provided me with the database dump as part of this investigation. Their help has been invaluable.

 

My previous news post also mentioned three compromised mod author accounts that had uploaded a suspicious file in place of legitimate mods on the site. I have been in contact with one of the owners of the compromised accounts personally, along with another individual who I know was compromised recently, and both were using extremely simple passwords. Passwords that would take a simple cracker mere seconds to crack. This helps to confirm that whoever is using this information is going for high-profile, but extremely easy accounts to crack.

 

To my knowledge, we have not seen any further suspicious activity in the file database at this time.

 

The malicious file that was uploaded, "dsound.dll", has been sent away to the malware research team at HPE Security Research to find out what it does and, hopefully, spread the word so it can be flagged by anti-virus software appropriately. Once again, a big thank you to the HPE Security Research team. They've provided an excellent service.

 

While we would like to force everyone to update their passwords so we can be completely in the clear when it comes to this breach, the only way we could force a password update is to make everyone's password invalid on the site and force you to do a password recovery via your email address. While that might be OK for our newer members (who this doesn't even affect), I imagine there are thousands, if not hundreds of thousands of users on this site who have signed up with email addresses they no longer have access to and would, instantly, become completely locked out of their accounts with no way of gaining entry back. So we have a bit of a conundrum in this respect, and I'm not entirely sure what to do.

 

In spite of the fact we think that we're "in the clear" on the possibility of a recent breach, we're not going to sit back and pretend like we couldn't be doing more. This scare has given us a real kick up the backside, so we're putting aside our work on the front-end for our NMM Profile Sharing at this time so we can focus on some improvements.

 

In the short-term, we've already begun work on more verbose logging of user actions on the site, especially in regards to logging the IP addresses you login with and use when performing major actions, such as uploading or removing files to the database. This should allow us to more easily analyse and spot suspicious activity on the sites when it occurs. If someone who previously used a static IP address for years starts making wild changes to all their files using IP addresses traced back to TOR, it's safe to say we're going to find that suspicious and will react accordingly.

 

We're also working on a system that will allow us to notify you, the users, when something as important as this comes up again. As it is, we have the functionality to send "full page notifications" to individual users when we want to make sure a user gets a message. Imagine a Private Message, but one you're forced to view and tick a box saying you've read the message, before you can browse the site again. While we can send these to individual users, we can't send this en-masse to every user of the sites, so we're going to modify this system so I can send out site-wide alerts and notifications for these important matters. You'll know when this system is finished because you will receive a notification (hopefully in the next few days) with information contained in these news posts and a reminder to change your password.

 

Following on from that, beginning next week we're going to bring forward work we had planned for the middle of next year in regards to our forum system. We aim to devolve more functionality away from our off-the-shelf Invision Board forums and into our own custom coded system that will allow us to have complete control over the member database and login security. Essentially, transitioning away from account security being controlled via the forums to account security being controlled via our own custom coded systems. Not only will this mean you no longer need to visit the forums to change your details, but it will also allow us to implement much stronger encryption of user data, Two-Factor authentication (no details as yet, but right now we're leaning towards Google Authenticator that will allow you to generate secure codes from your smart phones) and lots of our own custom touches that should make things a lot more secure in the backend. Idea being that even if the worst were to happen and another dump was released to the public, we'd make it absolute hell for anyone looking to crack the data.

 

And lastly, I'd like to thank you all for your response to this mini-crisis. Your words of understanding, support and encouragement, both publicly and via the outpour of private messages I've received have helped to stem the horrible feelings of disappointment in the announcement of this leak and provided me with added resolve to work my absolute hardest to get this sorted. I've said it plenty of times before, but I'll say it again; it really does make a massive difference when the people you're looking to do good by are as understanding and supportive as this community is.

[Sj456]

Thank you for the update.

[g4player25]

Glad To Hear

[tapioks]

Your forthrightness is very much appreciated. Glad to hear it's not a 3-alarm fire after all :)

[TheGreatFalro]

I've always loved the transparency you and your staff have. Thanks for the update!

[westsidekidd]

Dark0ne for president! This is how to handle a mini crisis. Good work. Keep it up!

[SnowyVee]

Good to know everything's good. o7

[JimboUK]

Thanks for the update, I've changed passwords across multiple sites since that date so I can rest easy.

[jpm22112]

Thank you for all your hard work, it is very much appreciated.

[zcul]

In response to post #31632815.

Dark0ne wrote: I promised I'd update you all on the possibility of a database breach on Nexus Mods that I announced yesterday morning and I am here with relatively "good" news.

I am now in possession of the database dump, that was first reported on Reddit, via university security networks, and I can confirm several things. First, the database dump is "old", with the last member in the database having registered on July 22nd 2013. If you're one of the 4.2 million users who registered on Nexus Mods after this date, your details are not included in this database dump and are therefore considered "safe". Second, the database dump isn't a complete database rip. The dump contains user IDs, usernames, email addresses, hashes and salts, and that's it. It does not contain cracked passwords i.e. anyone with access to the dump would need to attempt to crack the hashes and salts themselves in order to get any sort of use out of them on the site.

From this we can conclude a further two things. Firstly, that it's relatively safe to assume that whoever made this dump no longer has access to our database. Why? Because if they did, they'd have released a much more up-to-date dump of our member database. It would make sense they no longer have any access, considering we've patched up a lot of holes, applied countless security updates and switched to a far more secure database cluster system since July of 2013.

Second, if you've updated your password since July 2013, your account on the Nexus sites should be safe and secure, as they will not have your new hashes/salts/password information. If you have not updated your password recently, please do so now as I am now personally confident that there have been no recent breaches of our network or databases. Similarly, if you still use the password you were using in July 2013, or before that date, on any other sites or services you should update them immediately.

I would like to thank the HPE Security Research team who have personally helped me with this investigation and who securely provided me with the database dump as part of this investigation. Their help has been invaluable.

My previous news post also mentioned three compromised mod author accounts that had uploaded a suspicious file in place of legitimate mods on the site. I have been in contact with one of the owners of the compromised accounts personally, along with another individual who I know was compromised recently, and both were using extremely simple passwords. Passwords that would take a simple cracker mere seconds to crack. This helps to confirm that whoever is using this information is going for high-profile, but extremely easy accounts to crack.

To my knowledge, we have not seen any further suspicious activity in the file database at this time.

The malicious file that was uploaded, "dsound.dll", has been sent away to the malware research team at HPE Security Research to find out what it does and, hopefully, spread the word so it can be flagged by anti-virus software appropriately. Once again, a big thank you to the HPE Security Research team. They've provided an excellent service.

While we would like to force everyone to update their passwords so we can be completely in the clear when it comes to this breach, the only way we could force a password update is to make everyone's password invalid on the site and force you to do a password recovery via your email address. While that might be OK for our newer members (who this doesn't even affect), I imagine there are thousands, if not hundreds of thousands of users on this site who have signed up with email addresses they no longer have access to and would, instantly, become completely locked out of their accounts with no way of gaining entry back. So we have a bit of a conundrum in this respect, and I'm not entirely sure what to do.

In spite of the fact we think that we're "in the clear" on the possibility of a recent breach, we're not going to sit back and pretend like we couldn't be doing more. This scare has given us a real kick up the backside, so we're putting aside our work on the front-end for our NMM Profile Sharing at this time so we can focus on some improvements.

In the short-term, we've already begun work on more verbose logging of user actions on the site, especially in regards to logging the IP addresses you login with and use when performing major actions, such as uploading or removing files to the database. This should allow us to more easily analyse and spot suspicious activity on the sites when it occurs. If someone who previously used a static IP address for years starts making wild changes to all their files using IP addresses traced back to TOR, it's safe to say we're going to find that suspicious and will react accordingly.

We're also working on a system that will allow us to notify you, the users, when something as important as this comes up again. As it is, we have the functionality to send "full page notifications" to individual users when we want to make sure a user gets a message. Imagine a Private Message, but one you're forced to view and tick a box saying you've read the message, before you can browse the site again. While we can send these to individual users, we can't send this en-masse to every user of the sites, so we're going to modify this system so I can send out site-wide alerts and notifications for these important matters. You'll know when this system is finished because you will receive a notification (hopefully in the next few days) with information contained in these news posts and a reminder to change your password.

Following on from that, beginning next week we're going to bring forward work we had planned for the middle of next year in regards to our forum system. We aim to devolve more functionality away from our off-the-shelf Invision Board forums and into our own custom coded system that will allow us to have complete control over the member database and login security. Essentially, transitioning away from account security being controlled via the forums to account security being controlled via our own custom coded systems. Not only will this mean you no longer need to visit the forums to change your details, but it will also allow us to implement much stronger encryption of user data, Two-Factor authentication (no details as yet, but right now we're leaning towards Google Authenticator that will allow you to generate secure codes from your smart phones) and lots of our own custom touches that should make things a lot more secure in the backend. Idea being that even if the worst were to happen and another dump was released to the public, we'd make it absolute hell for anyone looking to crack the data.

And lastly, I'd like to thank you all for your response to this mini-crisis. Your words of understanding, support and encouragement, both publicly and via the outpour of private messages I've received have helped to stem the horrible feelings of disappointment in the announcement of this leak and provided me with added resolve to work my absolute hardest to get this sorted. I've said it plenty of times before, but I'll say it again; it really does make a massive difference when the people you're looking to do good by are as understanding and supportive as this community is.

I think, it's the way of being open for informing the community of any gaps and giving a pre-caution, instead of covering up anything as politicians tend to do. The Nexus team I think are not politicians. So far, thank you for informing us in time, regardless the possibility it could take effect on users or not. Better safe than sorry ... :smile: