Ethereum.org Forums Database Compromised | Hacker News Reader

Ethereum.org Forums Database Compromised

blog.ethereum.org

49 pointsuptown10 comments

So glad that when they realized they made a mistake they immediately came out and said exactly what happened, and the detailed steps they are taking to fix it. Nothing but respect for them.

Haha in complete contrast to what Yahoo prob would have done. (Given that Yahoo is a much larger company with more legal and bureaucracy so they may be unable to do this. but still, 3 yrs???)

> The attacker used social engineering to gain access to a mobile phone number that allowed them to gain access to other accounts, one of which had access to an old database backup from the forum.

Forgive me if I'm missing something blatantly obvious, but how was a hacker able to gain backup access with just a phone number? What kind of auth is that?

2FA with SMS?

It's a thing. Google uses it, Paychex and Adp too. Just about every really big one uses it for two factor.

Are you asking what it means or disagree with it?

If a: 2-Factor Authentication with Short Message Service (called "text" in the US).

If b: It's how Google's 2FA works by default, falls back to SMS.

Basically, getting control of (i.e. stealing) the 2nd factor in the 2FA scheme, and bypassing the 1st factor, the password (by resetting it). Plausible.

It looks like Google uses SMS for account recovery, could have been something like that.

https://support.google.com/accounts/answer/183723?hl=en

Presumably something along these lines:

1. attempt to log in to target's email system

2. "I forgot my password"

3. get 2FA key via SMS

4. enter 2FA key and new password, gain access to email

5. attempt to log in to target's backup system

6. "I forgot my password"

7. get password reset key via email...

To be fair to the Ethereum folks, this is the least embarrassing way to be compromised - that is, when it isn't your fault.

Yes, and also when it is unrelated to your main service.

wow, what a terrible year for Ethereum.

Reply on news.ycombinator.com