Unwanted visitor

As the sharp user might have noticed, then a few weird news posts were posted around 15:00 Saturday, these were the result of a user gaining access to certain information. I believe in full disclosure so I will try to explain you all exactly what happened, and what we have done to prevent it from happening again.

First of all I will however say what data was stolen, emails and encrypted passwords were taken for around 1500 users, from the pattern of the traffic it looks like the hacker was trying to get access to admin accounts. The 1500 affected users will be contacted when we get them enumerated. I will explain later on why encrypted passwords should still be changed, and why they are vulnerable.

First let me explain how this could happen. When you have a big website you need a database backing it to store userinformation, matches, blogs, news posts and so on. Whenever you access this database from PHP you send a query asking for some data, some of these queries are generated dynamically e.g. if you want to see the profile page for my user, then it will fetch the data from userid = 1. This however means reading information provided by the user, and the user really cannot be trusted not to be evil. So what you do is make sure that the input you get and send to the SQL server is properly formatted, and not in a form that can harm the database, or disclose data. In common talk this is called sql escaping. If your escaping is not done, then your site is vulnerable to sql injection.

As I am a 5th year computer science student I of course know all this, and the site has sql escaping, but in the around 16.000 lines of code touching the database, some escaping was lacking, solely due to human error. This meant that simply by constructing a bad HLTV.org url you could access any data in the database. There is no excuse for this, and I am very sorry for all the affected users.  A security hole like this is not up to the standard that we set for ourselves here at HLTV.org, and I would step back as the webpage coder if there was anyone to take over. From the serverlog we can see exactly what info was accessed, which is why I can say so surely that “only” 1500 users of the approximately 135.000 users in our database were hit.

Now I said the passwords were encrypted, and they were, the problem however is that the encryption was written long ago, and by a coder that has long since left HLTV.org, he unfortunatly did know to encrypt passwords, but not how to do it properly. The “encryption” used is called hashing, and it is very safe. It basically works this way, in comes a password, say “123”, it then spits out a generated string that will always be the same for the input 123, the hashing we use is called md5, md5 would in this case return 202cb962ac59075b964b07152d234b70 for the string 123. The smart thing is, if you just get “202cb962ac59075b964b07152d234b70” calculating what the real password is, is very hard. Except for one thing, a thing called Rainbow tables.

Rainbow tables are basically collections of md5 hashes and strings, so you have a big table where you can do lookups with md5 strings and then get the plaintext password back. e.g. you find one and enter “202cb962ac59075b964b07152d234b70“ and it will return 123, this only works for precomputed strings, normally people compute the hash for all words in a dictionary and stuff like that, things that are normal as passwords. This means that if you have a weak password, the hash is not safe. There is of course a way to get around this, namely to include something extra after the password, so lets say your pass is 123, then the coder should add something after, called a salt. In this case maybe we want to put on: unhackable, making the password we take a md5 hash of: 123unhackable. It is very unlikely that a Rainbow table would have that string. Sadly this was not done for the HLTV.org login system, so rainbow tables can be used to attack the encrypted passwords. I have fixed this problem and will roll out the fix tonight, meaning if anything like this ever happens again, then your password is impossible to break, too late I know, but the best I can do.

So for good measure, you should all change the passwords here on HLTV.org, and other places you have used the same password. I will compile a list of users as soon as I get a little time, but until then I recommend that everyone changes. Again I want to stress that “only” 1500 users were affected.

I cannot tell you how sorry I am for this, and I spend the past 3 hours running through 16.000 lines of code to check for exploits of this nature. Sadly when you run a high profile website, running a free service, only trying to do good, some still think hacking and attacking such sites is fun for god knows what reason. It really saddens me that the user did not contact us about the issue instead of exploit it. I guess no good deed goes unpunished. Sadly I think the motivational hit to the crew at HLTV.org will be a much bigger loss than the data lost.

So, HLTV.org was hacked, go have a field day rakaka.