Author Topic: SF defaced (Read 7662 times)

FliesLikeABrick · « **on:** April 28, 2010, 12:09:39 pm »

As you may have noticed, the forums were hacked/defaced around 11:10 AM EST today. I had the forums taken down and was investigating within the hour.

It looks like someone pwned it by using a php file manager they installed via a security hole in phpsysinfo. I am reminded now why I didn't run phpsysinfo on anything of mine for so long...

Unfortunately I had to revert some parts of the forums database to a snapshot from roughly 5:30AM EST (so about 5.75 hours of some data may have been lost). I haven't exactly identified what may have been lost, but I believe it may have been mostly just new threads and members created in that window. It may have also been new replies to existing threads, I am not sure.

It may be a good idea to update your passwords.

jrgp · « **Reply #1 on:** April 28, 2010, 12:17:47 pm »

Ugh.

Nice job restoring everything so quickly though. That mysql replication sure does pay off.

FliesLikeABrick · « **Reply #2 on:** April 28, 2010, 12:19:32 pm »

Actually in this case it didn't. The replication replicated the dropped tables over instantly, and apparently my script that catalogs hourly snapshots of the database stopped working quite some time ago. I had to recover the deleted tables from an rsync snapshot taken during last night's filesystem backup. Getting the database snapshot tool running again now...

jrgp · « **Reply #3 on:** April 28, 2010, 12:25:54 pm »

Ah.

What version of phpsysinfo let this happen btw? The old 2007 'stable' release or one of the new ajaxish beta snapshots?

PANZERCATWAGON · « **Reply #4 on:** April 28, 2010, 12:32:04 pm »

thanks flab you sexy sexy man you

FliesLikeABrick · « **Reply #5 on:** April 28, 2010, 12:51:01 pm »

*does a sexy dance*

One of the newer ajaxy ones.

Dusty · « **Reply #6 on:** April 28, 2010, 12:54:18 pm »

Who is behind all this?

FliesLikeABrick · « **Reply #7 on:** April 28, 2010, 12:55:45 pm »

I don't really have a good way of finding out, they very clearly used a proxy.

Horve · « **Reply #8 on:** April 28, 2010, 01:16:19 pm »

what was the point?

Centurion · « **Reply #9 on:** April 28, 2010, 01:39:23 pm »

I saw it. THere was a baby picture and some email. Any ideas who was the hacker?

Espadon · « **Reply #10 on:** April 28, 2010, 02:27:25 pm »

Quote from: FliesLikeABrick on April 28, 2010, 12:55:45 pm

I don't really have a good way of finding out, they very clearly used a proxy.

jrgp · « **Reply #11 on:** April 28, 2010, 03:17:58 pm »

Quote from: Centurion on April 28, 2010, 01:39:23 pm

I saw it. THere was a baby picture and some email. Any ideas who was the hacker?

Did anyone take a screenshot? I'm interested in seeing that. (all this happened while I was at school)

squiddy · « **Reply #12 on:** April 28, 2010, 03:29:40 pm »

I saw it too.

It was very weird, but now it's working fine, yay

It had some error that said "this is awkward..."

Weird :O

Atredes/GfF · « **Reply #13 on:** April 28, 2010, 03:31:37 pm »

No screenies but it looked like that (you can visualise black background if you really want

)

This is kinda awkward...

Please direct all flames to /dev/null.
Contact: kon@hushmail.com

Boblekonvolutt · « **Reply #14 on:** April 28, 2010, 03:32:39 pm »

Fake edit: Atredes beat me to it. "This is kinda awkward..." was the title.

jrgp · « **Reply #15 on:** April 28, 2010, 03:45:22 pm »

Interesting, thanks.

Mittsu · « **Reply #16 on:** April 28, 2010, 04:06:55 pm »

the guy clearly just needed some attention

PANZERCATWAGON · « **Reply #17 on:** April 28, 2010, 04:11:09 pm »

it was terrorists

five of them

Furai · « **Reply #18 on:** April 28, 2010, 05:07:40 pm »

I saw two of them giving bribe to Flies...

echo_trail · « **Reply #19 on:** April 28, 2010, 06:09:09 pm »

Quote from: Dusty on April 28, 2010, 12:54:18 pm

Who is behind all this?

A foul villain.. Internet warriors assemble! We MUST retaliate.

L[0ne]R · « **Reply #20 on:** April 29, 2010, 02:47:21 pm »

Quote from: echo_trail on April 28, 2010, 06:09:09 pm

Quote from: Dusty on April 28, 2010, 12:54:18 pm
Who is behind all this?

A foul villain.. Internet warriors assemble! We MUST retaliate.

Yeah! Let's be happy and do nothing!

If pissing us off was hacker's goal - I'd say he failed (I actually had a good laugh when I saw SF that way). Almost nothing was lost, and something was even gained (improvement in SF security).
It's nice to see that there's no panic and whine, let it stay that way.

DorkeyDear · « **Reply #21 on:** April 29, 2010, 04:12:56 pm »

SDFilm · « **Reply #22 on:** April 29, 2010, 04:20:03 pm »

Quote from: L[0ne]R on April 29, 2010, 02:47:21 pm

Quote from: echo_trail on April 28, 2010, 06:09:09 pm
Quote from: Dusty on April 28, 2010, 12:54:18 pm
Who is behind all this?

A foul villain.. Internet warriors assemble! We MUST retaliate.
Yeah! Let's be happy and do nothing!

If pissing us off was hacker's goal - I'd say he failed (I actually had a good laugh when I saw SF that way). Almost nothing was lost, and something was even gained (improvement in SF security).
It's nice to see that there's no panic and whine, let it stay that way.

Considering that Soldat Forums has seen much worse in its days (porn spams and someone abusing Chakra's account) I almost thought that it was an odd maintenance sign.

demoniac93 · « **Reply #23 on:** April 29, 2010, 04:28:16 pm »

I actually got a good lol out of that.
But at first I thought it was supposed to be a bad joke by the management.

L[0ne]R · « **Reply #24 on:** April 29, 2010, 06:07:22 pm »

From IRC:
-----------
xxx: <html>
xxx: brb
xxx: <br>
xxx: -FliesLikeABrick
xxx: </html>
xxx: thats soldatforums now

echo_trail · « **Reply #25 on:** April 29, 2010, 07:21:32 pm »

Quote from: L[0ne]R on April 29, 2010, 02:47:21 pm

Quote from: echo_trail on April 28, 2010, 06:09:09 pm
Quote from: Dusty on April 28, 2010, 12:54:18 pm
Who is behind all this?

A foul villain.. Internet warriors assemble! We MUST retaliate.
Yeah! Let's be happy and do nothing!

If pissing us off was hacker's goal - I'd say he failed (I actually had a good laugh when I saw SF that way). Almost nothing was lost, and something was even gained (improvement in SF security).
It's nice to see that there's no panic and whine, let it stay that way.

Yeah, you guys are unpredictable maniacs. Way to tell him crime doesn't pay. We have a hacker on our hand, OH LAWDS, but he failed his ultimate scheme. We rock

If I wasn't drunk out of my mind right now, I'd dare say the vast community of sf.com has shown it's worth yet again. Dear hacker, WHO'S LAUGHING NOW?!!

SpiltCoffee · « **Reply #26 on:** April 30, 2010, 12:54:52 am »

Quote from: echo_trail on April 28, 2010, 06:09:09 pm

Quote from: Dusty on April 28, 2010, 12:54:18 pm
Who is behind all this?

A foul villain.. Internet warriors assemble! We MUST retaliate.

More like the internet village is going to assemble together their pitchforks and flaming torches and go raid the closest troll's house.

Furai · « **Reply #27 on:** April 30, 2010, 03:02:57 am »

Quote from: SpiltCoffee on April 30, 2010, 12:54:52 am

(...) the closest troll's house.

-Major-'s ??

DarkCrusade · « **Reply #28 on:** April 30, 2010, 04:07:01 am »

Quote from: Wookash on April 30, 2010, 03:02:57 am

-Major-'s ??

Yes.

I had a laugh at that pic, also

pavliko · « **Reply #29 on:** April 30, 2010, 04:16:11 am »

A delivery for you guys.

I saved it so that I will upload it in the future for the laugh..

Quote from: L[0ne]R on April 29, 2010, 06:07:22 pm

From IRC:
-----------
xxx: <html>
xxx: brb
xxx: <br>
xxx: -FliesLikeABrick
xxx: </html>
xxx: thats soldatforums now

Who might that be? ^^
I know! It's batman!! :O

[SIRS]Foxconn^^2012 · « **Reply #30 on:** May 01, 2010, 02:47:44 pm »

Quote from: Dusty on April 28, 2010, 12:54:18 pm

Who is behind all this?

Enesce.

demoniac93 · « **Reply #31 on:** May 01, 2010, 02:51:50 pm »

Quote from: [SIRS]Foxconn^^2012 on May 01, 2010, 02:47:44 pm

Quote from: Dusty on April 28, 2010, 12:54:18 pm
Who is behind all this?

Enesce.

LIES! PROPAGANDA!

[SIRS]Foxconn^^2012 · « **Reply #32 on:** May 01, 2010, 03:13:29 pm »

~~COMMUNISM!~~ UPYACHKA!

pavliko · « **Reply #33 on:** May 02, 2010, 01:40:21 am »

Foxconn you should be more active on irc to know whos behind that

Blue-ninja · « **Reply #34 on:** May 02, 2010, 03:13:14 am »

Actually, it just looks like someone wanted to show you a security flaw and proved it. They could probably done a lot more than that.

[SIRS]Foxconn^^2012 · « **Reply #35 on:** May 02, 2010, 03:45:53 am »

Wait. I can just scan these forums with IntelliTamper and send the results to flies.

IntelliTamper will look for more security holes that can be used for a very cruel internet attack. Sending results to flab will save our asses for a very long period of time.

He will keep the results viewable for admins only, because some of the admins can quickly help him. Maybe jrgp knows something about it.

Waiting for admins decission to scan...

Thinkto urself · « **Reply #36 on:** May 02, 2010, 11:23:19 am »

you shouldn't say important things like those in a public forum, they can get your ip and burn down your house

Espadon · « **Reply #37 on:** May 02, 2010, 11:52:45 am »

Foxconn. Just... no.

ds dude · « **Reply #38 on:** May 02, 2010, 01:06:16 pm »

Foxconn should I refer you to my past events here on the soldat forums.

Yeah. Didn't think so.

tehsnipah · « **Reply #39 on:** May 03, 2010, 07:10:56 pm »

I'm actually surprised that Soldat's surrounding (game, forum) is keep getting hacked.

But I do have a feeling that this "hack" was just to warn FLAB/EnEsCe/MM to take care of Soldat better... Or am I being too optimistic.

pavliko · « **Reply #40 on:** May 04, 2010, 12:21:12 am »

Quote from: tehsnipah on May 03, 2010, 07:10:56 pm

But I do have a feeling that this "hack" was just to warn FLAB/EnEsCe/MM to take care of Soldat better... Or am I being too optimistic.

Why do you think so? ^__^
I got this strange feeling that YOU might be behind this all...
The real hackers are only the ones who say that they feel that this was just a warm to make soldat better...

Meep. · « **Reply #41 on:** May 04, 2010, 01:00:08 am »

Quick question, when I try to change my password it says "LDAP - Could not bind." Am I just doing something stupid?

L[0ne]R · « **Reply #42 on:** May 04, 2010, 02:08:18 pm »

Quote from: Meep. on May 04, 2010, 01:00:08 am

Quick question, when I try to change my password it says "LDAP - Could not bind." Am I just doing something stupid?

No, I'm having the same problem. :/

jrgp · « **Reply #43 on:** May 04, 2010, 02:23:16 pm »

Quote from: Meep. on May 04, 2010, 01:00:08 am

Quick question, when I try to change my password it says "LDAP - Could not bind." Am I just doing something stupid?

Quote from: L[0ne]R on May 04, 2010, 02:08:18 pm

Quote from: Meep. on May 04, 2010, 01:00:08 am
Quick question, when I try to change my password it says "LDAP - Could not bind." Am I just doing something stupid?
No, I'm having the same problem. :/

Should be fixed now.

tehsnipah · « **Reply #44 on:** May 04, 2010, 04:09:29 pm »

Quote from: pavliko on May 04, 2010, 12:21:12 am

Quote from: tehsnipah on May 03, 2010, 07:10:56 pm
But I do have a feeling that this "hack" was just to warn FLAB/EnEsCe/MM to take care of Soldat better... Or am I being too optimistic.
Why do you think so? ^__^
I got this strange feeling that YOU might be behind this all...
The real hackers are only the ones who say that they feel that this was just a warm to make soldat better...

Ya, a programming nub and 1337 14ngu4g3 nub liek me can hax this website.
I think this way, because I'm just an optimistic guy. I mean, what other reasons can there be?

pavliko · « **Reply #45 on:** May 05, 2010, 12:40:44 am »

Don't change the target. Every pro anon hacker acts like a nub, but hes really a pro. If you weren't the hacker then you would say that it was you....

DarkCrusade · « **Reply #46 on:** May 05, 2010, 09:30:16 am »

So you are a total noob, too, right, pav?

pavliko · « **Reply #47 on:** May 05, 2010, 09:38:58 am »

Sure i'm!!!

DarkCrusade · « **Reply #48 on:** May 05, 2010, 04:20:01 pm »

We got a non-liar! Ban!

tehsnipah · « **Reply #49 on:** May 05, 2010, 05:15:23 pm »

Quote from: pavliko on May 05, 2010, 12:40:44 am

Don't change the target. Every pro anon hacker acts like a nub, but hes really a pro. If you weren't the hacker then you would say that it was you....

Durp got me. Arrest me bitch.

Furai · « **Reply #50 on:** May 05, 2010, 06:16:02 pm »

I'm really amused by how quickly all threads in soldat forums turn into flame&troll wars.

echo_trail · « **Reply #51 on:** May 06, 2010, 04:00:53 am »

Wookash is right. Everyone shut the fuck up. Back on topic, please.

ds dude · « **Reply #52 on:** May 08, 2010, 06:25:19 pm »

Quote from: pavliko on May 04, 2010, 12:21:12 am

Quote from: tehsnipah on May 03, 2010, 07:10:56 pm
But I do have a feeling that this "hack" was just to warn FLAB/EnEsCe/MM to take care of Soldat better... Or am I being too optimistic.
Why do you think so? ^__^
I got this strange feeling that YOU might be behind this all...
The real hackers are only the ones who say that they feel that this was just a warm to make soldat better...

Please.. tensnipah can't even dress himself let alone hack a forums.

jrgp · « **Reply #53 on:** May 08, 2010, 06:32:42 pm »

Quote from: echo_trail on May 06, 2010, 04:00:53 am

Wookash is right. Everyone shut the f**k up. Back on topic, please.

this topic isn't even useful anymore. The security hole(s) were fixed and it won't happen again. Everything here is pretty much irrelevant now.

FliesLikeABrick · « **Reply #54 on:** May 09, 2010, 11:21:29 am »

Quote from: jrgp on May 08, 2010, 06:32:42 pm

Quote from: echo_trail on May 06, 2010, 04:00:53 am
Wookash is right. Everyone shut the f**k up. Back on topic, please.

this topic isn't even useful anymore. The security hole(s) ~~were~~ should be fixed and it ~~won't~~ shouldn't happen again. Everything here is pretty much irrelevant now.

Unfortunately, nothing is for sure ^^

echo_trail · « **Reply #55 on:** May 09, 2010, 06:47:59 pm »

Nothing ever is. But this sort of thing has happened before, as far as I recall, and you guys have always managed to fix it.

Espadon · « **Reply #56 on:** May 09, 2010, 06:58:26 pm »

What is for sure is OUR UNHACKABLE BOND OF FRIENDSHIP

News:

Author Topic: SF defaced (Read 7662 times)

DarkCrusade

DarkCrusade

DarkCrusade