ROM Hack PSA: "That ISO site" was hacked, exposing emails, usernames, IP addresses, and salted passwords!

[Rhapsody]

Information has recently come to light that "that ISO site" has been hacked (both the Wii U and 3DS variants), leaking emails, usernames, IP addresses, and salted MD5 passwords. This breach occurred in September of 2015. While this is a big deal, you're probably wondering, why post this here?

I realize that, even though we don't like to admit it, a lot of people download CIAs and ISOs from that site. From that, you can make a logical connection that most people are probably going to share their username and password with their GBATemp account and their "that ISO site" account, and sometimes even their email account. With that being said, this is a warning; if you use the password you use on "that ISO site" ANYWHERE else, you need to change the password immediately, or risk your account being compromised. I personally think that getting hacked because of a piracy site leaking details is a terrible way to go, but that's up to you if it happens.

"But Rhapsody," you ask, "you said the passwords are encrypted with MD5 and salted. There's nothing to worry about, right"? In a way, yes; CrackStation puts it best;

A password hashed using MD5 and salt is, for all practical purposes, just as secure as if it were hashed with SHA256 and salt. Nevertheless, it is a good idea to use a more secure hash function like SHA256, SHA512, RipeMD, or WHIRLPOOL if possible.

In other words, while your passwords aren't technically out there in plain text, it's still a good idea to change them. On the off-chance "that ISO site" was salting improperly, your password is easily crackable. To be safe, you should take the following steps;

1. Use a password manager like KeePass or LastPass so you can use unique passwords on each site.
2. Change your password on any site where you shared a password with "that ISO site", especially your email and GBATemp account if they do.
3. Ensure that your account hasn't been hacked. If it has, assess the damage, and, if possible, start cleaning it up.
4. Subscribe to https://haveibeenpwned.com/ on any email addresses you use to be aware of new major breaches.

I know that this is a lot more effort than normal internet users will want to put forward, but for the sake of keeping your accounts secure, you should really change your passwords now and make sure they're all unique, so something like this won't worry you. It's a lot easier when it's all set up.

 

[DeslotlCL]

Time to change my passwords :v

 

[Raylight]

that was a year ago if you signed up after that event your safe

 

[Pacheko17]

Oh, that was in 2015. You bloody scared me mate. I signed up in January 2016.

 

[Raylight]

Oh, that was in 2015. You bloody scared me mate. I signed up in January 2016.

lol same

 

[AshleyCummings]

Wait I log into that site with my Facebook x.x great ...

 

[Rhapsody]

Wait I log into that site with my Facebook x.x great ...

If you log in via alternative methods, that shouldn't be an issue, since it never shares your password with the site (only a unique identifier). If you've ever signed into a website with Steam, it's just like that.

 

[Sliter]

I don't remind when I subscribed there but I hink I have som work to do when I get home ... I think the pass are different but I don't remember XD

Subscribe to https://haveibeenpwned.com/ on any email addresses you use to be aware of new major breaches.

how this works?

 

[Scarlet]

;___________;

Of all the bad times to have joined eh? Ah well, pretty sure the password I have there is unique anyway. Gonna start using alias addresses in future and just delete them once I've made an account.

 

[Rhapsody]

I don't remind when I subscribed there but I hink I have som work to do when I get home ... I think the pass are different but I don't remember XD


how this works?

Haveibeenpwned is a site that looks through information leaked in large website breaches, and tells people who search their email address what leaks they were involved in. It doesn't provide any of this information to anyone else.

 

[Deleted-379826]

I don't remind when I subscribed there but I hink I have som work to do when I get home ... I think the pass are different but I don't remember XD


how this works?

They will send you emails about all breaches they know about

 

[Justinde75]

Good that I joined back in Febuary

 

[LooneyElsa]

I knew this would happen.
That's why I use a simpler password. Always use simpler passwords for hacking communities/warez etc.
Cheers.

 

[The Catboy]

Eh, I may have joined after the hack, but it was time to change my passwords anyways.

 

[DinohScene]

Another reminder why I don't sign up quickly.

 

[ThunderbInazuma]

Really? I signed in in October xD

 

[Dimensional]

It's a good thing I've never been on there. Kind of hard to have an account to be breached if you don't go there. Then again... I have no clue what the site's name is, so.... *shrugs* Not that I'm going to ask around.

 

[hyprskllz]

What about the PSP and PS3 site? Is it hacked too?
My PSP site account has been since about 7 years ago.

 

[yuyuyup]

hooray I used a burner email but thanks for the reminder

 

[Thunder Kai]

Joined 1-6-2016