Here's NoahSD's blog about it:
http://www.nsdpoker.com/2012/04/two-plus-two-hacked/
Quote:
The Two Plus Two Forums have been hacked, and the forums have been taken down by the admins to prevent further damage. The hacker has gained access to a list of usernames, e-mails, hashed passwords, and password salts. While hashed passwords and plaintext passwords aren’t quite the same thing, the combination of the hashed password together with the salt makes it possible for the hacker to find plaintext passwords. (This is preventable, but vBulletin’s default hashing algorithm is md5, which is completely insecure against this sort of thing–and other things.)
I'm still not sure how the hacker got the password salts.
Basically, when a password is hashed (encrypted), you can add a "salt" (another combination of character) on the end of the hashed password, and then hash it again. This makes it very hard to crack the encryption unless you have the salt.
I have read on some vBulletin hacking sites that it's possible to deduce the salts and break the hashed passwords, but I wasn't sure if that was actually true. Noah claims that the hashing algorithm (md5) is "completely insecure" against this, which I suppose is possible. I was reading that on some of the hacking sites, as well.
Here are Noah's suggestions (and my commentary after the -- on each one):
- "If you use the same password on 2p2 and some other site(s), change the password on the OTHER site(s) IMMEDIATELY" -- I agree.
- "Do not change your password on 2p2." -- I don't agree. Noah claims that the hacker might be able to see your new password, which I agree is possible. However, he also might not. If you change the password to something you don't use anywhere else, you can't be any worse off than not changing it at all.
- "Change the password on the e-mail that you use for 2p2 to something secure." -- I agree if you either have your e-mail password the same as you have on 2+2, or if your e-mail password is a dictionary word, or something else simple. Otherwise, I feel this is overkill.
- "Change your other important passwords similarly." -- I think he's talking about things associated with that specific e-mail address, such as poker accounts. Good advice, but again, only bother with this if your password is easy or a dictionary word.
- "If you’re a high stakes player, a moderator, or otherwise someone whose account may have been interesting to the hacker, worry about what was in your PM box." -- Yup, but I don't know what you can do about it at this point. If you had private conversations there that might end up being shared with the world, either brace for the consequences or pray that it won't be shared anywhere.
Now here's my additional advice:
If you still play online poker, and you have any accounts registered to the same e-mail you used on 2+2,
log into your online poker accounts immediately and change the registered e-mail. This is because e-mail itself can be hacked, even if your password is otherwise well-chosen. For example, some people can easily break into any AOL account of their choosing. Yahoo e-mail has also been compromised before, as has e-mail attached to internet service providers.
I would suggest creating a brand new Yahoo or gmail account, give it to no one, and change your e-mail to that account. Obviously don't enter this e-mail address anywhere on 2+2. Nobody will bother hacking it because nobody will know it exists.
If your 2+2 account is registered to a different e-mail than you use for online poker, or if you don't play online poker anymore, I wouldn't worry about this.
