Home | Community | Message Board
You are not signed in.
Sign In New Account
Forum Index Search Posts Trusted Vendors Highlights Galleries FAQ User List Chat Store Random Growery


This site includes paid links. Please support our sponsors.

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

Unfolding Nature Shop: Unfolding Nature: Being in the Implicate Order

Jump to first unread post Pages: 1 | 2 | 3 |  [ show all ]
The Recent Bulletin Board Exploit
    #3006109 -

Late last night, a surprise attack occured on the site when an unknown individual was able to gain administrative access to the bulletin board for a short period of time. Before we were able to react, he (or she) changed many forum names and descriptions, demoted all the moderators and administrators, and began a mass-deletion of private messages. The attacker almost certainly intended to delete all posts as well, but Vamp's quick reaction allowed us to save most of our data.

We had to take our server offline in the immediate aftermath of the attack to prevent further damage. During this downtime we retrieved as much data as possible from backups, repaired and rebuilt our databases, and began looking into the nature of the exploit.

Unfortunately, many private messages sent in the past week could not be recovered. For this we truly apologize. Know that we did everything possible to retrieve as much lost data as possible, and we have taken several effective steps to secure our server against similar attacks until we can track down the exact nature of the problem. The entire team is focused on doing whatever is necessary to protect the Shroomery and we appreciate your understanding during this time.

If anyone has questions about the situation, the admins will do our best to answer them but it may take a while for the full picture to emerge.

Peace,

-Y

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006140 -

I'm here and available to help as always.

interesting facts:

he has UBBthreads running on an IIS machine.

:smile:

i registered.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006282 -

You guys rock! Even thought you guys were only offline for a short time, I missed this place. I come here for several reasons. One being the information I gain from the site, another is the enjoyment from reading some of the off the wall topics. Crazy stuff!  The most important though, are the people. I love the people here. Some have brought me comfort, happiness, sadness and a feeling of belonging to something special. I met my current boyfriend off his site! For me, the shroomery is not just some website I visit, it's family, a home to go to. The Shroomery is forever!

So thank you so much! This place is forever "logged" into my heart!

:heart: :heart: :heart: :heart: :heart: :heart: :heart: :heart: :heart: :heart:


--------------------

The secret to being funny is to say smart things stupidly, or is it stupid things smartly? Whatever..it's not rocket surgery...or something like that.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006300 -

Thank you so much Ythan and Vamp for working your asses off in the last 24hrs to get this place back up.

We don't take attacks like this lightly, we will get to the bottom of this and get our culprit.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Thor]
    #3006333 -

:lol:
thor, you're a mod now. sorry, i couldn't help but laugh at that one.

i really hope you guys get this wanker. i lost a few valuable pms, but that's nothing in the grand scheme of things.

i googled "sardak" and this is what it shows. there are a few different "sardak" profiles on different boards. this may not help you find him, but i thought i'd throw it out there anyway. maybe there is something you can do with it.


--------------------
Anno cock? Is that some kind of Greek liquer? -Geo's all-knowing sex slave
Scat's way better than mud cause it's warm. -Ythan 4/23/07

Edited by eric_the_red (08/15/04 09:23 PM)

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006667 -

Thank you Ythan and great job Vamp!


--------------------
The bus came by and I got on that's when it all began!


Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3006886 -

Ythan and Vamp save the day!  Thank you so much guys!  You're my heros! :cheers:


--------------------


"It is dangerous to be right when the government is wrong."--Voltaire

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: silversoul7]
    #3007155 -

Yes thanks for the quick thinking. :thumbup:


--------------------

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3007204 -

Good work, Ythan and Vamp! :cool:

I'd just like to add that we've had a couple member accounts lost, which we'll need to re-instate. So far, I know we've lost both Bo0 and Fuman(SporeSure). If anyone knows of any other member accounts which has been lost, please let us know who they are, so we can work to re-instate them. Thanks. :smile:


--------------------

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3007397 -

I wonder if he/she deleted accounts of people that they had tangled with here. Might make it easier to track down this person.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Papaver]
    #3007867 -

Okay I think I should have restored almost all (if not all) deleted accounts, but their old posts will still show up as anonymous unless I can figure out some clever way to tie them back to their original poster. There were about 10,000 accounts gone so it apparently wasn't targeted towards specific users. However, he did manually ban three accounts: 'Administrator', 'matts' and 'Suntzu' (in that order). What this means is open to interpretation.

Vamp has identified the bug which we think we used to exploit the BB, and as I type this Anno is working to fix it. Hopefully things should be getting back to normal soon. :smile:

Peace,

-Y

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3007955 -

great job Ythan & Vampppppp! :sun:


--------------------
:pacman: - - - -  :pill: :mushroom2: :pill2: :mushroom2: :regularshroom: :mushroomgrow: :pill: :pill2: :mushroom2: :poison:

:sun::heart::sun:

tiny_rabid_birds said:
"your avatar is dirty."

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: 40oz]
    #3007981 -

That's what i'm sayin.


--------------------
"..all those molecules thrashing their kinky little tails, hot for destiny and the street."  Gibson


Nuke baby seals for Jesus!

(This has been a +1 production.)

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Papaver]
    #3008060 -

Based off of the "coolest shroomery chicks" poll, impala is unregistered.
Unsure if this is intended or not.


--------------------
"..all those molecules thrashing their kinky little tails, hot for destiny and the street."  Gibson


Nuke baby seals for Jesus!

(This has been a +1 production.)

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008073 -

Should we, the common user, take the precaution of changing our passwords? I'm unaware if it would have been possible for them to be collected from the site during this incursion.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: 40oz]
    #3008100 -

fortyounces2freedom said:
great job Ythan & Vampppppp! :sun:


:blowjob: :wink:


--------------------
buh

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008138 -

Fortunately, you can't find out someone's password through the admin interface. You can change it to something else, but if you're able to log in then your password wasn't changed and you should be safe. Still, this should serve as a reminder that there are people out there who will take any opportunity to fuck with us so if you have an insecure password, now would be a good time to change it to something more complex.

Thanks!

-Y

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: ]
    #3008160 -

I still think you guys should force a madatory password change on all users on next login.

He was able to inject directly into tables, no reason why he couldnt dump from there either.. raw sql is raw sql.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Barbi]
    #3008213 -

That's true, but only the password's MD5 hash is stored in the DB which would make it a lot harder to determine what the original password was.

However, if the attacker did get a copy of the users table, Anno uncovered an exploit which might let him gain access to accounts without needing their password. Since changing your password will make you immune to this exploit, I'm reversing my advice. I may make it mandatory after addressing some of the more pressing issues.

Extras: Filter Print Post Top
Re: The Recent Bulletin Board Exploit [Re: Thor]
    #3008319 -

I was starting to wonder... I couldnt log in at all yesterday, and when i just got back today, some of my recent pms had been deleted.

Hope all goes well.


--------------------
What?

Extras: Filter Print Post Top
Jump to top Pages: 1 | 2 | 3 |  [ show all ]

Unfolding Nature Shop: Unfolding Nature: Being in the Implicate Order

Feedback and Administration > Website Announcements and Feature Feedback
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Similar ThreadsPosterViewsRepliesLast post
* Bulletin Board Upgrade 3DSHROOM 1,971 17 06/19/03 11:50 PM
by matts
* Re: Error message from bulletin board mjshroomer 1,339 6 07/26/99 06:38 PM
by mjshroomer
* Bulletin Board upgrade
( 1 2 3 all )		 3DSHROOM 7,170 51 12/10/03 05:20 AM
by Asante
* We're a Big Board!
( 1 2 all )		 YthanA 2,776 27 09/08/04 01:15 AM
by felix
* Problem with the board? RoadkillM 702 3 01/23/05 06:16 PM
by Thor
* None or you give a shit about this board
( 1 2 all )		 dimitri211 5,328 36 07/24/01 06:05 PM
by lichen
* Re: This new board sucks Anonymous 3,516 15 02/10/98 01:53 PM
by Anonymous
* Big-boards.com? z@z.com 687 2 02/04/05 03:51 PM
by z@z.com

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: Ythan, Thor, Seuss, geokills
6,267 topic views. 0 members, 8 guests and 6 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.04 seconds spending 0.012 seconds on 18 queries.