Server hax

**reki** · 17th Jul 12 7:59 PM

So, we had a hacker(s) get through our defences overnight. We've locked down the site a bit more & restored yesterday's backup to make sure we got all the crap they uploaded. We lost forum posts made since yesterday as a result.

**Codex** · 17th Jul 12 8:08 PM

Shiiiiiiit I sunk a few hours into posts in that time.

Ah wellllll, better safe than sorry. Thanks reki.

**n0z3k1ll3r** · 17th Jul 12 8:22 PM

I'm just glad I didn't update the Lets Play yesterday.

Also I feel sorry for Kirjava.

**reki** · 17th Jul 12 8:44 PM

Yeah unfortunately, today's backup completed about 20 minutes after the hacker gained access, which made today's backup a bit useless.

**[Vertigo]** · 17th Jul 12 9:30 PM

Good that we got that cleared up.

**Aesaar** · 18th Jul 12 1:04 AM

Poor, poor Kirjava.

**Belgarion** · 18th Jul 12 3:58 AM

I changed password yesterday and it reverted back so I assume I need to change passwords again right

**Homdax** · 18th Jul 12 4:26 AM

That is terrible news, Reki. I sincerely hope nothing serious was lost.
I assume we have sent out a Ninja patrol already to chop some heads off?

**Methuselath** · 18th Jul 12 4:31 AM

Ouch. Any info on what was taken? I assume changing passwords is a given yes?

**OhJohnNo** · 18th Jul 12 5:07 AM

Just glad it's all back.

**scoiatollo** · 18th Jul 12 5:09 AM

Ninja patrol Homdax?! We have fucking VICKING HAMSTERS to take care of that, no reason to be sneaky with Ninjas!

**Gorb** · 18th Jul 12 5:48 AM

Are Vicking hamsters somehow superior to Viking hamsters? I think you were sold fake Viking hamsters, scoia

@Meth: Uber did advise changing passwords on the FB page.

**Codex** · 18th Jul 12 6:00 AM

I'm far too lazy with passwords nowadays, but at least this event has convinced me I need two different strong passwords at the very least.

**Homdax** · 18th Jul 12 6:43 AM

Goat-throwing hamsters?
G0at-thr0W1nG'H4m5T3rS . All done.
Or
9047-7|-|r0\/\/1|\|9 |-|4/\/\$73r$

Passphrase Password L33T Conversion Generator.

**scoiatollo** · 18th Jul 12 6:45 AM

God dammit Gorb, of course they are superior, they have one additional letter and don't care about spelling!

I was a bit in a rush and the edit function seems to be borked on the mobile skin....

**ÜberJumper** · 18th Jul 12 6:47 AM

http://xkcd.com/936/

**FriendlyFire** · 18th Jul 12 8:46 AM

http://lastpass.com/

http://keepass.info/

Ever since I started using LastPass, I've stopped caring about password hacks. 10 to 15-character long randomly generated mixed case alphanumeric (with symbols if allowed) passwords, different for every site. If there's an issue with a site, I just generate a new one. All of them are stored on LastPass's servers (with client-side 256-bit AES encryption thank you very much) behind one of the few passwords I keep track of, which is extremely long and complex, on top of an integration with Google Authenticator.

**p0seidon** · 18th Jul 12 10:34 AM

Eeeeeh.. lastpass is kind of a bullshit service in some ways seeing it only protects against "conventional" keyloggers if you don't bother with the premium service and even then it's still defeat able with certain malware.
I'd personally be far more worried about credit card and other personal information online than going out of my way to use a PW encryption service.

Edit:

Also, I'm guessing that patch for the XSS vulnerability 4.2.0 has is already installed?
It's some annoying bug so you can steal cookies of any user through the calender if I remember correctly.

**FriendlyFire** · 18th Jul 12 10:44 AM

If your computer is compromised, you have far bigger issues than lastpass getting cracked.

I was strictly speaking of server-side hacks (you know, like what we're speaking of in this very thread).

**p0seidon** · 18th Jul 12 10:56 AM

And every company is still vulnerable to social engineering attacks.
Let's say lastpass gets their security circumvented by means of SE'ing, they store a lot of payment data and other identifiable data.
Lots of companies do.

What I am speaking of is that there's a lot more to worry about that's stored on servers than just your passwords

.
And I'd like to know if there was anything lifted from here that's actually valuable such as email lists etc..

**Wargrim** · 18th Jul 12 11:15 AM

I hate remembering new passwords. Too many password for too many things.

I hope no lasting damage has been done? Has the modmin porn stash been compromized?

**Homdax** · 18th Jul 12 11:32 AM

No.

**Codex** · 18th Jul 12 2:53 PM

Wait, can I download this porn stash?
Thanks.

New password: GorramH4x0rs

**Methuselath** · 18th Jul 12 7:47 PM

Gorb, but I was way ahead of you guys. I have no FB account. Ha!

**maxdamage** · 20th Jul 12 1:23 PM

@Reki

Thanks for the update.Luckily I had kept an email notification of a pm from TON_Viper that I got on tuesday morning. Phew!....I just have to re-post a problem I am having with my Hw2 mod though.

Server hax

Thread Tools

Server hax

Thread Information

Users Browsing this Thread

Posting Permissions