Jump to content

Shit's Borked

RPM

By RPM
in Please do this better?

 Share

Recommended Posts

  • Replies 6.3k
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Popular Posts

immamac
immamac

Tornado hit data center. Sorry for downtime. Going to have more downtime to fix later Please report weird shit here but I'm with my family and mobile only. I just spent about an hour on a bench o

hookemATL
hookemATL

I had to draw porno. Wasn’t great but I finished

immamac
immamac

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest if you want to know what data could have possibly been leaked request here.  The passwords are encrypted at rest in

Posted Images

  • Popular Post
immamac

immamac 42841

Posted
  • Popular Post
Posted

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

  • Hook 'Em 22
  • Like 2
Link to comment
Share on other sites
Rimbo

Rimbo 25921

Posted
Posted
5 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

Any evidence/law enforcement contact on the attacker?

Link to comment
Share on other sites
C-Man

C-Man 27217

Posted
Posted
15 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

 

7 minutes ago, immamac said:

no, they weren't even seeking ransom or doing anything besides fucking with the site.

It was this guy wasn't it?

image.png.74f857b3fdee4461f8110d75506b995d.png

  • Like 2
  • Haha 5
Link to comment
Share on other sites
IDIOTsavant

IDIOTsavant 8483

Posted
Posted (edited)
25 minutes ago, Goredho said:

Yep, that's her.  Tits as googly as her eyes.

The fucked up thing is that I had to click the quoted post to figure out if you were talking about South Austin’s mom or Luicci.

Edited by IDIOTsavant
Sydney Carton impression
  • Like 2
  • Haha 5
Link to comment
Share on other sites
Captainant

Captainant 27656

Posted
Posted
41 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

Well that's a shitty way to have to spend an afternoon

  • Hook 'Em 1
Link to comment
Share on other sites
  • Popular Post
Burt Macklin

Burt Macklin 19021

Posted
  • Popular Post
Posted

The best part about Surly being down all afternoon is that managing partners of accounting and law firms all over Texas are going to be lying awake at night wondering why their billables had such a huge spike on a day where a massive chunk of the state had no power or electricity. 

  • Hook 'Em 8
  • Like 4
  • Haha 9
Link to comment
Share on other sites
Biff Tannen

Biff Tannen 45676

Posted
Posted
55 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

Dude let’s be honest. You could make up just about anything here and 95% of this board, myself included, would just nod along like, “yeah fine, I mean, whatever you gotta do, I don’t know what the hell is going on here.”

  • Hook 'Em 4
  • Like 1
  • Haha 3
Link to comment
Share on other sites
TOR

TOR 5548

Posted
Posted
2 minutes ago, markstanco said:


If you want to hack into texags, it’s easy.

URL: 192.168.19.39
Login: Administrator
Pass: Qwerty1234!

It was that guy, or maybe Notre Dame Dad.  Long grudge and shit.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing


Football ... Basketball ... Baseball ... Other Sports ... Futbol ... 🤫995🤫 ... Gambling ... Movies & TV ... Music ... Hobbies ... Lulz ... Food & Travel ... Daily Texan ... Business and Markets ... Cloak Room ... Help ... For Sale ... Board Discussion ... Subscribe!... Donate!... Advertise... COOKIE MONSTER!

×
×
  • Create New...