Suspicions de hacking sur Doomworld, changez vos mots de passe

Salut à tous,

Une info concernant les utilisateurs du forum Doomworld : apparemment, le site a été hacké.
Voici un message de Linguica, administrateur du site :

Linguica, sur Doomworld, a écrit:

As you may have heard by now, Doomworld (probably) got pwned by a script kiddie. I don't know what databases were accessed but they claim email addresses and password hashes, at the least. I will be looking into this further of course.

To summarize what you should know about your account:
- We don't store your password directly, but the output of a salted and hashed one-way algorithm. You can change your password if you wish but no one should be able to decrypt it anyway.
- If you signed up using an OpenID service like Twitter, Google etc, we only store some sort of token, no password or password-related data ever touches our end, so you shouldn't have to worry.
- The forum's admin panel uses 2-factor authentication so I don't particularly think that anything sensitive could have been accessed or changed that way, but if someone exfiltrated the database via other means it wouldn't really matter.
- As the admin, this is ultimately my fault, and I am very sorry it has happened. I will have to consider this and consult with others to decide what sort of site changes need to be made to help fix this situation. In general this is a good opportunity to consider your password hygiene and begin using a password manager with unique passwords if you haven't done so.

En gros, même si les mots de passe des comptes utilisateur ne sont pas visibles en clair, on vous recommande de changer votre mot de passe Doomworld de toute urgence.

On a vu ça, l'info a été relayé sur le Discord (celui de la CFD) avant de voir ce fameux bandeau.
Je doute que des passwords haché soient exploitable, sauf si l'algo de hash est MD5, là ça craint.

Bon évidemment, on est jamais trop prudent. J'espère que les admins ont au moins de l'aide de développeurs/DBA (de métier) pour aider à la sécurité

Ouais, normalement y'a pas de risque, mais c'est l'occasion de changer le mot de passe (un truc qu'on ne fait jamais assez souvent).