What you need to know about the recent MangaDex data breach

[Maru_chan]

Thank you for your efforts, and welcome back ♥

 

[pocket_lint]

The hacker was probably asking for 10K in BTC right? Considering they spammed hombre, maybe english isn't their first language and they just made a grammar mistake, or they are clueless about the conversion rates. Or am I just missing the joke and people are intentionally dunking on them for making a grammar mistake?

 

[defnotamiracle]

Thank you for transparency!

 

[vinsegas]

Sigh.....
Lets hope this doesnt become the norm....

 

[shinya78]

Welp, this would be my 6th time I'm changing my password, every single time randomized by literally smashing the keyboard multiple times then re-arranging the mess.

 

[BlueStallion44]

Someone tell me what 2FA and RSS mean on MangaDex pleeeeaasssee

 

[DLRevan]

I can only imagine that the people spamming "LOOOL PHP" are either programming amateurs, rank green students or just people bandwagoning on internet programming memes.

If you really did work in an IT related field where using or not using PHP is a consideration for you, you would at worst acknowledge that PHP has faults that are not directly related to the breach, at best you would have said nothing. PHP has decent-good performance, can be implemented broadly for just about anything, and you'll always be able to find someone who can build it for you.

The most clueless are those who insinuate that not only is PHP bad, it's dead. Please, almost everything uses PHP, and while its not going to be as popular in the future, it's going to continue to stick around for years if not decades.

As for the session credentials issue....well I agree with some here that accounts with admin rights should always need to reauthenticate. Is it a criminal sin for a site that doesn't store much sensitive information beyond internal activity and login credentials?....Hardly. I'd just say it's something that can change now that this has happened, but it's not exactly a huge mistake.

 

[Jendrej]

@BlueStallion44
https://en.wikipedia.org/wiki/Multi-factor_authentication
https://en.wikipedia.org/wiki/RSS

 

[sorceressLulu]

Suddenly I find myself wishing for hackers full of tortue imprisonment
Involving killing important for that person pepole in front of him
Who new chaning my password can make me this angry...

Glad you are back <3

 

[FuzzyPaws]

IXNAY ON THE HOMBREEEEEE

 

[BlueStallion44]

@Jendrej thanks!

 

[minmanga]

While I am thankful that the site is up and that the administrators did they task there is one thing I wish:
Instead of just putting up a unhelpful message about emergency shutdown without giving any information they should have immediately told that they got hacked. As they anyway took the time to inform through Twitter (and even searching for a picture to add to the announcement) they could as well have written something like this:

"We got hacked and currently we try to determine what information they have been able to dump from us. We are also working on fixing the security holes and restoring the site. Meanwhile, if you used the same password somewhere else, please change it."

It is not like I ask them to give continuous updates when things go wrong, but some kind of transparency as they have a lot of information about us. Some users have even told that their bank information is stored at Mangadex and we as users might want to take our own countermeasures.

 

[Natsukashii]

I thought it was very strange to see a post of the mangadex code in the software section on nyaa.

Glad it has been sorted out

 

[MCM]

>attacking a manga hosting website in 2021 for a ransom
The absolute state of script kiddies these days, be it system level code execution through a vuln or memory corruption bugs (intended or not), PHP RCE are a pain in the ass

 

[freshlypotatoed]

For future purposes, can't you automate a script to periodically create and overwrite a docker image of the servers status so that in any emergency you can revert to that docker image?

 

[Shaftw]

well.

 

[Alcorin]

Yare yare, people really have nothing better to do with their time... What a pain.

Welcome back and thank you for your efforts Hopefully this will be the last such incident.

 

[superfan1224]

please let me know how to delete my account!! And please delete it soon

 

[Ucluk4]

@superfan1224 you can post it here
https://mangadex.org/thread/178895/87/#post_5037333

 

[shinya78]

Welp, this would be my 6th time I'm changing my password, every single time randomized by literally smashing the keyboard multiple times then re-arranging the mess.

7th time.

My filter chapter languages was suddenly set to Arabic when I relogged with 'Remember Me' ticked on. Not sure how that came to be, but it went back to what I had originally set it to after switching to a different mangadex tab and checking, just in case, I'll clear cookies AGAIN.