What.CD database compromised?

[sexydingo]

I want to like what.cd so badly

[cRaZyzMaN]

they send me that email too. lol
nice try

[Ghost+Rider]

Wtf i got this

Dear registered user of the site What.cd,

We have recently been investigating the activities of the users of the
site http://www.what.cd/ and we have found that this site exists for the
sole purpose of music piracy.

Pirating music is a criminal offence and we believe it should be obvious
to you that the results outweigh the benefits - hard working artists
won't be rewarded for their work and will stop producing music,
ultimately leading to a severely reduced selection of music both in the
shops and for download.

The RIAA had hoped that the disabling by the police of the large illegal
music site, Oink.cd, would stop a lot of people from engaging in piracy,
as they don't want to be seen as criminals. However, this appears to
not be the case, as two large new sites have sprung up in its place.

This email is the final warning to all of you who were members of
Oink.cd and are current members of What.cd. If we find you to be
committing any more criminal acts of piracy then we will have to press
charges against you, as representatives of the major record companies of
America.

Yours Faithfully,

The RIAA

[sleepyy]

Same here haha strange stuff good thing i don't use the emaill address for all torrent sites only this password changed aswell at least they should recomend a password change on the site i think i'm going to look around for a waffles invite instead this site is kind of strange from day one but still good

[snap3r]

Ugh. Yet another reason to use waffles over what.

no offence to anyone but waffles is crap
they where hacked to so i advise to change passwords there aswell

[dave12]

i am not scared they can send as many letters as they want, i am not using same email and pass on trackers so thats good news for me and for others change ur pass of email and trackers as soon as possible.

[cRaZyzMaN]

for me this is spam

[Kyl3KK]

Ugh. Yet another reason to use waffles over what.

no offence to anyone but waffles is crap
they where hacked to so i advise to change passwords there aswell

Why is waffles crap?

[smiggy]

Re. changing your password, I'm not so sure it's the best option. If you had a good quality password before, leave it be, if it's complex enough it might take a 25000-node botnet tens of years to crack.

They obviously had full access to the source code and may have altered the password changing script to either store the new password in "safe place" send it off-site somewhere.

Have the admins done an audit to look for altered code?

I just wish they would invest an hour or two in setting up mod_security2.

And they obviously stored email addresses in plain text, when it would be sufficient to just have a hash of it. The user inputs their md5($email) address and you can tell if it is correct or not.

[kaffeine]

I'm obviously not concerned about the mail, but about the staff, how serious and responsible they are, and how are they handling things over there... all the bugs, the sql exploits, downtimes, and now this.... *sigh*

I don't want to think that these problems are caused by a poor code with major security holes, and/or inexperienced and irresponsible staff who rushed into things, but...

ps: i'm keeping the mail for later amusement