Breach Disclosure: D3Scene

D3Scene, a gaming website and forum, was breached in January 2016. The forum is known for discussions on how to cheat in online video games, bypass various anti-cheat gaming clients and how to abuse these various platforms. The breach data contained approximately 568,000 rows of email addresses, IP addresses, salted md5 passwords and usernames.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The passwords were stored in salted md5 format, which helps protect against brute force attacks. Md5 has known weaknesses that reduce the search space for brute force significantly, so the format is still not ideal for protecting user data.

A recent thread on the forum by user Sifex talked about the breach being added to Have I Been Pwned. The user questioned why D3Scene does not force https on the website. An administrator's hand-wavy reply did not address the forced-https question:

I think we were aware of that breach and prompted every user to create a new password which we did continuously for a good amount of time.

On top of that we updated the forum software again to prevent future hacks.