Popular Usenet indexer NZBGeek has been hacked. The site’s database was copied exposing the personal details of all users. The hackers also managed to install a keylogger, opening the door to further abuse. The site’s operators recommend that users should secure their online accounts as well as credit cards that were used on the site recently.
From: TF, for the latest news on copyright battles, piracy and more. We have some good VPN deals here for the holidays.
Despite the growing popularity of pirate streaming sites and services, classic file-sharing tools continue to have a smaller but dedicated audience.
This is true for BitTorrent as well as Usenet. In the latter category, NZBGeek is one of the largest players as it provides an indexing service that helps users to find content.
NZBGeek is a private community to which users can sign up without any charges. However, those who donate get some extra features that will help to sift through the more than 500,000 NZBs indexed by the site.
NZBGeek Hacked
The site generally operates smoothly but last week something changed. After initially becoming unreachable, the problem was initially clear but after a while, the operators put up a message stating that there were hosting related issues. Yesterday, however, things turned from bad to worse.
“It’s with a heavy heart that we must admit that we have had a breach,” the site informed its users. “If you have recently used your card or payment with us we suggest changing your credentials and card info as soon as possible.”
Database Compromised
According to the site’s operators, the hackers were able to put a keylogger on the site and also managed to get a copy of the database. The compromised data includes user emails and encrypted passwords.
“The hackers obtained a copy of our database which includes your username, encrypted password, email address & last connected ip address. During this time we had the hard drive on our indexer fail along with an api server.”
NZBgeek advises all users to change their passwords and do the same on all other accounts where a similar password is used. PayPal payment data should be safe as long as it uses a unique password. However, the site does recommend that users who paid at the site via credit card since 20th November to take appropriate action.
Javascript Keylogger
TorrentFreak spoke to NZBgeek admin Jeeves who clarifies that the site doesn’t store credit card details. That said, the hackers used an SQL-exploit to install a Javascript-based keylogger, which left users exposed.
The NZB indexer is still investigating the hack and aside from the API, all systems are still offline. If more information becomes available it will be shared with the community.
Needless to say, the breach has caused quite a bit of concern among users. Some fear that their download histories will be exposed, which would be a concern, especially since their IP-addresses and other information were also compromised.
“I am concerned as I don’t know if other data such as download history was accessed,” an NZBGeek user informed us, adding that it’s not clear why the site would need to store IP-addresses anyway.
Next Steps
While it’s understandable that users would like to have more information, it seems that NZBGeek is still figuring out the scope of the breach themselves.
A hack like this one is a major setback but it’s good to see that the operators are being transparent and open. Other sites may have simply tried to cover things up, leaving users even more exposed.
NZBGeek is still figuring out what steps to take next but they tell us that more information on that will be made public in the future.
“We are taking massive steps, with the help of many community members around the world who are experts in various forms of cybersecurity. I am happy to provide those details as these are vetted and finalized,” NZBgeek informs us.
—
Update: NZBGeek informed us that download histories were stored on a separate server that had a disk fail last week, but it’s not clear if this was compromised. The site stores users’ most recent IP-addresses in order to combat abuse.
From: TF, for the latest news on copyright battles, piracy and more. We have some good VPN deals here for the holidays.
Noch mehr Geodaten können künftig frei genutzt werden. Für die Openstreetmap ist das aber nicht ohne weiteres möglich. (
Lenovos Thinkpad X1 Fold zeigt, wie faszinierend und praktisch das Foldable als Windows-PC sein kann. Allerdings gibt es noch viel zu tun. Ein Test von Oliver Nickel (
Nach Apple liefert Xiaomi als weiterer Hersteller Smartphones künftig ohne Netzteil aus - und der nächste folgt vermutlich in Kürze. (
Eine zweite Großkanzlei bereitet sich auf eine Sammelklage wegen Cyberpunk 2077 vor. Dessen Hersteller will sich "energisch" wehren. (
Auch ältere Playstation-Controller bekommen offiziellen Linux-Support vom Hersteller Sony. (
Ein Blick auf eine Betaversion von Harmony OS 2.0 deutet darauf hin, dass Huaweis Betriebssystem nichts anderes als ein Android-Fork ist. (
Die aktuelle Ruby-Version enthält außerdem Werkzeuge für Type-Checking. Der JIT-Compiler ist aber immer noch nicht überall einsatzbereit. (
You must be logged in to post a comment.