Jump to content

Shit's Borked


RPM

Recommended Posts

5 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

Any evidence/law enforcement contact on the attacker?

Link to comment
Share on other sites

15 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

 

7 minutes ago, immamac said:

no, they weren't even seeking ransom or doing anything besides fucking with the site.

It was this guy wasn't it?

image.png.74f857b3fdee4461f8110d75506b995d.png

  • Like 2
  • Haha 5
Link to comment
Share on other sites

Posted (edited)
25 minutes ago, Goredho said:

Yep, that's her.  Tits as googly as her eyes.

The fucked up thing is that I had to click the quoted post to figure out if you were talking about South Austin’s mom or Luicci.

Edited by IDIOTsavant
Sydney Carton impression
  • Like 2
  • Haha 5
Link to comment
Share on other sites

41 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

Well that's a shitty way to have to spend an afternoon

  • Hook 'Em 1
Link to comment
Share on other sites

55 minutes ago, immamac said:

https://www.surlyhorns.com/board/settings/account-security/#piiDataRequest

if you want to know what data could have possibly been leaked request here. 

The passwords are encrypted at rest in the database so there is no leaks there and there are no leaks related to any payment information that could have happened. 

The actor was not very sophisticated and mainly just fucked with the site - I have extensive audit logging on the database and query monitoring. There was no unusual database activity in the form of dumps or unusual queries leading up to the hijack and subsequent dropping of the database tables. 

An example of the data that could have been leaked is your IP addresses, your name, your email, and your birthdate and your address. Nothing else is available in unencrypted formats at rest in the database other than already public information such as posts etc. 

Again I have no reason to suspect there was a database dump and there was no access gained to the underlying server or direct access to the database (although the credentials were leveraged in a side vector attack using the php configuration).

I suspect this happened because of a leftover artifact from an upgrade some time ago and a brute force attack on spoofing admin credentials on a largely unused admin account. Both of those attack vectors have been addressed and I will be monitoring the situation closely. 

 

@Rimbo

 

Also there were 3 duplicate transactions for payments that I have already refunded, this was due to me testing the site before doing a point in time recovery to a safe point right before the attacker dropped the entire database. That coupled with closing any and all attack vectors that I suspected took the additional time from the first site bring up to the second site bring up. 

Dude let’s be honest. You could make up just about anything here and 95% of this board, myself included, would just nod along like, “yeah fine, I mean, whatever you gotta do, I don’t know what the hell is going on here.”

  • Hook 'Em 4
  • Like 1
  • Haha 3
Link to comment
Share on other sites

2 minutes ago, markstanco said:


If you want to hack into texags, it’s easy.

URL: 192.168.19.39
Login: Administrator
Pass: Qwerty1234!

It was that guy, or maybe Notre Dame Dad.  Long grudge and shit.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...