[Mr.Kurd]

In The Name OF Allah

Al-Salam Alekum

Another breach sadly people data get breached very easily...

On 12/28/2018 we’ve received an email regarding the popular online RP game “Town Of Salem”s breach. The sender, who wishes to be anonymous at this time, provided DeHashed with evidence of server access and provided the complete database for disclosure. We’ve reached out to BlankMediaGames regarding a statement and to provide assistance with securing their servers.

What is this game:

Town of Salem is a browser-based game that challenges players on their ability to convincingly lie as well as detect when other players are lying. The game ranges from 7 to 15 players. These players are randomly divided into alignments – Town, Mafia, and Neutrals. If you are a Town member (the good guys) you must track down the Mafia and other villains before they kill you. The catch? You don’t know who is a Town member and who is a villain. If you are an evil role, such as a Serial Killer, you secretly murder town members in the veil of night and try to avoid getting caught. – Wikia

The source provided further information later on:

Here’s an analysis of what we found. This is the first time the company has ever seen any kind of breach, ironically it was caused by a entree-level vulnerability known as “LFI” / “RFI”.

The data affected, includes but is not limited to:
Usernames, Emails, Passwords (phpass, MD5(WordPress), MD5(phpBB3)), IP Addresses, Game & Forum Activity, & Payment Information. With some of the users who paid for certain premium features having their billing information/data breached as well.
The total row count is: 8,388,894, with 7,633,234 unique email addresses.

Wa Salam Alekum

[mothered]

The good old RFI (Remote File Inclusion) vulnerability. Not surprised at all.

The nature of the data compromised, Is quite alarming. And that's only what they've made publicly known- we'll probably never know what else has been affected.

[Nyx]

I actually got an email about this for my own account. Not overly concerned with my personal information personally because I don't reuse passwords and I never entered any financial information anywhere whatsoever, but in general seeing another company get hacked and having data leaked is a pretty disheartening sight to see. It's easy to say companies should step up their security but that will never really stop hackers from finding a way in.

[Mr.Kurd]

The good old RFI (Remote File Inclusion) vulnerability. Not surprised at all.

The nature of the data compromised, Is quite alarming. And that's only what they've made publicly known- we'll probably never know what else has been affected.

Suprised me mothred how can a company with 8 M accounts having A hole like that?! it became something normal actually nowadays to see breaches of biggest companies but the exploit type suprised me.

[mothered]

The good old RFI (Remote File Inclusion) vulnerability. Not surprised at all.

The nature of the data compromised, Is quite alarming.  And that's only what they've made publicly known- we'll probably never know what else has been affected.

Suprised me mothred how can a company with 8 M accounts having A hole like that?!  it became something normal actually nowadays to see breaches of biggest companies but the exploit type suprised me.

Considering the scale of the company and the nature of the data compromised, It's certainly alarming.

I exploit on a daily basis, so It's not surprising to me.