2

Generic moderators work and do countless tasks and most don't even get paid for it. However, on my community one moderator came to me and told be the website's myBB installation was being hacked. Does this mean the "hacker" could find a way to "hack" into a Steam account? All my moderators are, strangely, "worried" about their Steam accounts. And I, As the community manager (CEO/Founder), must found out a simple question; Can this hacker REALLY hack my Moderator's steam account?

Improve this question
2
  • This is a very broad question without a lot of details. Based on your comments to the answer provided, you seem concerned about a hack but don't mention why or any further details. I've closed the question so that you can provide some of those details and we can provide better answers.
    – Andy
    Commented Sep 1, 2014 at 22:14
  • 2
    @Andy I agree with closing this question, but not about the reason. This question is not too broad, which is proven by the answer it received. It is simply off-topic and belongs on security.stackexchange.com
    – Philipp
    Commented Sep 2, 2014 at 14:52

1 Answer 1

Reset to default
2

The answer to this depends on a few things. Firstly when you say he hacked your myBB forum, did he get into your database? Did he get access to your admin control panel? Did he get a full list of users and e-mail addresses?

If he only managed to deface your site, injected a few thousand posts or something like that, but didn't get access to any private information and didn't hack any admin accounts then you're fine. He's got nothing to go on.

Assuming the worst, that he got everything and that you store users steam account names as additional info against their profile, then to hack their account they need access to the e-mail address that is tied to the steam profile. Lets assume that it's the same e-mail address as used on the myBB forum, as most people will do.

Assuming the user has gotten the full database, hashed passwords and salts, then unfortunately for you myBB only uses MD5 for hashing passwords, which in this day and age is just not enough. Creating a rainbow table to guess common passwords when you know the salt is very simple for a hacker. They'll get most common passwords in a few hours, more complex ones in a few days.

Next they can try those passwords against the e-mail address and steam account. If someone is foolish enough to have used the same password everywhere, then the hacker now has access to everything. If they've used different passwords, well the hacker is still stuck at needing access to their e-mail stage. From then on it's a case of can they hack their e-mail account.

So are the steam accounts at risk? Yes, possibly. Is it likely that the hacker will get in, probably not unless it's an absolute worse case scenario where they got everything and the user was stupid enough to use the exact same, easy to guess password everywhere.

Improve this answer
5
  • Something that wasn't mentioned, but if the MyBB is using Steam's OpenID to login, then the passwords are not stored on the board because the board never sees them.
    – Andy
    Commented Sep 1, 2014 at 21:23
  • Hm. Okay. My moderators do not use the same password everywhere, However, Is it possible that the hacker could "guess" a steam password?
    – user424
    Commented Sep 1, 2014 at 21:23
  • @MarkieJonesWTF Is it possible you could "guess" a steam password? Why is a hacker any better at guessing than you? It's possible they might try commonly used passwords. Just Google common password list, that's what your hacker would do.
    – Styphon
    Commented Sep 1, 2014 at 21:28
  • @Styphon My password isn't common. It's more random than common. if they could not use mybb or common passwords, is there any way? at all?
    – user424
    Commented Sep 1, 2014 at 21:32
  • @MarkieJonesWTF There are only two ways, one is to use the password reset, for which you need access to the persons e-mail. The second is to convince support that you own the account and have lost access to your e-mail. Good luck with number two, you'd need a lot of proof for that. Hackers don't go around "guessing" passwords to hack things. That's called a brute force attack, and most sites have protection against it, including steam.
    – Styphon
    Commented Sep 1, 2014 at 21:37