Author Topic: ---WARNING--- - password hacking attempt on many accounts -- UPDATE -- (Read 22007 times)

saint · « **on:** February 15, 2011, 10:20:19 pm »

Someone has been attempting to hack user accounts here today using an automated process with multiple IP addresses. Dozens of regular posters are being targeted. If your password isn't a good, secure, hard to randomly crack/guess password, you are strongly encouraged to change it to one that is.

UPDATE 02-18-2011

The password hacking attack does not appear to be related to any other issue at BYOAC. There is a mass-attack against SMF forums (and others, such as PHPboard) in general. More info here: http://www.simplemachines.org/community/index.php?topic=421603.msg2949285#msg2949285. The attacks against BYOAC match this pattern exactly. I do not believe Driver-Man is related to this at all.

I am taking various measures against the attacks. There have not been any successful attacks that I am aware of anywhere. I now consider this a low threat level. Make sure you have a good, non-dictionary based password and beyond that I would not worry about it.

I will note if anything changes in this arena.

--- saint

yotsuya · « **Reply #1 on:** February 15, 2011, 11:08:37 pm »

Man, I wish there was something we could do about it/him.

SavannahLion · « **Reply #2 on:** February 15, 2011, 11:30:38 pm »

All it does is prove just how wrong the punk is. If he was right there would be no reason to act like an
---uvula---.

trevski · « **Reply #3 on:** February 16, 2011, 07:59:35 am »

ooh, I wonder.

Man, what a dips**t

Hoopz · « **Reply #4 on:** February 16, 2011, 08:00:33 am »

Quote from: trevski on February 16, 2011, 07:59:35 am

Man, what a dips**t

You can call him a dipshit or anything else. The site has an auto censor. I call him a ---P&R denizen--- amongst other things.

CheffoJeffo · « **Reply #5 on:** February 16, 2011, 08:35:48 am »

I think it may be time to take up a collection to send someone down to visit spacies and deal with this ---P&R denizen---.

I would volunteer, but I think that perhaps Xiaou with his death punch may be more suitable.

Ed_McCarron · « **Reply #6 on:** February 16, 2011, 08:41:44 am »

---steaming pile of meadow muffin---, so I should change my password from "12345?"

stu33 · « **Reply #7 on:** February 16, 2011, 08:52:50 am »

That's the same combination I have on my luggage!

shfifty · « **Reply #8 on:** February 16, 2011, 08:53:50 am »

he should get a Shinkuu Hadouken to the face

HaRuMaN · « **Reply #9 on:** February 16, 2011, 09:11:36 am »

maybe I should change mine... mine is "password"

HaRuMaN · « **Reply #10 on:** February 16, 2011, 09:13:25 am »

Here's a dumb question, say he was able to hack a mod's account... would that give him access to the forum user's passwords? Or is that encrypted somewhere (I hope).

emphatic · « **Reply #11 on:** February 16, 2011, 09:13:56 am »

Quote from: HarumaN on February 16, 2011, 09:11:36 am

maybe I should change mine... mine is "password"

That's really clever.

Samstag · « **Reply #12 on:** February 16, 2011, 09:21:44 am »

I'm pretty sure I'm okay. Mine is Hq71d4AQr2KsN4f2S, so only the most persistent of hackers could hope to crack it.

newmanfamilyvlogs · « **Reply #13 on:** February 16, 2011, 09:22:14 am »

If his un-proxied IP was recorded, I wonder what could be done by contacting his ISP? We know his real name, his home address.. I recall seeing a plausible DOB somewhere.

He's lived in NZ since at least 2004:
http://www.trademe.co.nz/Electronics-photography/TVs/Standard/CRT/21-53cm-and-under/auction-62790078.htm

I suppose it's at least possible he's no longer living in the area and the person whose address is findable is just family.. here in 2008 is selling various household items:
http://web.archive.org/web/20080512072008/http://www.trademe.co.nz/Members/Listings.aspx?member=487159

The account is now closed.

leapinlew · « **Reply #14 on:** February 16, 2011, 09:32:31 am »

Thanks saint

I added a number 7 to my "123456" password to make it more secure.

saint · « **Reply #15 on:** February 16, 2011, 09:40:53 am »

Quote from: HarumaN on February 16, 2011, 09:13:25 am

Here's a dumb question, say he was able to hack a mod's account... would that give him access to the forum user's passwords? Or is that encrypted somewhere (I hope).

I don't have access to passwords. I can change them, but not tell you what they are.

saint · « **Reply #16 on:** February 16, 2011, 09:42:18 am »

Quote from: leapinlew on February 16, 2011, 09:32:31 am

Thanks saint

I added a number 7 to my "123456" password to make it more secure.

Attaboy.

This may be an unrelated attack. I know of at least one other SMF forum undergoing a similar attack.

newmanfamilyvlogs · « **Reply #17 on:** February 16, 2011, 09:44:53 am »

Maybe setup a honeypot account and see what happens?

shilmover · « **Reply #18 on:** February 16, 2011, 10:22:01 am »

obviously, I have missed something as I have no idea who you are talking about...

Hoopz · « **Reply #19 on:** February 16, 2011, 10:35:35 am »

Quote from: cotmm68030 on February 16, 2011, 09:44:53 am

Maybe setup a honeypot account and see what happens?

The old Pooh Bear defense?

Donkbaca · « **Reply #20 on:** February 16, 2011, 10:37:07 am »

done - password changed to Hackerlicks2balls

figured the number 2 would prevent him from figuring it out...

ErikRuud · « **Reply #21 on:** February 16, 2011, 10:56:14 am »

Is it ok to use my cat's name as my password?

His name is "p#4dgtoxg@t%htkafe". I change his name every 30 days.

opt2not · « **Reply #22 on:** February 16, 2011, 11:08:51 am »

Wow, if it's "you-know-who", his dedication to ---meecrob----baggery is astounding.

Dartful Dodger · « **Reply #23 on:** February 16, 2011, 11:12:50 am »

My password is so secure I don't even know it.

I've had this computer for over 7 years. I think the last time I had to enter a password was a few years ago when arcadecontrols.com switch servers or something.

(I had forgotten my password then too.)

wp34 · « **Reply #24 on:** February 16, 2011, 11:36:23 am »

Quote from: ErikRuud on February 16, 2011, 10:56:14 am

Is it ok to use my cat's name as my password?

His name is "p#4dgtoxg@t%htkafe". I change his name every 30 days.

Mikezilla · « **Reply #25 on:** February 16, 2011, 12:11:47 pm »

God that is such ---That which is odiferous and causeth plants to grow---. What a low life scumbag. That cat one was pretty funny though.

missioncontrol · « **Reply #26 on:** February 16, 2011, 12:32:58 pm »

what if your password is a censored word, does that mean you password is actually what the auto-censor changes it to?

newmanfamilyvlogs · « **Reply #27 on:** February 16, 2011, 01:22:41 pm »

My password has an MD5 hash of 'xxxxpleasedontstealpasswordsxxxx'

ark_ader · « **Reply #28 on:** February 16, 2011, 02:24:27 pm »

Really, what is in your account for him to steal?

Time to have a peek and remove any details that might incriminate you or put your personal life into Jeopardy.

I have a SMF forum on my site that was retired on the grounds that it was targetted by hackers.

Maybe Saint should migrate to IP Board. Yes it costs to subscribe, but it is more secure.

If everyone donated 50c Saint would have enough cash to have it.

Thanks for tell me though, and I have changed my password from ataridigdug to........

saint · « **Reply #29 on:** February 16, 2011, 02:25:50 pm »

For what it's worth, I have no indicators that we *have* been hacked. My warning about your password is precautionary (and good advice in general)...

ark_ader · « **Reply #30 on:** February 16, 2011, 02:32:53 pm »

Quote from: saint on February 16, 2011, 02:25:50 pm

For what it's worth, I have no indicators that we *have* been hacked. My warning about your password is precautionary (and good advice in general)...

You do not have a three try lockout or something similar for an indicator?

saint · « **Reply #31 on:** February 16, 2011, 02:42:09 pm »

Quote from: ark_ader on February 16, 2011, 02:32:53 pm

Quote from: saint on February 16, 2011, 02:25:50 pm
For what it's worth, I have no indicators that we *have* been hacked. My warning about your password is precautionary (and good advice in general)...

You do not have a three try lockout or something similar for an indicator?

The behavior looks a lot like a brute force attack. No one account is ever attempted more than once in a row, though repeated periodically. It's pretty much:

Try a username/password. Fail
Try another username/password. Fail
Try another username/password. Fail
.
.
.
Try the first username/password. Fail

Each from a different IP address with random time intervals between.

A 3 tries and you're locked won't really work in this attack due to the long time intervals and IP hopping, unless someone sees something I'm overlooking? Suggestions welcomed of course... I am banning the IP addresses used in the attack which is having a pretty good effect in stopping the attempts, but more IP addresses are easy to get...

ark_ader · « **Reply #32 on:** February 16, 2011, 02:45:05 pm »

Perhaps you should disable the avatar uploading facility just to be sure, and purge all avatars from the board.

You can have members email you their avatars later on. If it was my site, I would do this immediately.

RayB · « **Reply #33 on:** February 16, 2011, 03:32:49 pm »

So Driver-~~Man~~Boy is a 14 year old script-kiddie. That actually explains a lot.

pinballwizard79 · « **Reply #34 on:** February 16, 2011, 04:22:37 pm »

who are we talking about, ive been a good member I deserve to know

SavannahLion · « **Reply #35 on:** February 16, 2011, 04:30:30 pm »

Quote from: ark_ader on February 16, 2011, 02:45:05 pm

Perhaps you should disable the avatar uploading facility just to be sure, and purge all avatars from the board.

You can have members email you their avatars later on. If it was my site, I would do this immediately.

It's not, so we have little to worry about in that regards.

polaris · « **Reply #36 on:** February 16, 2011, 04:36:31 pm »

Quote from: leapinlew on February 16, 2011, 09:32:31 am

Thanks saint

I added a number 7 to my "123456" password to make it more secure.

hey we're password buddies, i never thought someone would pick the same as me, odds must be like 1 in a 100, maybe more.

ChadTower · « **Reply #37 on:** February 16, 2011, 04:37:59 pm »

Actually, this might just be Stingray trying to get in after a few beers.

Quote from: saint on February 16, 2011, 02:42:09 pm

The behavior looks a lot like a brute force attack. No one account is ever attempted more than once in a row, though repeated periodically. It's pretty much:

Try a username/password. Fail
Try another username/password. Fail
Try another username/password. Fail
.
.
.
Try the first username/password. Fail

Each from a different IP address with random time intervals between.

A 3 tries and you're locked won't really work in this attack due to the long time intervals and IP hopping, unless someone sees something I'm overlooking? Suggestions welcomed of course... I am banning the IP addresses used in the attack which is having a pretty good effect in stopping the attempts, but more IP addresses are easy to get...

hypernova · « **Reply #38 on:** February 16, 2011, 05:57:50 pm »

I've always been more of a "pound of cure" kind of guy myself, rather than the "ounce of prevention."

Because, hey, more is better. Duh!

Donkbaca · « **Reply #39 on:** February 16, 2011, 06:04:19 pm »

Just do what I do with passwords. Change it every week. Start of with -99bottlesofbeeronthewall


Main	Restorations	Software	Audio/Jukebox/MP3	Everything Else	Buy/Sell/Trade
Project Announcements	Monitor/Video	GroovyMAME	Merit/JVL Touchscreen	Meet Up	Retail Vendors
Driving & Racing	Woodworking	Software Support Forums	Consoles	Project Arcade	Reviews
Automated Projects	Artwork	Frontend Support Forums	Pinball	Forum Discussion	Old Boards
Raspberry Pi & Dev Board	controls.dat	Linux	Miscellaneous Arcade	Wiki Discussion	Old Archives
Lightguns	Arcade1Up	Try the site in https mode		Site News


Unread posts \| New Replies \| Recent posts \| Rules \| Chatroom \| Wiki \| File Repository \| RSS \| Submit news