theiving members, major bandwidth!

[raymor]

Originally Posted by xenigo

I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.

Probably 30% of all PHP scripts used by webmasters have a security
hole that will allow an attacker to do exactly that. I see this happen all
the time. (The reason I see it is because I'm the guy webmasters call
for help when it does happen.) You CAN secure your password list
using any of several different methods, most of which involve using stronger encryption such as an MD5 hash. I wrote a page for the Strongbox
manual covering this tooic today, but I left it in the car and I'm on my way to
bed right now, so email me at support@bettercgi.com if you'd like to
loook that over. Strongbox would help you determine if the user himself
leaked the password or if the list was cracked by giving such information
as how many other usernames were compromised at around the same time.
If you have 1,000 members and only this password got posted, and if
this is a also a secure password (long enough, not based on an English word),
he probably gave it out. Onb the other hand, if many different passwords
were posted on the same day the list was probably cracked.
Another possibility is that a cracker got it using a dictionary attack.
If for example his username was "john" and his password was "password"
then the attacker probably guessed it using an automated guessing program
(called a dictionary attack). Definitely chnage the user's password and then
watch what happens with his username in the future.
We'll be standing by to install Strongbox whenever you're ready.