In the very early morning of 8th November 2019 we noticed suspicious activity by a potentially malicious third party actor against our services. Using an exploit in our legacy codebase, our logs confirm that they accessed a small number of user records from the old user service.
Even though we were able to secure the endpoint as soon as we discovered the exploit, as a measure of security, we are informing all of you, as we cannot rule out that further access to other user data including email addresses, password hashes and password salts has taken place.
We immediately worked to rectify the situation and, as part of the process, brought forward our release schedule for our long-planned new user service to ensure no other potential exploits on the old user service could be used to obtain user data. This step we took is ensuring that the new passwords are not only better protected, but that any encrypted passwords that have - potentially - been obtained from the old user service are already out of date.
Further, and as is required by law, we have informed the ICO about this incident and we are in the process of fulfilling our obligations related to the matter.
What does this mean for you?
While we noticed the suspicious activity on 8th November 2019, and we have no evidence of past activity in our logs, we cannot say for certain whether the exploit had been used before, and thus cannot ascertain how many - if any - email addresses, password hashes and salts were accessed.
Recognising our obligation to all of you, however, we are strongly urging you to be vigilant of potential phishing and credential stuffing attacks.
General Recommendations
- If you haven’t already, please log out and back in, in order to update your account and password and migrate to the new user service. If you’ve already used the new user service, then there is no need to change your password again.
- If you were using the same password you had on our old user service on other sites, please, change your password on these other sites as soon as possible.
- We strongly recommend using a password manager and to not reuse passwords across sites.
- Always use unique and strong passwords of at least 12 characters for each service you use.
- Consider using Two-Factor Authentication, especially if you are a mod author.
287 comments
Comments locked
A moderator has closed this comment topic for the time beingBut now the attitude is forcing passwords security and what not, which wasn't the problem on the first but a security issue on their side... Surely I'm not gonna give them a good password so that they can lose it again... So now I have totally forgotten which my original account pasword was and I'll be using a new fire and forget account whenever I need one to download heavy mods, make a question in a mod page or see adult content... Which I think is not what nexus teams wants us users to do... but in the new envyroment is what I am going to do...
And what's funny is seeing supposed security people talk about brute forcing like it's still how accounts get cracked. "Gotta make the passwords harder to guess!" as if anybody's trying to guess it. Nah, legit hackers don't brute force anymore. If they want your password, they send you phishing e-mails, malware with keyloggers, malware that takes advantage of password manager vulnerabilities (and you thought that would keep you safe), or the real good ones take advantage of website vulnerabilities to steal hashes (oh, look, what happened to Nexus). I do still see brute force attacks, but only in business and they're pretty lazy attacks against outdated protocols where the attacker figures "if they're still using PPTP then they're probably using stupid simple passwords".
But what this really boils down to is Nexus screwed up by having bad security and instead of fixing their $%^& they make their users jump through hoops that meet (outdated) "security best practices" but don't actually improve security.
MFA? started looking into that. But umm... where do I get the other piece from? My home phone? That is about all I have to get something else on.
Hardly, everything is possible... but that's stuff which should be common practice by now and luckily is for many companies handling sensible data.
In fact you could go in your windows computer right now, and delete an important file you need in order to operate your computer, and completely destroy your software. If you can do this, a hacker can do the same thing.
No, the real thing that needs to be protected is not just the data, but the actual database. In where if software is compromised, it can easily affect the company. From what I'm seeing, nexus mod's website is still slightly old fashioned compared to what could be improved, this is just from a glance.
In terms of constant mod manager updates, you gotta keep in mind that the actual files for the mods are also old fashioned, and if it isn't, trust me, it will be, I'd be shocked if it wasn't) , and so the way they're handled can be old fashioned as well.
Not every user on the nexus is computer savvy in wanting to upgrade to vortex, many are nervous they'll lose their mods, even the slightest change can destroy their whole game. It's that finicky, and so it's very stressful for them to not only create a hard to remember password that usually doesn't stop hacking attempts, but upgrade to completely new managers while installing, uninstalling mods. Very stressful!
This discourages new users, and makes old users wanna move on.
Also another vulnerability, there are many spam users that serve as bots. With Hackers becoming more advanced in programming, and not to mention desperate, they're finding new ways to get their software to get past the CAPTCHA, I think they're Youtube videos that show programs doing this. This combined with a super fluency of bots can further harm the confidentiality of the network.
The bots are the huge portion of why the nexus is being compromised so many different ways. As time goes on, these new gen bots capable of passing CAPTCHA (so like over 1,000 bots able to do this) this is gunna butcher the entire site and be very difficult to keep up with, as I'm sure admins do all day is remove fake user accounts for spam.
I can go on about what different improvements can be done.
Another fun note for those who wanna keep reading, it talks about the utilization of demilitarized zones
This allows good traffic, such as coworkers and staff, while preventing malicious entry from gaining access such as black hats or script kiddies
If you think about it, an overpowered password system begins to take the role of an overpowered dmz, in where users can't get in as easily, and have a hard time gaining access to their house(the network; their user profile) A bank their serves like this for good reason, however they too struggle when their customers can't gain access to their account when they need to. Its a give and take, the more money a criminal is likely to steal, the greater you need to make your dmz. The less likely a robber will get away with much, the more laxed a dmz can be to allow a continuous flow of the company, and a smooth availability of the network.
Regardless, I barely have any trust in this site anymore . Of course I still use Nexus, but I find it funny the site actually wants us to buy premium for faster downloads when I would not even trust this site with a phone number. LOL
This comes from 5+ years of personally USING THEIR SOFTWARE. Their code is so filled with bugs that it's a miracle that my PC hasn't required me to reinstall Windows from scratch yet.
(not listing every issue I have with Avast - the final straw I had with 'em was with their exclusion system not working AT ALL - quarantining files THAT I PUT ON THAT LIST as "malicious & dangerous" - EVEN THOUGH THOSE FILES WERE 100% CLEAN.)
https://www.vice.com/en_us/article/3a8vjk/czech-data-protection-authority-investigation-avast-jumpshot
Thankfully; Microsoft's previously poor AV products have much improved, so I use that for basic cover now. Malwarebytes is a solid product for all the stuff which gets through the cracks. Even the free/trial mode is a life saver. Sometimes I use Sophos too (as I get home license coverage from work). It's always been very solid (due to good support - not just the client software), but it can be a bit over hard on the machine performance for gamer type scenarios. It's best left on your 'work' machine..
Don't make suggestions if you don't know what you are talking about. Windows Defender isn't a bad anti-virus product in real-world scores, it's better than nothing, but it isn't better than Avast. Avast consistently scores better in real-world tests and has less performance impact.
See for yourself:
https://www.av-test.org/en/antivirus/home-windows/
https://www.av-comparatives.org/consumer/
If you aren't an IT professional, don't hand out anti-virus recommendations.
For future use, you can use a free tool called CCleaner from Piriform to clean the caches of multiple browsers at the same time, and the Windows system temp files:
https://www.ccleaner.com/ccleaner/builds
https://www.vice.com/en_us/article/wxejbb/avast-antivirus-is-shutting-down-jumpshot-data-collection-arm-effective-immediately
There are many alternatives, including free ones (e.g. "Windows Defender", which is built-in to Win10) that do a much better job.
Windows Defender scores in the middle of anti-virus products on the market, in real-world AV tests. . It's better than nothing, but it does not do a much better job than Avast or AVG, both of which consistently score near the top.
Ppl who use one password for everything are playing with fire, just like people who use easy-to-guess passwords and PIN numbers.
Don't use any personally identifiable information in your passwords, bible verses, famous quotes, lucky numbers, easy-to-guess number combinations (12345, 77777, 6969, birthdays, SSNs, etc.) If someone can go on your social media page and write down everything they know about you and break the password, it wasn't a good password.
Yet another know it all that thinks everyone should have the same grasp as he, let me tell you something, people are different and and MANY can't remember what they go to the toilet for... not everyone has the same outlook as you.
Of the 20 million folks here a good number of them wouldn't understand what the hell you were talking about, they might not have spacebook, facetube or even read the bible.
You're preaching to those that already understand and others that ain't listening and don't care.
I've used the site for 15 years and I still know nothing.
working in the mental health industry for a decade gives you a different outlook on peoples understanding and their desires, they are in many cases at very different levels.
Now, I say if you have 20 million peoples details, details that you demand when they join, it should be up to you to keep those safe, not each and everyone that you enticed in.
I also think posting what you did and the way you did it is completely unnecessary, as @amadeuskun wasn't specifically bashing anyone but in fact was sharing information that could potentially help someone in a situation of having bad passwords.
I downloaded the file and ran it. Since then, penis extensions offers have been sent to my (dummy) email address
Well the site knows exactly with user is premium and who isn't. So why when clicking download it takes me to a sub site to choose slow download or fast download. I think people here made a bad decisions and users will gonna quit not only because of their usernames and passwords but also because of the psychological forcing to buy a premium subscription. Staff add only a button, but what the future will brings? 30 seconds timeout with ads for free users next?
Dear Nexus please stop where you are now because you choose the wrong side. The year 2020 should be better not worse! Do not let this happen.
P.s. The subscription lifetime plan is little to expensive, make a promo.
I have paid in the past (under a different account, which is gone now hence the new one; I used to be under the user name "centime") for a premium account, but this hard sell guarantees that I never will again. And I also agree about the price of a lifetime subscription...49.00 UK exchanges to $64.74 US; too much for a game modding site (in my opinion, which counts for nothing to anyone but me). Perhaps if I were younger...
Call me whatever you like, but there is no need for pushing our faces down into the idea of paying for a subscription. Again, we all know how to do it and what is at stake if we don't, but this new tactic will, I believe, turn off a lot of would-be financial contributors to Nexus. This has left such a bad taste I don't think I will be here for too long anyway. Greed is, to me, the most ugly of human attributes.
As you can see your account is not Premium. Perhaps you had another account with a different email address?
Send a copy of your purchase invoice to [email protected] and we'll help you track it down.