Breach Disclosure: Demon Forums

DemonForums is a cybercriminal hacking forum that has existed since November 2015. The forum describes itself as “..a community forum that suits everyone. Based on general, gaming and computing discussions. Also providing leaks, resources, tools, software, tutorials and much more”. Several reports claim it was hacked on or around November 2016, where a snapshot of its source code and database contents was shared on a partner website. The leak itself contains 52,000 rows of usernames, email addresses and salted md5 passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The original post for the leak occurred on LeakForums, and subsequent posts were made on competing forums, such as RaidForums. Most of these posts for the leak contained a singular SQL file with database contents from Demon Forums. Some posts, however, contained a zip file with the source code enclosed inside. The database itself also contained the salts used per hash per user, so cracking the passwords is a much easier endeavour given that they are using md5, a weak cryptographic hashing algorithm.