Password hacking

[cafeaulait]

I have just gone through my Pennywize blocked accounts for Jan and discovered that most of the hacked accounts appear in exactly the same order as the members are joining the site, how can this be?

All passwords are random generated so it can't be brute force, could someone be sniffing my site traffic for passwords in URL or confirmation emails? Is this even possible?

[Mutt]

there are exploits out there for some of the third party processors, some of the hackers can add their own passwords or at least get your password file and then decript it, or whatever the word is for that.

looks like you use Glo-bill. You should search the 'security' sites and look around, maybe Globill has a weakness in their scripts some smarter surfers have found.

[demented]

Could be If they really wanted into your site.

[Socks]

Yeah they are definitely adding passwords themselves. I'm not being sarcastic, this is what's happening to you. Contact Glo-Bill, and have them look into it, it could very well be a network-wide problem with them, not you. What are the steps you would use to add a password/user?

[Socks]

By the way, the average person cracks into a site using a real user's account name and password. That's clearly not what is happening to you, unless those *were* real users.

[greathope]

i know many password,but i donn't want to post publicly

[cafeaulait]

Thanks guys I'll look into this further.

Greathope, what do you mean? Passwords for my site or in general?