PDA

View Full Version : What happened?

Th0r
9th January 2010, 10:00 PM
Well, where have we been the past week?

We were hacked. No point in telling porkies about it because enough people know to make that a pointless excercise. You'll have noticed a months posts, users, threads and all have gone to the dogs.

How did this happen? Parts of the database were corrupted both by the hackers and PHP My Admin. The piece of shit programme we use to manage our SQL databases.

After the best part of FORTY hours trying to work this shit out on my part (I had almost the entire week off due to snow.) and a considerable amount of input from DoctaD I realised we're never going to get that one month back.

Sad, but true.

Not that big a deal. Might sound stupid of me but we can get most of the threads back courtesy of Google Cached Pages.

Has the data been compromised?

Nope. Even if it was the data is relatively secure. Passwords are hashed using MD5 and salted three times over.

Once again, you have my apologies.
bankraped
9th January 2010, 10:09 PM
Good job on saving as much as you did.

Welcome back, rorta!
Beyond
9th January 2010, 10:15 PM
Cheers Th0r!
Th0r
9th January 2010, 10:21 PM
Glad to see people missed us. I am deeply sorry about the data loss and it shouldn't have happened. You can blame our host for that one... Hope everyone's ok...
DoctaD
9th January 2010, 10:34 PM
Th0r mentioned our host... they were changing their backup servers so users can restore their own scheduled backups. We were hacked at the worst possible time, a few days later and the loss of data would have been minimal. At least, we can promise that if something like this happens again there would not be such disasterous circumstances.

I too apologise for the downtime and loss of data, and encourage everyone to repost anything lost.
lcnostra
9th January 2010, 10:43 PM
I can't imagine the work and frustration with getting the board back on its feet. Great job to all and many thanks.
Th0r
9th January 2010, 10:55 PM
Be sure to tell everyone you know here that Rorta's back. Invite as many associates and whatnot as is possible!
Tricho
9th January 2010, 11:25 PM
It was quite annoying I was like what the hell all week. I was going through withdraw. The funnier thing is that it changed my avatar back to Heinrich Himmler and it was the Ice Truck Killer before, hmmm interesting I guess they did delete a month.
catnips
9th January 2010, 11:25 PM
oh well : it happens ...
Th0r
9th January 2010, 11:26 PM
We gotta move on and say shit happens...

We've learned our lesson.
xannex
9th January 2010, 11:44 PM
Thanks for working so hard to get it back up.
Beyond
10th January 2010, 12:20 AM
I can't imagine the work and frustration with getting the board back on its feet. Great job to all and many thanks.

It can be a real pain in the ass because there is literally so much that could go wrong in the process. Th0r did a great job.
Mr.A
10th January 2010, 01:07 AM
What a bitch.
Jinx
10th January 2010, 10:21 AM
Woo! I was hoping when you guys were gunna be back up. Just got back from the lakes...Ugh sad to hear about the data loss, but thanks Th0r, DoctaD and everyone else whom helped getting Rorta back on it's feet. Extremely appreciated. Will continue to post as per normal and once again, thanks for getting Rorta back up guys.
REL0AD
10th January 2010, 01:26 PM
HEIL TH0R!
thief
10th January 2010, 05:59 PM
Wait... what.... Mr.A? Hmmmmm
REL0AD
10th January 2010, 07:08 PM
Wait... what.... Mr.A? Hmmmmm

I don't think so somehow...
Th0r
10th January 2010, 07:23 PM
Wait... what.... Mr.A? Hmmmmm

Oh please. We know who did it, I've got names, addresses etc.
NINEBREAKER
10th January 2010, 08:04 PM
thankfully this place is back up.
odin_dax
10th January 2010, 08:14 PM
Oh please. We know who did it, I've got names, addresses etc.

What can be done?
Th0r
10th January 2010, 08:26 PM
I'm not sure. I want to take this slowly... Play our cards right. These fuckers screwed us over alright, but I don't want a repeat.
thief
11th January 2010, 01:16 AM
Oh please. We know who did it, I've got names, addresses etc.

I know you said so on msn... but he is back in town. :poke:
odin_dax
11th January 2010, 02:26 AM
I know you said so on msn... but he is back in town. :poke:

??????
Mr.A
11th January 2010, 02:26 AM
Why do I always have to play the bad guy?!
thief
11th January 2010, 06:40 PM
??????

And the question is?
Th0r
11th January 2010, 08:25 PM
I know Mr. A is innocent, whatever you say. He doesn't deserve the blame for this shit.
thief
12th January 2010, 12:58 AM
I never gave him the blame.... :/
Th0r
12th January 2010, 07:23 PM
It seemed to me like you implied it. Whatever, you're acquitted.

I know Mr. A was disliked by people here but he was disliked for making stupid posts and breaking rules (To an extent.). I don't see him making pointless posts, snooping around and breaking rules.

He stays unless he does otherwise.
Slip240sx
13th January 2010, 03:06 AM
damm i missed you guys
Mr.A
13th January 2010, 03:58 AM
damm i missed you guys

Does anyone know who this is?
Th0r
13th January 2010, 09:08 AM
Does anyone know who this is?

Yeah, he was here before the crash. Had like thirty posts in a month. He's legit.
Slip240sx
13th January 2010, 11:58 PM
yeah i noticed all my post were gone so i will try to repost some of those ideas i had again. please tell me whoever the fuck did this is going to get a little payback??!! don't need to know how just want to know its going to happen!!!
DoctaD
14th January 2010, 01:00 AM
We're not launching some cyber attack on anyone, or delivering flaming shit bags to their doors, or even signing them up to spam mailing lists. It seems to me that some random scumbags, in no way associated with rorta, launched a pointless attack due to the fact we hadn't patched the vB, which we now have... thats the end of it.
Tricho
14th January 2010, 01:36 AM
We're not launching some cyber attack on anyone, or delivering flaming shit bags to their doors, or even signing them up to spam mailing lists. It seems to me that some random scumbags, in no way associated with rorta, launched a pointless attack due to the fact we hadn't patched the vB, which we now have... thats the end of it.

I bet the said hacker had a laugh cause of that prior vulnerability.
catnips
21st January 2010, 12:57 AM
We're not launching some cyber attack on anyone, or delivering flaming shit bags to their doors, or even signing them up to spam mailing lists. It seems to me that some random scumbags, in no way associated with rorta, launched a pointless attack due to the fact we hadn't patched the vB, which we now have... thats the end of it.

How very sane and level-headed; I'm happy to hear it ...
EOF
iceniner
21st January 2010, 08:02 PM
Vbulletin and most other forum software should allow backups to be performed by script.

PHPMyAdmin is the buggiest, security-hole-riddenest piece of shit ever.

MD5 triplesalt should not be considered secure especially if the system has been compromised.

Typically, the way these hacks proceed is via search engines. They would search for some text string, eg. "Powered by vBulletin? Version 3.7.1" (from down at the bottom of the window here), software versions that they have exploits for. Then the script will go ahead and intrude, deface, delete and steal passwords.
Th0r
21st January 2010, 08:11 PM
Iceniner, see my thread on MD5.

PHP My Admin is a bitch to use, but we had no other choice. SSH and Telnet wasn't going to work and ultimately somewhere along the line some SQL had screwed up.
iceniner
22nd January 2010, 12:26 AM
SSH and Telnet wasn't going to work

Why does SSH not work?

You could disable PHPMyAdmin until you needed to use it.
Th0r
22nd January 2010, 07:09 PM
It just wouldn't connect.