Author Topic: ---WARNING--- - password hacking attempt on many accounts -- UPDATE -- (Read 22029 times)

Edgedamage · « **Reply #40 on:** February 16, 2011, 06:09:28 pm »

I will miss my old one:
C U Next Tuesday

wp34 · « **Reply #41 on:** February 16, 2011, 06:36:16 pm »

Quote from: Edgedamage on February 16, 2011, 06:09:28 pm

I will miss my old one:
C U Next Tuesday

Shouldn't it be See You Next Wednesday?

http://en.wikipedia.org/wiki/See_You_Next_Wednesday

missioncontrol · « **Reply #42 on:** February 16, 2011, 06:43:55 pm »

Quote from: wp34 on February 16, 2011, 06:36:16 pm

Quote from: Edgedamage on February 16, 2011, 06:09:28 pm
I will miss my old one:
C U Next Tuesday

Shouldn't it be See You Next Wednesday?

oh great, now you told everyone his new one...

DaOld Man · « **Reply #43 on:** February 16, 2011, 07:29:40 pm »

Ive changed mine to a language that you would have to rip out your tongue to say it correctly.
But translated to English it is "drowssap"
Ingenious!

RayB · « **Reply #44 on:** February 16, 2011, 07:35:36 pm »

mine requires 4 digit ALT codes to enter. Takes me 10 minutes to log in.

Donkbaca · « **Reply #45 on:** February 16, 2011, 07:39:39 pm »

That's because you are an arcade dork Ray

Donkbaca · « **Reply #46 on:** February 16, 2011, 07:40:38 pm »

double post!

NipRing · « **Reply #47 on:** February 16, 2011, 07:41:15 pm »

I just got this email, dont know if its legit, i didnt click on any link, but i did goto byoac via my normal bookmark and changed my passord.
"Dear NipRing,

This mail was sent because the 'forgot password' function has been applied to your account. To set a new password click the following link:

IP: 76.10.222.100

Username: NipRing

Regards,
The Build Your Own Arcade Controls Forum Team."

SammyWI · « **Reply #48 on:** February 16, 2011, 07:43:02 pm »

Just got the same thing myself. Our script kiddie is still going.

upprc04 · « **Reply #49 on:** February 16, 2011, 07:43:56 pm »

I got that too. Instead of trying to hack peoples account he is just trying to reset the passwords I guess.

Same IP: 76.10.222.100

NipRing · « **Reply #50 on:** February 16, 2011, 07:46:48 pm »

Why is this person even bothering, what is there to gain?

bitbytebit · « **Reply #51 on:** February 16, 2011, 07:47:26 pm »

I just got the same email, same IP address being used. So they are for some reason doing the forgot password thing for peoples accounts now, guessing they aren't going to exactly get anywhere doing that, hopefully. It is strange they are trying that, hopefully they haven't got some sneaky loophole, I really don't see what the purpose would be otherwise.

wp34 · « **Reply #52 on:** February 16, 2011, 07:50:30 pm »

I got one as well.

CheffoJeffo · « **Reply #53 on:** February 16, 2011, 07:56:48 pm »

Me three.

SavannahLion · « **Reply #54 on:** February 16, 2011, 08:18:45 pm »

Reporting in that I too got the email attempt. Obvious attack vector on that one. Might I suggest that Saint temporarily disables the password recovery module/code and switch to a manual request system? Or maybe use a capta? At least for the time being.

missioncontrol · « **Reply #55 on:** February 16, 2011, 08:24:03 pm »

me too:

Quote

Dear missioncontrol,

This mail was sent because the 'forgot password' function has been applied to your account. To set a new password click the following link:

IP: 76.10.222.100

Username: missioncontrol

Regards,
The Build Your Own Arcade Controls Forum Team.

Hoopz · « **Reply #56 on:** February 16, 2011, 08:33:46 pm »

Yep, I received it also. He's picking people that haven't previously been involved in his threads which may mean that it isn't dipshit after all.

NIVO · « **Reply #57 on:** February 16, 2011, 08:36:50 pm »

Quote from: ChadTower on February 16, 2011, 04:37:59 pm

Actually, this might just be Stingray trying to get in after a few beers.

Quote from: saint on February 16, 2011, 02:42:09 pm

The behavior looks a lot like a brute force attack. No one account is ever attempted more than once in a row, though repeated periodically. It's pretty much:

Try a username/password. Fail
Try another username/password. Fail
Try another username/password. Fail
.
.
.
Try the first username/password. Fail

Each from a different IP address with random time intervals between.

A 3 tries and you're locked won't really work in this attack due to the long time intervals and IP hopping, unless someone sees something I'm overlooking? Suggestions welcomed of course... I am banning the IP addresses used in the attack which is having a pretty good effect in stopping the attempts, but more IP addresses are easy to get...

nah. He would have mistaken you for a zombie and shot his way in by now.

DaOld Man · « **Reply #58 on:** February 16, 2011, 08:37:57 pm »

I got same thing AFTER I changed my password.
I thought it may be just part of the password change routine, but didnt click on it just in case.

Ok dude (You know who you are D-Man), if you are still able to read our posts, please, GET A LIFE!

SavannahLion · « **Reply #59 on:** February 16, 2011, 08:39:40 pm »

Quote from: Hoopz on February 16, 2011, 08:33:46 pm

Yep, I received it also. He's picking people that haven't previously been involved in his threads which may mean that it isn't dipshit after all.

It really doesn't matter. That list is short so he's probably just going down a list of names. He doesn't care as long as he does some damage.

missioncontrol · « **Reply #60 on:** February 16, 2011, 08:40:36 pm »

Jokes on him, not only did I change my password, I then changed it back just to mess with him

saint · « **Reply #61 on:** February 16, 2011, 09:32:53 pm »

Quote from: SavannahLion on February 16, 2011, 08:18:45 pm

Reporting in that I too got the email attempt. Obvious attack vector on that one. Might I suggest that Saint temporarily disables the password recovery module/code and switch to a manual request system? Or maybe use a capta? At least for the time being.

Good suggestion - implemented.

saint · « **Reply #62 on:** February 18, 2011, 08:10:30 am »

The password hacking attack does not appear to be related to any other issue at BYOAC. There is a mass-attack against SMF forums (and others, such as PHPboard) in general. More info here: http://www.simplemachines.org/community/index.php?topic=421603.msg2949285#msg2949285. The attacks against BYOAC match this pattern exactly. I do not believe Driver-Man is related to this at all.

I am taking various measures against the attacks. There have not been any successful attacks that I am aware of anywhere. I now consider this a low threat level. Make sure you have a good, non-dictionary based password and beyond that I would not worry about it.

I will note if anything changes in this arena.

--- saint

WhereEaglesDare · « **Reply #63 on:** February 18, 2011, 11:20:38 am »

Quote from: HarumaN on February 16, 2011, 09:13:25 am

Here's a dumb question, say he was able to hack a mod's account... would that give him access to the forum user's passwords? Or is that encrypted somewhere (I hope).

Mods dont have access to PWs on SMF, they can reset them though.

twisty · « **Reply #64 on:** February 18, 2011, 01:21:58 pm »

He was doing the mass password recovery routine at MW concurrent with it happening here. This was 100% confirmed as being him by matching IP's. (And we don't use SMF either.)

Just thought you should know that.

newmanfamilyvlogs · « **Reply #65 on:** February 18, 2011, 01:29:47 pm »

Please forward relevant logs:

From: spaterson@woosh.com
CC: abuse@woosh.com

Quote

Hello,

That IP address (203.211.81.166) is part of a dynamically allocated range.

In order to unambiguously identify the user, we require require logs
(httpd, mail, etc), with timestamps.

We will also need need copies of any unacceptable content (eg, in this
case a sample of the unsolicited emails with headers).

We require this in order to highlight any specific breaches of our Terms
and Conditions to the end user, and for our records.

Regards,
Simon Paterson
Woosh Wireless Limited

twisty · « **Reply #66 on:** February 18, 2011, 01:48:31 pm »

Quote from: cotmm68030 on February 18, 2011, 01:29:47 pm

Please forward relevant logs:

Time to go fishing in my raw access logs and forward the requested info.

saint · « **Reply #67 on:** February 18, 2011, 01:53:56 pm »

Quote from: twisty on February 18, 2011, 01:21:58 pm

He was doing the mass password recovery routine at MW concurrent with it happening here. This was 100% confirmed as being him by matching IP's. (And we don't use SMF either.)

Just thought you should know that.

Well heck, then I don't know. I matched 1 IP which I assumed was due to using the same proxy service... I'll go dig through my logs again.

Dexter · « **Reply #68 on:** February 18, 2011, 02:07:10 pm »

LOL!!!!!

Saint,

over on that alt.games.mame thread you linked to, a user with no previous posts , no profile and iffy e-mail address just posted about how great drivermans 720 driver is.....

twisty · « **Reply #69 on:** February 18, 2011, 02:43:32 pm »

Quote from: Dexter on February 18, 2011, 02:07:10 pm

LOL!!!!!

Saint,

over on that alt.games.mame thread you linked to, a user with no previous posts , no profile and iffy e-mail address just posted about how great drivermans 720 driver is.....

Hmm...I don't think it's a good idea to give the ---tallywhacker--- free advertising. At the very least it's going to annoy the AGM regs there.

twisty · « **Reply #70 on:** February 18, 2011, 02:47:41 pm »

Quote from: saint on February 18, 2011, 01:53:56 pm

Well heck, then I don't know. I matched 1 IP which I assumed was due to using the same proxy service... I'll go dig through my logs again.

Oh, it's definitely him. Prior to that it was the PM flooding.

I've since made script changes to shut it all down. And now I am working diligently to shut him down.

saint · « **Reply #71 on:** February 18, 2011, 03:02:03 pm »

Quote from: twisty on February 18, 2011, 02:43:32 pm

Quote from: Dexter on February 18, 2011, 02:07:10 pm
LOL!!!!!

Saint,

over on that alt.games.mame thread you linked to, a user with no previous posts , no profile and iffy e-mail address just posted about how great drivermans 720 driver is.....

Hmm...I don't think it's a good idea to give the ---tallywhacker--- free advertising. At the very least it's going to annoy the AGM regs there.

Twisty's putting me to shame today

I did not think that through.

CheffoJeffo · « **Reply #72 on:** February 18, 2011, 03:19:04 pm »

Quote from: saint on February 18, 2011, 03:02:03 pm

Quote from: twisty on February 18, 2011, 02:43:32 pm
Quote from: Dexter on February 18, 2011, 02:07:10 pm
LOL!!!!!

Saint,

over on that alt.games.mame thread you linked to, a user with no previous posts , no profile and iffy e-mail address just posted about how great drivermans 720 driver is.....

Hmm...I don't think it's a good idea to give the ---tallywhacker--- free advertising. At the very least it's going to annoy the AGM regs there.

Twisty's putting me to shame today I did not think that through.

The folks at AGM were annoyed with him long before you mentioned his thread (and there are 5 or six at last count).

To their credit, they have handled him better than anybody else has so far.

twisty · « **Reply #73 on:** February 18, 2011, 03:41:38 pm »

Quote from: saint on February 18, 2011, 03:02:03 pm

Twisty's putting me to shame today I did not think that through.

No shame intended, it was only a suggestion

Gatt · « **Reply #74 on:** February 18, 2011, 08:11:25 pm »

Sorry guys, I've been lurking on this, but I have a new favorite gem. In reading through the posts someone linked above, I found this gem from abaraba...

Quote

you should realize that there is hardly many people in the world with such a unique knowledge as mine, i could practically make the whole Google Earth myself, which i did of course, and render their whole stupid team useless as they are..

From the top-secret link.

I'm sure he's hoarding is super-secret Google Earth code too because Google will delete his code behind closed doors too. I'm guessing it runs on the satelite system he built and launched too, probably using the matter-antimatter drives he's powering from his home-built far superior collider.

yotsuya · « **Reply #75 on:** February 18, 2011, 08:29:29 pm »

You know what's even better? One of the links he provided was to his YouTube account, and according to that, he's 39 years old.

emphatic · « **Reply #76 on:** February 19, 2011, 04:46:24 pm »

I got a mass e-mail from this shady, disgruntled emu-dev tonight. I'm betting some more folks here will too.

yotsuya · « **Reply #77 on:** February 19, 2011, 05:06:18 pm »

I got one too.

ark_ader · « **Reply #78 on:** February 19, 2011, 06:47:03 pm »

I emailed the company from where the IP address came from, and now they want the logs for the attack.

If you want to contribute Saint, I'll forward the email address to you. Let me know.

Ken Layton · « **Reply #79 on:** February 19, 2011, 11:49:04 pm »

Quote from: emphatic on February 19, 2011, 04:46:24 pm

I got a mass e-mail from this shady, disgruntled emu-dev tonight. I'm betting some more folks here will too.

So did I.


Main	Restorations	Software	Audio/Jukebox/MP3	Everything Else	Buy/Sell/Trade
Project Announcements	Monitor/Video	GroovyMAME	Merit/JVL Touchscreen	Meet Up	Retail Vendors
Driving & Racing	Woodworking	Software Support Forums	Consoles	Project Arcade	Reviews
Automated Projects	Artwork	Frontend Support Forums	Pinball	Forum Discussion	Old Boards
Raspberry Pi & Dev Board	controls.dat	Linux	Miscellaneous Arcade	Wiki Discussion	Old Archives
Lightguns	Arcade1Up	Try the site in https mode		Site News


Unread posts \| New Replies \| Recent posts \| Rules \| Chatroom \| Wiki \| File Repository \| RSS \| Submit news

Author Topic: ---WARNING--- - password hacking attempt on many accounts -- UPDATE -- (Read 22029 times)

bitbytebit