View Full Version : Wot happened! [Edit: Forum Hacked]
Anyone else get a 'strange' email supposedly from the Org?
I just received one - bit huffed about it really - a bit rude
i got one to and i really don't appreciate having the F word sent to me in an e-mail
Obviously it's NOT from the Org, so don't take it personally..
the .org has been hacked by grifter.org who ever they are,seems they have got everyones email address's
seems to me the org isnt very secure then?
NickInTheNorth
15-Jun-11, 18:55
I believe the site was hacked by some very nasty folks, don't think the org has turned nasty :)
I got one too. Looks like someone has hacked into the contact details for all the users. Whoever it was is clearly very pleased with themselves!
I got this, instead of the home page, when tried to get on about 15 mins ago. Malwarebytes stopped the threats.
I didn't get an email.
Advent Grifter.Org Goodrun shoutout to Grifter.Org & void us.
rockyrider
15-Jun-11, 18:58
me too ?????
Looks like the Org has been hacked, and they have a complete list of our email addresses. Wonderfull.
The ****jagex seem to be a hacker group, why they hit the Org I don't know. Prepare for spam.
lindsaymcc
15-Jun-11, 18:59
hubby and I both got the F worded email.
What concerns me more is that we can not register on here with the likes of hotmail accounts etc and have to use primary emails ( or used to be the case ) now we have I presume some one with our email addresses. If it was a hotmail account I use it would not fuss me, ditch it and start another simples.
Have recieved said email. Not pleased.
Niall Fernie
15-Jun-11, 19:07
Yes the forum was hacked.
Not sure what the intent was other than to redirect folks to their website and deliver their nice message.
I'd advise everyone to update their passwords and do a full virus and malware scan if you hit their website.
Everyone was e-mailed via the forum so I would think that they have not gone to the bother of trawling for addresses but they may have. Again make sure your anti virus is up to date.
Hundreds of people have already sent me an e-mail asking about why they got the e-mail from the forum. Hopefully they read this as it would be impossible to reply to them all. I also received the e-mail to my account and started investigating it then.
Hopefully there are no more traces of the hack and we can all go about our business but if anyone notices anything out of the ordinary, please do not hesitate to e-mail me on niall@caithness.org and I'll try to get as much done as I can in the morning.
Yes the forum was hacked.
Not sure what the intent was other than to redirect folks to their website and deliver their nice message.
I'd advise everyone to update their passwords and do a full virus and malware scan if you hit their website.
Everyone was e-mailed via the forum so I would think that they have not gone to the bother of trawling for addresses but they may have. Again make sure your anti virus is up to date.
Hundreds of people have already sent me an e-mail asking about why they got the e-mail from the forum. Hopefully they read this as it would be impossible to reply to them all. I also received the e-mail to my account and started investigating it then.
Hopefully there are no more traces of the hack and we can all go about our business but if anyone notices anything out of the ordinary, please do not hesitate to e-mail me on niall@caithness.org and I'll try to get as much done as I can in the morning.
Seriously Niall? You think and you hope?
I think you are being naive and I hope I am wrong.
torisdale
15-Jun-11, 19:20
Yes the forum was hacked.
Not sure what the intent was other than to redirect folks to their website and deliver their nice message.
I'd advise everyone to update their passwords and do a full virus and malware scan if you hit their website.
Everyone was e-mailed via the forum so I would think that they have not gone to the bother of trawling for addresses but they may have. Again make sure your anti virus is up to date.
Hundreds of people have already sent me an e-mail asking about why they got the e-mail from the forum. Hopefully they read this as it would be impossible to reply to them all. I also received the e-mail to my account and started investigating it then.
Hopefully there are no more traces of the hack and we can all go about our business but if anyone notices anything out of the ordinary, please do not hesitate to e-mail me on niall@caithness.org and I'll try to get as much done as I can in the morning.
See my personal message to you about a security patch for this version of vBulletin.
vBulletin admin panel has a built in email all users feature so it's more than likely the person/team did that other than access a database? also for members reassurance on passwords vBulletin has some sort of salt encryption that should keep you safe but never the less always better to be safe than sorry.
Niall Fernie
15-Jun-11, 19:21
So DocStone, what would you like me to tell you?
Unfortunately I am not a security expert but I do know where the problem arose and that has been dealt with. If you're not happy being told to update your antivirus and do a scan as a precautionary measure then what would you like to hear?
Hello guys, Yes I got a strange email which I cant repeat to the forums but if I was yous I would recommend changing your password which I will do just now. Why would anyone want to hack a community site I'll never know.
i got the email as well... but it went to my junk mail.. i tend to just ignore things like that in my email and delete them.
I would like a little bit more reasurrance that hoping and thinking. Even a simple "We are taking the forums and website offline for 24 hours to ensure no further damage was done whilst we contact our hosts and check admin logs, and also update the forum with the latest security patches."
Also, perhaps a simple "Sorry" and an explanation sent out using the same mass email system the hackers used?
Not having a go Niall, but to just go on hoping everything is OK doesnt seem right to me.
Is it not possible to find out just what the implications are of this from the hosts / ISP provider?
I.e. have our email & passwords been harvested or not?
Like many, having to use a primary email instead of a generic webmail account to register for the forum, this is potentially a tad more than a virus / malware issue.
Niall Fernie
15-Jun-11, 19:37
Doc, ok then you're right:
I'm taking the forum offline for the next 24 hours whilst we make sure all the latest patches are in place. I would check the admin logs but they were deleted by the hack.
We should be ready to go again late tomorrow afternoon.
Sorry for any inconvenience caused to our loyal users.
I got one of those emails too - which password do I change - comp/email/org? Yes, I'm thick! LOL
horsegirl
15-Jun-11, 23:54
I also got the email. Was not very amused. Glad my kids can not read !!
secrets in symmetry
16-Jun-11, 00:06
What concerns me more is that we can not register on here with the likes of hotmail accounts etc and have to use primary emails ( or used to be the case ) now we have I presume some one with our email addresses. If it was a hotmail account I use it would not fuss me, ditch it and start another simples.
Like many, having to use a primary email instead of a generic webmail account to register for the forum, this is potentially a tad more than a virus / malware issue.
You don't have to use a primary email address. Create MyOrg_Email@myISP.whatever (MyOrg_Email@MyISP.Whatev) and replace it whenever you like.
I like the updated forum. We can have discussions about AGW and CO2 with subscripts without having to remember how to do the cursed things.
Feeling a bit sheepish now as I also got one and promptly answered it, I am not great with PC's so i will have to get someone to help me with this situation......however i do wish the SICK **"$%^&8* the same in return onlyTEN FOLD.
NickInTheNorth
16-Jun-11, 09:03
To all that are complaining about what has happened and whingeing about having to use primary email addresses, demanding that Niall takes further actions etc, please just back off and take a moment to think things through.
YOUR computer security is YOUR issue. Not caithness.org 's responsibility. You can use whatever forums etc you want on the internet. There is a pretty good chance that at some time your security may be compromised at some point. That is your problem, not the administrators problem. Neither Niall, nor Bill, nor anyone else connected with caithness.org is responsible for what happened.
Just get over it and move on!
Thats right Nick, its no big deal and can happen to anyone anytime of the day or night. Its up to us to protect our own PC's.
Anyway, I checked my online banking and still have my £millions in my account so they didnt get to that!!! ....:eek:
Thanks Niall for sorting it so quickly.
C3......:roll:;)
Green_not_greed
16-Jun-11, 09:14
To all that are complaining about what has happened and whingeing about having to use primary email addresses, demanding that Niall takes further actions etc, please just back off and take a moment to think things through.
YOUR computer security is YOUR issue. Not caithness.org 's responsibility. You can use whatever forums etc you want on the internet. There is a pretty good chance that at some time your security may be compromised at some point. That is your problem, not the administrators problem. Neither Niall, nor Bill, nor anyone else connected with caithness.org is responsible for what happened.
Just get over it and move on!
Well said !
I too got the email. I guess all users did. Treat it like any other spam - block the address and delete the email. Change your password if you feel you need to. Then get back to normal business.....
GNG
To all that are complaining about what has happened and whingeing about having to use primary email addresses, demanding that Niall takes further actions etc, please just back off and take a moment to think things through.
YOUR computer security is YOUR issue. Not caithness.org 's responsibility. You can use whatever forums etc you want on the internet. There is a pretty good chance that at some time your security may be compromised at some point. That is your problem, not the administrators problem. Neither Niall, nor Bill, nor anyone else connected with caithness.org is responsible for what happened.
Just get over it and move on!
I think, most of us, are aware of this. That is why i posted, that Malwarebytes. Stopped the attacks on my laptop.
Better Out Than In
16-Jun-11, 09:26
"Thats right Nick, its no big deal and can happen to anyone anytime of the day or night. Its up to us to protect our own PC's.
Anyway, I checked my online banking and still have my £millions in my account so they didnt get to that!!! ....:eek:"
Perhaps it needs double checking. Send me the details and I will be happy to do that for you.
"Thats right Nick, its no big deal and can happen to anyone anytime of the day or night. Its up to us to protect our own PC's.
Anyway, I checked my online banking and still have my £millions in my account so they didnt get to that!!! ....:eek:"
Perhaps it needs double checking. Send me the details and I will be happy to do that for you.
Are you Nigerian ?
To all that are complaining about what has happened and whingeing about having to use primary email addresses, demanding that Niall takes further actions etc, please just back off and take a moment to think things through.
YOUR computer security is YOUR issue. Not caithness.org 's responsibility. You can use whatever forums etc you want on the internet. There is a pretty good chance that at some time your security may be compromised at some point. That is your problem, not the administrators problem. Neither Niall, nor Bill, nor anyone else connected with caithness.org is responsible for what happened.
Just get over it and move on!
Sorry NITN, but that is simply not true. The Org was hit by hackers that exploited a vulnerability in the Orgs security. This resulted in a mass email being sent out which in itself was harmless as it was intended only to show that Advent is "l33t haxxor", however the redirects which some people encountered were more serious. More serious than that was the fact that this character Advent had full access to the board database, including forum permissions, user reigstration and more importantly user emails. The Admin logs were deleted so they have no idea what was actually done when Advent had access and what settings were changed etc.
Unfortunately Niall and Bill as webmasters of this site are responsible for the security of the site and the safe keeping of our details. They may have got lucky and the only adverse effects will be the single mass email that was sent, and I hope they have been. However they may not, and it may be the next time you log onto the Org you get a redirect not to a hackers gloat page but something more disturbing. Also, they have hit the site once, chances are they will do it again to show that they can get around any security measures that they implemented.
Simple fact is the Org was hacked, not the users computers, and personally I would recommend the board be restored to the last back-up and hope that it isn't an old one. I may be over-reacting and no damage has been done and as you say we can just "get over and move on", but I would check and double check to make sure we can.
I have seen first hand what can be done to message boards that have been hacked, and this could have been a lot worse, hell we should be glad we still have a forum to discuss this on. I would also like to point out that I am not having a go at Niall or Bill with my posts, these things happen, maybe their security should have been tighter, maybe they had everything up to date and tighter than a Weeker at the bar, who knows, however it is how they react to it that counts, and personally I don't think some people realise just how serious this incident has been.
It's better to be safe than to be sorry.
This happening, has done me a favour. I have now disabled 3rd party cookies, and, enabled tracking protection.
I have also down loaded. SuperAntiSpyware, to run alongside. Malwarebytes and security software.
hey Niall,
dont let the slightly pee'ed off people here get to ya. you DO RUN A FREE SITE!! some of the biggist sites in the world fall to hackers... black hatters have a A LOT to answer for!!
NickInTheNorth
16-Jun-11, 11:01
DocStone - by connecting your computer to the internet you accept all the risks that go with it. No-one forces anyone to be on-line, no-one forces anyone to visit forums.
Yes Bill and Niall need to take reasonable care to update the software with security patches etc, which they do, after that you are on your own. Use it at your own risk - or don't use it.
they must of done a lot more than delete the admin logs i think they have a copy of all our email addresses
Thats right Nick, its no big deal and can happen to anyone anytime of the day or night. Its up to us to protect our own PC's.
Anyway, I checked my online banking and still have my £millions in my account so they didnt get to that!!! ....:eek:
Thanks Niall for sorting it so quickly.
C3......:roll:;) Aye your right Nick and like Corrie Have checked my pittance in the bank ha ha
I'm feeling quite left out; I didn't get an email!
Seriously though, hope the .org survives this hit without too much angst.
Lavenderblue2
16-Jun-11, 11:36
I also recieved two emails titled 'Owned' and containing the 'F' word in quick succession 18.16 & 18.17 hrs.
When I tried to log on to COMPLAIN my access was blocked by some obscure message or other... A very bad show... :mad:
I didn`t receive any nasty mail, but suspect that as I use yahoo and only set up a bt mail to join the org it has probably expired. I did try to log into bt today but my avg/malwarebites suggested not to as it was an unsafe site!
DocStone - by connecting your computer to the internet you accept all the risks that go with it. No-one forces anyone to be on-line, no-one forces anyone to visit forums.
Yes Bill and Niall need to take reasonable care to update the software with security patches etc, which they do, after that you are on your own. Use it at your own risk - or don't use it.
Agree with your first point 100% NITN, the internet is a big bad place.
Regards your second point, this site stores personal information and the webmasters have a responsibility to ensure that it is kept safe, however I agree - we are not forced to use it and we should be aware of the possible dangers when we do.
My main concern however is the security of the board. The amount of damage that can be done to a message board if a hacker gets a few minutes with admin rights is frightening, something I am obviously failing to get across in my posts. I do not want to see the Org become compromised as it is a valuable resource for the people that use it, and the "forget it and move on" or "hope things are OK" attitude does not help prevent this. When your site is hacked you suspect the worst, and you act accordingly. You restore the site from the most recent offsite back-up, OK, you may lose a day to a weeks worth of post but you ensure that any changes that may have been made are negated. You check for the last few new members and deactivate them, you reset the permissions for all user groups, you do everything you can to ensure you have the board safe.
Again, I have seen what can happen to a board when the worst happens, and I do not want that happening to the Org. In some cases it pays to be paranoid, and this in my opinion is one of them.
Niall Fernie
16-Jun-11, 14:36
So really what you are saying is we should tell you in great detail exactly what we have done since the hack. We should tell you and the world (and the hacker) what we did to prevent it happening again. We should inform everyone of how we traced what had happened and the great amount of time we spend doing it. You would want us to restore a backup of a database that contained security flaws and a path of re-entry without a single care as to when and how the original entry took place. You assume it happened yesterday and that nothing before that time would have mattered.
This is a forum. Its not a national security website. It contains flaws as does all software on the web. Who is to say that the holes that we patched are even the holes that were used to gain access. For all we know and for all you and the world knows, this particular hacker has found a way into sites that has not been fixed and is quite happily sitting on his backdoor, not making it public so that a fix can be created in order that it can be used again.
If you really feel the need to go on about security, tell us the flawless method by which you protect your own personal data. Have you used the same password on here as you have on any other site on the internet. Do you use the same username, same e-mail address etc etc I could go on.
If you choose to think that we have not done everything in our power to fix the situation and prevent what has happened from happening again (until another flaw in the forum software is found) then I would suggest that you simply stop using the site. I will (very) happily remove any of your personal details from the site in case we are hacked again.
The forum itself was used to send the spam e-mails and at this time we have no reason to believe that the aim of the hack was to do other than what we all witnessed. (and do it again and again if we did not take action).
The actions of the hacker at the very least pointed out that we had become slack in maintaining the forum's software to the maximum level available to us and for that we should probably be thankful. As has been pointed out things could have been much worse.
The last 24 hours have been very trying especially as I had to devote 9 odd hours to my real life from that time. So without giving a blow by blow account of the last day, I for one would like to feel satisfied that all we are able to do has been done and that at least for now we can move on and get back to business as usual (albeit with the knowledge that we have to be more careful in the future).
Niall, nowhere did I say you had to tell me or the world what you have or haven't done. I understand you are frustrated and angry at what happened but I am only trying to help. Sorry if taken the wrong way.
Niall Fernie
16-Jun-11, 14:59
Frustrated, angry and very, very tired. I'm sure a couple of hours kip will brighten my day.
You have a PM , and again, sorry if I came across all "blamey" ;)
If a Competent hacker wants to hack your system your doomed , i dont care what kind of security software you have, if he is good he will find a way in, it may take him a while but he will get in,, their aint a day that goes by, that we dont here of some government or corporation getting hacked , give niall a break it aint his fault some blackhat or script kiddie has nothing better to do with his skills than hack a community public forum,, shocking stuff.
cameroncara
16-Jun-11, 15:50
Yes same here.
Latet news lady in watten faints after receiving four letter word in email, paramedics revived her by waving a bottle of Glenmorangie under her nose.
Will our PMs be appearing on the Wickerleaks website?
Latet news lady in watten faints after receiving four letter word in email, paramedics revived her by waving a bottle of Glenmorangie under her nose.
Will our PMs be appearing on the Wickerleaks website?
It was just a conspiracy Fred, it never really happened, I never got one of the alleged e-mails, ergo it never happened
Latest news lady in watten faints after receiving four letter word in email, paramedics revived her by waving a bottle of Glenmorangie under her nose.
Heh yeah that's what I found most funny about this thread. That people are offended by a word not the sentiment behind the word but the word. Relevant (http://www.youtube.com/watch?v=s_osQvkeNRM).
Mystical Potato Head
16-Jun-11, 19:29
Heh yeah that's what I found most funny about this thread. That people are offended by a word not the sentiment behind the word but the word. Relevant (http://www.youtube.com/watch?v=s_osQvkeNRM).
Yes,and Billy Connolly found it funny too in his song"A four letter word".
" It shouldn't be said in polite company
When aged old ladies are drinking their tea
But if those ladies' pasts were revealed, sure as hell
They've not only said it, they've done it as well"
Well I'm pleased to report that I, thankfully, never received said e-mail. I can imagine that it would be very disconcerting for Org members to receive such a disgusting e-mail without warrant.
My OH (a survey engineer) is versed up on all those "scanning sites" etc. (does it show that I have no clue at all about technology, LOL ;) ?!) so that may be the reason why I didn't receive it !!
changilass
16-Jun-11, 20:42
It was an email that contained nothing worse that what some folks have posted on the forums in the past. The email in itself, aint the worry, its the scumbags behind it.
Latet news lady in watten faints after receiving four letter word in email, paramedics revived her by waving a bottle of Glenmorangie under her nose.
Will our PMs be appearing on the Wickerleaks website?
Hi there Fred......
Didn't know you were back....Dropped by your road a couple of weeks ago but missed you. Talked to your Neighbour with the croftie at the bottom o' e' road an e sheep...my Cousin.
How u be? s
Hi there Fred......
Didn't know you were back....Dropped by your road a couple of weeks ago but missed you. Talked to your Neighbour with the croftie at the bottom o' e' road an e sheep...my Cousin.
How u be? s
Hi Sandy I'm not back, just looked in because I got the email.
hi i got nasty email also
TrulyRural
16-Jun-11, 22:01
I tell you what we want to hear Mr Fernie, perhaps an apology to all those people who have had their emails hacked on YOUR WEBSITE!
I tell you what we want to hear Mr Fernie, perhaps an apology to all those people who have had their emails hacked on YOUR WEBSITE!
Be careful of the use of the word "WE".......You can speak for yourself but dont include me in your silly demands.
C3.....:mad:[evil]
changilass
16-Jun-11, 22:07
I tell you what we want to hear Mr Fernie, perhaps an apology to all those people who have had their emails hacked on YOUR WEBSITE!
see post #25, he already did, you would have known had you taken the trouble to read the thread instead of just jumping in feet first.
TrulyRural
16-Jun-11, 22:18
Yeah didn't read the bit where he apologised.........perhaps it should have been done at the start of the thread. As for the 'we' corrie 3, I was referring to those of us who see this security issue as the sole responsibility of the org itself
As for the 'we' corrie 3, I was referring to those of us who see this security issue as the sole responsibility of the org itself
Perhaps you should have made that clear at the start of your post instead of making yourself out to be the Members spokesperson.
C3.....:roll:[disgust]
Oh well this looks like this thread is going downhill fast - things have been fully explained..
Powered by vBulletin® Copyright © 2024 vBulletin Solutions, Inc. All rights reserved.