This post suggests that logging out is enough to invalidate all active sessions:
https://bitcointalk.org/index.php?action=login2;sa=salt;sesc=insertYourSessionCodeHere
Please note, that is
not the ordinary logout link. So, logging out is not enough. The logout button is:
https://bitcointalk.org/index.php?action=logout;sesc=insertYourSessionCodeHereWow, thats an interesting thread:
Hidden pages/ features on the forum. Bookmarked to read in detail later!
@theymos, please clarify re OP?
OP suggests that requires a password change:
it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).
Your first hypothesis could be true since theymos upgraded PHP. About your second hypothesis, could it be true? even after Cloudflare blocked the attacks?
I suggested that perhaps, emergency WAF rules that Cloudflare designed in a hurry may themselves have unintended failure cases. Though Id expect that by now, Cloudflare has had more than adequate time to find any such bugs in their own code. As a diagnostic brainstorm, Im just trying to think of all possibilities.
For your third hypothesis, theymos has already stated that all the attempt failed, except there is new vulnerability that he didn't notice but I don't think so because theymos will sure be at alert after that first attempt happened.
There is no absolute certainty here. I dont want to FUD the forums security; I just allow a proverbial 1% or 0.1% chance that an attacker may have persistent access. Given weird slowness and sporadic failures as observed, Id lean toward the 1% chance. Of course, there is always
some nonzero chance of this on any website.
