Quote from: Blazr on May 27, 2015, 12:29:55 PM

=snip=
In this case the hacker used social engineering, there were no security vulnerabilities in the forum software, in fact the hacker likely had little technical skills at all, they just needed to convince the hosting company they were theymos and the hosting company let them in. There really isn't a whole lot we can do about attacks like that, there are thousands of ways to execute social engineering attacks against the forum, it is of course a good idea to check what information your host requires to let you reset your account, and it would also be a good idea to inform the host there may be social engineering attacks, but I mean I can think of a million other ways this could be done and I can't think of many ways to prevent them. What we really need is a more layered approach, for example if we had javascript-side PM encryption then we could store the PM's fully encrypted on the server and prevent against even a root attacker from grabbing them. The forum already stored passwords in a secure manner. Honestly the only things we need to protect are PM's, email addresses and passwords/security questions.
=snip=

The man in the loop is always a security flaw; however, you cannot remove it from the process. So the best response to such events will be recovery preparedness - since you'll always need to recover from unavoidable hacks - while trying to mitigate the frequency of such attacks by educate parties - e.g. the host - to use best practices like safer off-line authentication, etc.

Quote from: Blazr on May 27, 2015, 12:29:55 PM

=snip=
Additionally I would highly recommend the account recovery feature be changed. I think that it should require both a recovery email and answer to security question, currently it only requires one of those. I would think this would greatly reduce the amount of hacked accounts.

+1.