# Compromised Forum Admin
**URL:** https://meta.discourse.org/t/compromised-forum-admin/266954
**Category:** Support
**Created:** [June 1, 2023, 8:35pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954 "2023-06-01T20:35:13Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@codergautam](https://meta.discourse.org/u/codergautam)
#### Post date: [June 1, 2023, 8:35pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/1 "2023-06-01T20:35:13Z")
Hi, we were recently social engineered to give admin to a compromised user. As far as the logs say, he enabled “[Data Explorer](https://meta.discourse.org/t/32566?silent=true)”, and didn’t do anything else except Impersonate a few users.
What is the impact of this incident to our forum and is there anything serious?
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [June 1, 2023, 8:42pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/2 "2023-06-01T20:42:26Z")
The impersonation can show them that users email with out that part being logged.
As for the data explore…
Almost anything can be received using it including every users email, Ip, **PASSWORDS** (well the hash and hashing algorithm but you can then get the password with that), etc and can be exported in just a click. And making and deleting queries are not logged.
I would recommend making a post pinning globally and banner saying that a user with bad intent was given admin and their emails, IPs etc may have been leaked to them as a result. And to CHANGE THEIR PASSWORD.
---
### Author:  [@codergautam](https://meta.discourse.org/u/codergautam)
#### Post date: [June 1, 2023, 9:13pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/3 "2023-06-01T21:13:46Z")
But the passwords would be hashed so that part would be safe right?
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [June 1, 2023, 9:14pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/4 "2023-06-01T21:14:21Z")
I think the algorithm that they can get (matched with the hash) would let them decrypt the hash.
---
### Author:  [@codergautam](https://meta.discourse.org/u/codergautam)
#### Post date: [June 1, 2023, 9:43pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/5 "2023-06-01T21:43:07Z")
Is there a way to force everyone to reset their password? I made an announcement but that’s not going to cover everyone
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [June 1, 2023, 9:48pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/6 "2023-06-01T21:48:49Z")
I do not think so. What you can do is use the API and send a password reset email to every user.
---
### Author:  [@Lhc\_fl](https://meta.discourse.org/u/Lhc_fl)
#### Post date: [June 2, 2023, 1:37am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/7 "2023-06-02T01:37:45Z")
What? it’s impossible. Cryptography makes it impossible for us to restore the password from the password hash, unless social engineering is used.
To put it simply, although the leaked password hash does have a great risk, it can help others guess the password through information such as birthday, name, phone number, etc., but no one can restore the password based on the password hash alone.
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [June 2, 2023, 1:38am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/8 "2023-06-02T01:38:45Z")
What about with the salt and algorithm?
---
### Author:  [@Lhc\_fl](https://meta.discourse.org/u/Lhc_fl)
#### Post date: [June 2, 2023, 1:46am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/9 "2023-06-02T01:46:14Z")
A cryptographic algorithm is like taking a picture of a password. The same person will indeed take the same photo, but the person who gets the photo cannot restore your DNA from the photo alone.
The password salt increases the security of the password, making it more difficult to be cracked by rainbow tables and other means even if it is leaked.
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [June 2, 2023, 1:47am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/10 "2023-06-02T01:47:14Z")
So even with all 3 leaked passwords are safe?
---
### Author:  [@Lhc\_fl](https://meta.discourse.org/u/Lhc_fl)
#### Post date: [June 2, 2023, 1:59am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/11 "2023-06-02T01:59:57Z")
It is not absolutely safe. If his users have very good password habits, such as not using ilovexxxx or name+birthday as passwords, these methods can greatly reduce the probability of their passwords being cracked. If users don’t have good password habits, all their accounts on all websites are at risk.
---
### Author:  [@Lhc\_fl](https://meta.discourse.org/u/Lhc_fl)
#### Post date: [June 2, 2023, 2:01am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/12 "2023-06-02T02:01:28Z")
You could try resetting everyone’s passwords to random passwords in the Ruby console, which will force them to reset their passwords to log in.
---
### Author:  [@codergautam](https://meta.discourse.org/u/codergautam)
#### Post date: [June 2, 2023, 2:47am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/13 "2023-06-02T02:47:30Z")
Thank you!
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [June 2, 2023, 5:29am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/14 "2023-06-02T05:29:24Z")
Ask your admins and users to enable 2FA.
---
### Author:  [@codergautam](https://meta.discourse.org/u/codergautam)
#### Post date: [June 2, 2023, 10:20am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/15 "2023-06-02T10:20:32Z")
Doing that too
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [June 2, 2023, 6:39pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/16 "2023-06-02T18:39:15Z")
If you’re resetting everyone’s password, be sure to put up some kind of banner letting people know they need to change their password, and be prepared to expect problems with people doing that.
---
### Author:  [@Jonathan5](https://meta.discourse.org/u/Jonathan5)
#### Post date: [June 2, 2023, 10:30pm UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/17 "2023-06-02T22:30:30Z")
> [@not-ethan](#):
>
> **PASSWORDS** (well the hash and hashing algorithm but you can then get the password with that)
I think it’s misleading for this answer to be marked as the “Solution”.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [June 3, 2023, 8:05am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/18 "2023-06-03T08:05:41Z")
I don’t think it is misleading. The question was about the impact of someone having temporarily gained admin access and the answer is that basically everything could be compromised because the attacker could have downloaded (parts of) the database without leaving a trace.
And yes, password hashes could be very hard to crack but if you have extra context (like user email addresses) and access to leaked passwords from another source then there is a chance you could piece together some things and succeed.
---
### Author:  [@Jonathan5](https://meta.discourse.org/u/Jonathan5)
#### Post date: [June 3, 2023, 9:55am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/19 "2023-06-03T09:55:29Z")
By “you can then get the password” with “the hash and hashing algorithm” I thought Ethan’s meaning was that armed with only the hashes and the hashing algorithm you can obtain all the passwords.
That is the meaning that I thought was intended and which I found misleading. Perhaps it’s only misleading to the uneducated. I will look into this interesting subject as soon as I get the chance!
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [June 3, 2023, 11:21am UTC](https://meta.discourse.org/t/compromised-forum-admin/266954/20 "2023-06-03T11:21:38Z")
With average users you can obtain most.
It doesn’t take much more than raw CPU to brute force using a password list once you have the hashes, salts, and no rate limiting.
[Next page](https://meta.discourse.org/t/compromised-forum-admin/266954.md?page=2)