Home | Community | Message Board
You are not signed in.
Sign In New Account
Forum Index Search Posts Trusted Vendors Highlights Galleries FAQ User List Chat Store Random Growery

MushroomMan Mycology
This site includes paid links. Please support our sponsors.

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

Unfolding Nature Shop: Unfolding Nature: Being in the Implicate Order

Jump to first unread post Pages: 1 | 2 | 3  [ show all ]
The Recent Bulletin Board Exploit
    #3006109 -

Late last night, a surprise attack occured on the site when an unknown individual was able to gain administrative access to the bulletin board for a short period of time. Before we were able to react, he (or she) changed many forum names and descriptions, demoted all the moderators and administrators, and began a mass-deletion of private messages. The attacker almost certainly intended to delete all posts as well, but Vamp's quick reaction allowed us to save most of our data.

We had to take our server offline in the immediate aftermath of the attack to prevent further damage. During this downtime we retrieved as much data as possible from backups, repaired and rebuilt our databases, and began looking into the nature of the exploit.

Unfortunately, many private messages sent in the past week could not be recovered. For this we truly apologize. Know that we did everything possible to retrieve as much lost data as possible, and we have taken several effective steps to secure our server against similar attacks until we can track down the exact nature of the problem. The entire team is focused on doing whatever is necessary to protect the Shroomery and we appreciate your understanding during this time.

If anyone has questions about the situation, the admins will do our best to answer them but it may take a while for the full picture to emerge.

Peace,

-Y

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006140 -

I'm here and available to help as always.

interesting facts:

he has UBBthreads running on an IIS machine.

:smile:

i registered.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006282 -

You guys rock! Even thought you guys were only offline for a short time, I missed this place. I come here for several reasons. One being the information I gain from the site, another is the enjoyment from reading some of the off the wall topics. Crazy stuff!  The most important though, are the people. I love the people here. Some have brought me comfort, happiness, sadness and a feeling of belonging to something special. I met my current boyfriend off his site! For me, the shroomery is not just some website I visit, it's family, a home to go to. The Shroomery is forever!

So thank you so much! This place is forever "logged" into my heart!

:heart: :heart: :heart: :heart: :heart: :heart: :heart: :heart: :heart: :heart:


--------------------

The secret to being funny is to say smart things stupidly, or is it stupid things smartly? Whatever..it's not rocket surgery...or something like that.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006300 -

Thank you so much Ythan and Vamp for working your asses off in the last 24hrs to get this place back up.

We don't take attacks like this lightly, we will get to the bottom of this and get our culprit.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Thor]
    #3006333 -

:lol:
thor, you're a mod now. sorry, i couldn't help but laugh at that one.

i really hope you guys get this wanker. i lost a few valuable pms, but that's nothing in the grand scheme of things.

i googled "sardak" and this is what it shows. there are a few different "sardak" profiles on different boards. this may not help you find him, but i thought i'd throw it out there anyway. maybe there is something you can do with it.


--------------------
Anno cock? Is that some kind of Greek liquer? -Geo's all-knowing sex slave
Scat's way better than mud cause it's warm. -Ythan 4/23/07

Edited by eric_the_red (08/15/04 09:23 PM)

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006667 -

Thank you Ythan and great job Vamp!


--------------------
The bus came by and I got on that's when it all began!


Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006886 -

Ythan and Vamp save the day!  Thank you so much guys!  You're my heros! :cheers:


--------------------


"It is dangerous to be right when the government is wrong."--Voltaire

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: silversoul7]
    #3007155 -

Yes thanks for the quick thinking. :thumbup:


--------------------

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3007204 -

Good work, Ythan and Vamp! :cool:

I'd just like to add that we've had a couple member accounts lost, which we'll need to re-instate. So far, I know we've lost both Bo0 and Fuman(SporeSure). If anyone knows of any other member accounts which has been lost, please let us know who they are, so we can work to re-instate them. Thanks. :smile:


--------------------

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3007397 -

I wonder if he/she deleted accounts of people that they had tangled with here. Might make it easier to track down this person.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Papaver]
    #3007867 -

Okay I think I should have restored almost all (if not all) deleted accounts, but their old posts will still show up as anonymous unless I can figure out some clever way to tie them back to their original poster. There were about 10,000 accounts gone so it apparently wasn't targeted towards specific users. However, he did manually ban three accounts: 'Administrator', 'matts' and 'Suntzu' (in that order). What this means is open to interpretation.

Vamp has identified the bug which we think we used to exploit the BB, and as I type this Anno is working to fix it. Hopefully things should be getting back to normal soon. :smile:

Peace,

-Y

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3007955 -

great job Ythan & Vampppppp! :sun:


--------------------
:pacman: - - - -  :pill: :mushroom2: :pill2: :mushroom2: :regularshroom: :mushroomgrow: :pill: :pill2: :mushroom2: :poison:

:sun::heart::sun:

tiny_rabid_birds said:
"your avatar is dirty."

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: 40oz]
    #3007981 -

That's what i'm sayin.


--------------------
"..all those molecules thrashing their kinky little tails, hot for destiny and the street."  Gibson


Nuke baby seals for Jesus!

(This has been a +1 production.)

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Papaver]
    #3008060 -

Based off of the "coolest shroomery chicks" poll, impala is unregistered.
Unsure if this is intended or not.


--------------------
"..all those molecules thrashing their kinky little tails, hot for destiny and the street."  Gibson


Nuke baby seals for Jesus!

(This has been a +1 production.)

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008073 -

Should we, the common user, take the precaution of changing our passwords? I'm unaware if it would have been possible for them to be collected from the site during this incursion.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: 40oz]
    #3008100 -

fortyounces2freedom said:
great job Ythan & Vampppppp! :sun:


:blowjob: :wink:


--------------------
buh

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008138 -

Fortunately, you can't find out someone's password through the admin interface. You can change it to something else, but if you're able to log in then your password wasn't changed and you should be safe. Still, this should serve as a reminder that there are people out there who will take any opportunity to fuck with us so if you have an insecure password, now would be a good time to change it to something more complex.

Thanks!

-Y

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008160 -

I still think you guys should force a madatory password change on all users on next login.

He was able to inject directly into tables, no reason why he couldnt dump from there either.. raw sql is raw sql.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Barbi]
    #3008213 -

That's true, but only the password's MD5 hash is stored in the DB which would make it a lot harder to determine what the original password was.

However, if the attacker did get a copy of the users table, Anno uncovered an exploit which might let him gain access to accounts without needing their password. Since changing your password will make you immune to this exploit, I'm reversing my advice. I may make it mandatory after addressing some of the more pressing issues.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Thor]
    #3008319 -

I was starting to wonder... I couldnt log in at all yesterday, and when i just got back today, some of my recent pms had been deleted.

Hope all goes well.


--------------------
What?

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008378 -

Ythan, the threads can be tied back to the original poster by looking at the 're:' line of the second post...

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008387 -

I tried to change my password, but cannot access the edit page. Any idea's as to why? Thank you.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008404 -

I attempted to change my password. I went to my home, and clicked the edit button next to Personal information, email, password, etc. It logged me out and returned me to the message boards main site. I have no idea how I'm supposed to change my password if it continues to do that. My apologies if this to off topic for this thread, but I thought I should bring it to someone's attention.

Edit: Oops! Didn't see the above post.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008437 -

It is not currently possible to change ones password since the files needed for this are currently disabled for security reasons until we know more.


--------------------
Grow Mushrooms from Spores - PF-Tek for Simple Minds

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Anno]
    #3008453 -

Very understandable considering the current situation. Thanks for the reply.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008769 -

i love my community!
:thumbup:


--------------------
lucidal expansion

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: shirley knott]
    #3009383 -

shirley knott said:
fortyounces2freedom said:
great job Ythan & Vampppppp! :sun:


:blowjob: :wink:


lol! i know Vamp IRL!!


--------------------
:pacman: - - - -  :pill: :mushroom2: :pill2: :mushroom2: :regularshroom: :mushroomgrow: :pill: :pill2: :mushroom2: :poison:

:sun::heart::sun:

tiny_rabid_birds said:
"your avatar is dirty."

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: 40oz]
    #3010002 -

you :blowme: vamp in real life? wow, that's quite an admission  :thumbup:


--------------------
buh

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: shirley knott]
    #3014933 -

:lol:
bastard!/bitch! whichever may apply :wink:


--------------------
:pacman: - - - -  :pill: :mushroom2: :pill2: :mushroom2: :regularshroom: :mushroomgrow: :pill: :pill2: :mushroom2: :poison:

:sun::heart::sun:

tiny_rabid_birds said:
"your avatar is dirty."

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: 40oz]
    #3021840 -

On further investigation it looks as if the exploit was created due to geokills custom name color..






















:laugh:


--------------------
./configure --without-sanity --without-logic --without-regret
01100110011101010110001101101011011110010110111101110101
jaded = safe != happy
Were not familly, we are the shroomery, and to some thats thicker than blood.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Vampire999]
    #3022022 -



...




--------------------

--------------------
┼ ··∙   long live the shroomery  ∙·· ┼
...╬π╥ ╥π╬...

Extras: Filter Print Post Top
h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: geokills]
    #3023964 -

By changing new username id's to the old ones it should fix the old post problem, may cause a "new post problem" if they've posted before you reverted the id. Please force people to change thier passwords. It is a risk.


--------------------
The DJ's took pills to stay awake and play for seven days.

Extras: Filter Print Post Top
Re: h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: tak]
    #3024427 -

This would be easy to do if people actually kept their email addresses up to date..

Obviously we cant just have them login then be forced to change their pass.. if someone had their password that would make hrmm a lack of sense. It would just be a game of chance that the right person loged in first.

If we just clear them out and force all new passwords to be recovered via email 30% of the current users would never get them because they dont keep their information up to date.

Also from the time that the attack started to the time I closed the server down was about 10 minutes.. With the size that our DB is currently you cant even use the built in board backup feature. It times out long before it could spit out the file. So the chances this person pulled anything is slim to none. You cant view passwords from the admin feature as that they are all stored MD5.


--------------------
./configure --without-sanity --without-logic --without-regret
01100110011101010110001101101011011110010110111101110101
jaded = safe != happy
Were not familly, we are the shroomery, and to some thats thicker than blood.

Extras: Filter Print Post Top
Re: h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: Vampire999]
    #3027508 -

Anything to do with this? Or what? :shrug:


--------------------
Every Animal Is Someone 🌱 watchdominion.org

Extras: Filter Print Post Top
Re: h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: ivi]
    #3027516 -

No. It was a loophole in the forum software.


--------------------
Grow Mushrooms from Spores - PF-Tek for Simple Minds

Extras: Filter Print Post Top
Re: h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: ]
    #3031774 -

Did you get an IP address?

Extras: Filter Print Post Top
Re: h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: ]
    #3032401 -

if he logged into couldnt you check what ip address he logged in under then some how trace back him back to his isp?

Extras: Filter Print Post Top
Re: h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: guri]
    #3034243 -

guri said:
if he logged into couldnt you check what ip address he logged in under then some how trace back him back to his isp?


We got alot more than the IP :smile:

Extras: Filter Print Post Top
Re: h0ky h4ck3rz b4tm4n!!!!!!!!!!!!!!!!!!!222 [Re: Thor]
    #3040409 -

like his mothers foot size? cause im interested.


--------------------
The DJ's took pills to stay awake and play for seven days.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3042142 -

Good job, people! I hope you can get to the bottom of this to prevent other script kiddies from messing up our beloved 'Shroomery. :thumbup:

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3049671 -

More the reason to never have personal details aka sn@il addresses ect in the PM'age and use PGP if one has to. Who knows if any future attacks are LEO or some cop sycophant?

That said, thanks -- shroomery admins -- on increasing the pics to 3000kb a day, unless that's a glitch?


--------------------
Convert Metric and Imperial.

Extras: Filter Print Post Top
Jump to top Pages: 1 | 2 | 3  [ show all ]

Unfolding Nature Shop: Unfolding Nature: Being in the Implicate Order

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Similar ThreadsPosterViewsRepliesLast post
* Bulletin Board Upgrade 3DSHROOM 1,971 17 06/19/03 11:50 PM
by matts
* Re: Error message from bulletin board mjshroomer 1,339 6 07/26/99 06:38 PM
by mjshroomer
* Bulletin Board upgrade
( 1 2 3 all )		 3DSHROOM 7,170 51 12/10/03 05:20 AM
by Asante
* We're a Big Board!
( 1 2 all )		 YthanA 2,776 27 09/08/04 01:15 AM
by felix
* Problem with the board? RoadkillM 702 3 01/23/05 06:16 PM
by Thor
* None or you give a shit about this board
( 1 2 all )		 dimitri211 5,327 36 07/24/01 06:05 PM
by lichen
* Re: This new board sucks Anonymous 3,516 15 02/10/98 01:53 PM
by Anonymous
* Big-boards.com? z@z.com 687 2 02/04/05 03:51 PM
by z@z.com

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: Ythan, Thor, Seuss, geokills
6,267 topic views. 0 members, 16 guests and 2 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.042 seconds spending 0.009 seconds on 16 queries.