Forum Hack

[ProxyAmenRa]

Well, that was interesting. Someone tore down a wallpaper.

 

[Duxwing]

Indeed. What a strange event. I wonder what they wanted with us.

-Duxwing

 

[ProxyAmenRa]

Indeed. What a strange event. I wonder what they wanted with us.

-Duxwing

This forum is targeted around once per year. Probably some old members pissed off that they were banned.

 

[BigApplePi]

This forum is targeted around once per year. Probably some old members pissed off that they were banned.

It's a conspiracy with a trigger where the Earth comes 'round to a certain point.

 

[Ragnar]

I'm looking into it; and have turned the place back on for now. Not having been here I don't know what the symptoms were, but turning the forum off was absolutely the right thing to do.


There seems no evidence left in the back-end: but it gave us a chance to repair the database.

 

[EyeSeeCold]

http://urlquery.net/report.php?id=2366093

[bIMG]http://i.imgur.com/Yyxphbp.png[/bIMG]

 

[Duxwing]

I'm looking into it; and have turned the place back on for now. Not having been here I don't know what the symptoms were, but turning the forum off was absolutely the right thing to do.


There seems no evidence left in the back-end: but it gave us a chance to repair the database.

Three cheers for the sysadmins!

-Duxwing

 

[Architect]

Loved it, but thanks for fixing.

 

[Wolf18]

I've been bored for days on end. Thanks for taking care of this.

Duxwing, I doubt they wanted anything. It was p0wersurge, a hacker group. Then again, I hope no one had any important personal information on here.

SW

 

[jachian]

That was so cool !! I watched the kitty dance for hours !!

 

[Duxwing]

I've been bored for days on end. Thanks for taking care of this.

Duxwing, I doubt they wanted anything. It was p0wersurge, a hacker group. Then again, I hope no one had any important personal information on here.

SW

The payoff from a typology forum DoS seems such a tiny bang for so much work. Also, I've tried researching them, but nothing's come up. Do you anything more about them?

-Duxwing

 

[TheScornedReflex]

That was so cool !! I watched the kitty dance for hours !!

Hahahaha, same!

 

[TheScornedReflex]

And the mighty overlord reveals himself.. What a week.

 

[C.Hecker88]

I'm looking into it; and have turned the place back on for now. Not having been here I don't know what the symptoms were, but turning the forum off was absolutely the right thing to do.


There seems no evidence left in the back-end: but it gave us a chance to repair the database.

Hello Ragnar.

Whatever happened, I'm glad that it's all back to normal. I was beginning to go quite mad without my procrastination fix.

 

[Nick]

I miss the dancing kitty!
Can we put it up somewhere on the site as a memorial?

Maybe since it happened on the 7th, it was part of OpUSA?
https://krebsonsecurity.com/2013/05/dhs-opusa-may-be-more-bark-than-bite/

 

[pjoa09]

I'm looking into it; and have turned the place back on for now. Not having been here I don't know what the symptoms were, but turning the forum off was absolutely the right thing to do.


There seems no evidence left in the back-end: but it gave us a chance to repair the database.

@Ragnar

murd3r requested to update the forum and remove ibProArcade or something.

I kinda agree.

I don't know if that was the motive of the hack.

 

[patchtrix]

the intj forum was so boring!

 

[C.Hecker88]

the intj forum was so boring!

Oh wow, I'm sorry for you. I was lucky enough to have an INTP facebook group to lurk in.

 

[patchtrix]

Oh wow, I'm sorry for you. I was lucky enough to have an INTP facebook group to lurk in.

lol i actually got filtered about three times for mentioning this forum until i figured it out

 

[Kuu]

murd3r requested to update the forum and remove ibProArcade or something.

Where exactly was this request made, if I may so inquire?

It does seem there's an exploit in the arcade plugin, so I've put it in the rubbish bin.

Motivation? Probably just because they could. For the lulz.

 

[walfin]

Anyone made a screenshot of the kitty?

 

[Affinity]

Cute dancing kitty and elegant electronic music. It was not a bad sojourn.

 

[bartoli]

Also, while the forum was down, i found an old version of INTPf on the web still running. Time to close this one? http://199.193.247.39/
I think the cat was just in the javascript of the page if someone still has it in history. Or it is apparently available if you register on the hackers' forum

 

[pjoa09]

Where exactly was this request made, if I may so inquire?

It does seem there's an exploit in the arcade plugin, so I've put it in the rubbish bin.

Motivation? Probably just because they could. For the lulz.

@Kuu
Honest.

I made an account at p0wersurge and I pmed murd3r, he then sent me a rather short pm in return. Unfortunately, in the midst of a hastily made complicated password that I forgot and still can't recover even after successfully requesting for it on my email, I can't access that pm anymore.

Yeah, I think it was for the lulz. I made a query search and saw that intpf was on the top 10 or 15 exploitable forums. I believe mostly because its dated.

I am pretty damn sure a couple of INTPs got an account on that website.

So I guess that was the motivation. Cool site though.

 

[Cognisant]

I was insulted that their forum called me a noob for not using one of the two operating systems they prefer, I use an ipad for general browsing precisely because they're hard to hack in to, I can't help but wonder what kind of moron would actually take that advice.

Furthermore it's been suggested to me that long outages like this may convince longstanding members who are already thinking of leaving into actually doing so.

Not happy.
(not directed at Ragnar)

 

[BigApplePi]

Furthermore it's been suggested to me that long outages like this may convince longstanding members who are already thinking of leaving into actually doing so.

Attention:
If you are a longstanding member thinking of leaving, you are to immediately stop thinking. Pour your feelings out to Cognisant first.

If Cognisant is unable to turn you around, your status as a longstanding member will be terminated and you will be demoted to member emeritus.

Intermediate-standing members will be promoted to longstanding members with or without their permission and will replace you. All positions will be filled as vacuums are not to be tolerated.

 

[Ragnar]

Also, while the forum was down, i found an old version of INTPf on the web still running. Time to close this one? http://199.193.247.39/

Strange, and slightly peculiar.

Hostspy is down at this moment, so I can't see anything about it; but the ip is nearly the same as this one's. It is as if our hosts have released an old back-up into the wild blue yonder. Which is unlikely --- however I can't see why anyone would waste hosting on a permanently inactive mirror.

Yeah, I think it was for the lulz. I made a query search and saw that intpf was on the top 10 or 15 exploitable forums. I believe mostly because its dated.

I doubt if it is among the most exploitable forums; just that the author of that 35 list ( which is to be seen in Google cache --- note: now to use Google cache, you press the green down button at the end of the url ) targeted it and the others *. And published the hashes. The list includes vBulletin 4.2; however even vBulletin 5.0 released this year has sql exploits. Plenty of bigger sites still run on 3.x.x, such as The Straight Dope.


* I must say they mostly seem innocuous: one of them is this wildlife forum: http://redtailboa.net/forums/


It was probably the Arcade vulnerability; but I am getting more sceptical of php itself every tear...

 

[The Gopher]

Nobody is allowed to leave without telling me first.

 

[BigApplePi]

Nobody is allowed to leave without telling me first.

If you dare to leave wo notifying Gopher, you may be subject to silencing followed by ostracism.

 

[Ragnar]

Well, something went wrong: Five modifications needed updating, but one the translator of yore was long gone: so 4: updated them and added Tapatalk, and I couldn't post...

Uninstalled Tapatalk, same thing. Turned off 2 of them just upgraded ( template modification & advanced user tagging ) and it works again.

So you can't tag if ever you did.



Basically, everyone has the mantra: upgrade; then when you do it stops working. Doesn't stop them telling you to keep the upgrade as anyone ever on a Mozilla or Wordpress help forum can notice.

 

[Ex-User (5841)]

It was for teh lullz/to gain merit.

Specifically, via ProxieZ: http://www.p0wersurge.com/forums/introductions/7662-thd.html

"I know exactly what your problem is, and how it was exploited, PM me and I will be more than happy to help you out, since you asked. I have reverted your index.php back to normal already and deleted the shells/arcade.php which was the exploited file.

There is a known SQLi in the ibProArcade 2.7.1+, that was coded by MrZeropage, however there are updated versions you can get if you have a vBulletin license, which you do. Best luck fixing up your forum!"

vBulletin vulnerability

 

[Ex-User (5841)]

Overall the p0wersurge peeps seem fairly amiable, and I like their functional skillset and collective potential, so...

 

[Ragnar]

Well, thank them for me. Not for the hack; but for being OK afterwards.





The Arcade has been updated, but now I don't trust it anyway.

 

[Oedipus]

What was the song that the kitty danced to?

 

[Jennywocky]

What was the song that the kitty danced to?

Not sure, it was some kind of cute electro-pop thing. The kitty was bigger than the screen and kept changing colors and was doing in ASCII-art style.

EDIT:

Here's the cat, in black and white.

http://procool.ru/interesting/funny_kitten.htm

 

[TheScornedReflex]

What was the song that the kitty danced to?

Someone posted a link to it.. I shall go find it.

Found it.

http://www.youtube.com/watch?v=0kxlbndlfs8


Supplied by Adaire.

 

[Oedipus]

I had to keep coming here to listen to it.

 

[Redfire]

But wasn't the cat turning around? I think Jenny posted the same cat with a different dance.

The song is awesome. All in all it was a good experience :P

 

[BloodCountess88]

That was so cool !! I watched the kitty dance for hours !!

I did too, so did my toddlers!

The music was great, it was a great experience overall. Plus, kitteh!


The song was this one though. It wasn't daybreak, but after hours.

 

[Redfire]

That's just the album's six songs all in a row I think.

 

[Ink]

So did they get any "vulnerable information" or not?

 

[Ragnar]

They already had the vulnerable information, which was a leak in the Arcade software which enabled some person to publish the hashes of admin access on the internet, which meant the hackers could change some stuff temporarily. They weren't interested in member information --- hackers don't target users' accounts for obvious reasons: they target admins' accounts --- and really the only information anyone can gather in any forum, apart from access in the first place, is a member's email address and his/her password. And they can get most email addresses anyway from most people simply by making a post inviting people to email them for some alleged reward. Not that I think email lists have the value they might have had ten years ago, even for spamlords.

The Arcade is now patched, although were I them I would have left a backdoor, and it seems more of a prank than anything vicious. Admin passwords are changed and everyone ought to change their own password; but there is no danger or loss.

However I can say it will happen again: not from the same persons and not through the same leak; but simply because all websites are hackable and all forums will get hacked eventually. A couple of years back in 2011 they hacked the White House, Linux.org, Microsoft and others: in 2012 vbulletin.org was hacked causing members to be locked out awhile.



It's just like power-cuts: they are going to happen and any country's electricity supplier who guarantees there will never ever be interrupted power is lying.






And, of course, sometimes it's the power brokers themselves manipulating the power cuts, as with Enron, of blessed memory.

 

[Architect]

The best part is that it forced you to update the old forum software and now it supports Tapatalk

 

[Duxwing]

The best part is that it forced you to update the old forum software and now it supports Tapatalk

Sounds like somebody was little bit displeased with the old order.

-Duxwing

 

[Architect]

Sounds like somebody was little bit displeased with the old order.

I had nothing to do with the Forum hack. That's my story and I'm sticking to it.

 

[Ragnar]

The vBull remains the same version, just the four mods were updated. And I can't see any point in going to vBull 4 or 5, when it would be cheaper to go to something else such as XenForo --- and prolly a damn sight more secure. A forum conversion is not on the cards right now because of a/ cost and b/ the sorrow of losing installed mods; though I suppose people could live with the latter sadly enough...

It's rather the same with WordPress, each upgrade may make some plugins stop working, and wordpress.org has now begun warning that older plugins are old. The plugin developers stop supporting plugins eventually anyway. It's entropy, I tell you, entropy !




As for Tapatalk, I will make an announcement later, but I don't particularly understand it as I use an old Motorola, and I dunno if anyone actually uses it much; but it looked neat.


Also I think it costs about $3 as an app.







P.S Is that Robert E. Lee ?