Sciencemadness Discussion Board - The Forum Has Been Hacked

The Forum Has Been Hacked

Pages: 1 2

Texium - 11-8-2014 at 22:16

Just now, in a thread in beginnings, HeYBrO noticed that some members' locations mysteriously changed to "/root/." Here is a list of affected members:
bobm4360
elementcollector1
Oscilllator
Manifest
Tdep
DubaiAmateurRocketry
Mr_Magnesium
TheChemiKid
gdflp
HeYBrO
numos
careysub

No idea why this happened, could just be the effect of some routine software tweaking, but I thought it would be good to let everybody know just in case it's caused by someone or something malicious.

EDIT: We now know that the forum has definitely been hacked. If any of your account information has been changed, change your password before your account becomes compromised.

[Edited on 8-12-2014 by zts16]

Texium - 11-8-2014 at 22:29

Just noticed that all of their birthdays have changed to 1-1-1980

Also, now we know that Mr_Magnesium has been taken over by someone else, as he's posting crap about acetone peroxide with horrible grammar which doesn't seem like him: https://www.sciencemadness.org/whisper/viewthread.php?tid=32... and he was one of the ones affected. Both happened around the same time, so it may possible be related, although it could be a coincidence.

[Edited on 8-12-2014 by zts16]

Manifest - 11-8-2014 at 22:32

Good work Columbo.

[Edited on 12-8-2014 by Manifest]

Texium - 11-8-2014 at 22:34

Look man, I know it's probably nothing. I just wanted to point it out, just in case.

Manifest - 11-8-2014 at 22:36

I'm just joking, you need to take me less seriously.

Texium - 11-8-2014 at 22:42

Sorry Manifest, but it's rather hard to detect joking and sarcasm on a forum, particularly since it's late at night for me right now and I should probably be going to sleep.

Manifest - 11-8-2014 at 22:45

His posts are being deleted...

Texium - 11-8-2014 at 22:48

Err, yeah... His recent posts seemed to have disappeared. The older ones are still there. But at the same time, it makes me wonder, since the list hasn't changed other than for his two accounts, so it looks a bit like he's actually just pretending to be hacked...

Manifest - 11-8-2014 at 22:49

No, he made a post on his alternate account saying Brain Force was compromised.

Texium - 11-8-2014 at 22:52

Yes, and that one also appeared with the /root/ and the post disappeared, but since earlier when I posted the list of affected usernames, the only two that were added were his two accounts, making it seem like he might have done it himself just to screw with us.

Manifest - 11-8-2014 at 23:00

Polverone is online now, hopefully he'll give us an explanation, this is scaring me

Tdep - 11-8-2014 at 23:01

Woah, I just got older!

Hope he hasn't changed every record, I don't want to be suddenly 30!

Polverone - 12-8-2014 at 01:08

I don't think this is as dire as I originally believed. Affected user accounts, as listed in the first message in this thread, have been frozen for now (email addresses altered and passwords disabled). More information to follow.

APO - 12-8-2014 at 01:59

Hey, some members things where it says "Location: /root/" are just disappearing. I'm scared now. I think you should freeze all password and email address changes for awhile except for those who need a reset.

[Edited on 12-8-2014 by APO]

legitaccountdontdelete - 12-8-2014 at 02:24

Polverone what do you think it is?

Polverone - 12-8-2014 at 03:03

Yes, all the users with '/root/' as their location have been compromised -- perhaps a few others. A rootkit scan on the server didn't show anything, ssh access logs didn't show anything, and there were no new script files installed. Further, if an attacker really did have root access, why bother with non-moderator accounts? Why tip your hand when you could just access the database directly and bypass all forum passwords? The most likely explanation seems to be that the attacker doesn't really have root access but just guessed weak passwords on some ordinary user accounts.

Examination of the the forum logs and web server logs did reveal an interesting connection.

A bunch of server access was referred from http://5.175.164.221 (I have delayed posting until I could locally archive what was there). In case that site is offline by the time you read this, it contains/contained a melange of pictures and videos of homemade pyrotechnics, lists of common passwords, and scripts for hacking.

By cross-referencing the server access logs and the IP addresses on user posts, I can tell that the following accounts used IP addresses at least once that were also used by the mysterious person(s) referred-by-5.175.164.221:

Bert
bobm4360
Burner
careysub
Crypto
DubaiAmateurRocketry
Eisenstein
elementcollector1
gdflp
Leetage
leu
Magpie
Mailinmypocket
Manifest
Mercedesbenzene
mnick12
Mr_Magnesium
numos
Oscilllator
Praxichys
Pyro
Pyrocystis Lunula
S.C. Wack
Tdep
TheChemiKid
woelen
Xenoid

This includes a number of accounts that were already reported as compromised but also some that weren't. What do the members on this list have in common? Use of public proxies? If your name is on this list and your account isn't already frozen, I suggest changing your password and making it strong.

For the technically inclined, here's a line from a web server log file that shows what I am talking about :

Code:

::1:80 66.87.66.61 - - [12/Aug/2014:00:11:07 -0700] "GET /talk/misc.php?action=login HTTP/1.1" 200 3429 "http://5.175.164.221/https.html" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; SPH-L710 Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30"

I cross-matched the IP address 66.87.66.61 with a prior posting from a registered member. I scripted the cross-referencing for all unique IP addresses that showed up with a 5.175.164.221 referrer.

At this point I'm guessing that the attack came from a juvenile member or members of our own forum here.

In order to begin unfreezing compromised user accounts I am going to need to restore a database backup locally, to find what email addresses were before the attacker reset them, then I will make contact with the affected members via email to get their access restored. I am also going to interview a couple of affected members about their passwords before I actually begin unfreezing, to make sure they really were relatively easy to guess. If affected accounts had passwords like 2Qc..6f0eb1a913a4adP338, I'm going to have to reconsider my password-guessing assumption.

APO - 12-8-2014 at 03:52

Just an idea, freeze the accounts of anyone who registered today and disable new member registering until we/you figure out the problem.

Texium - 12-8-2014 at 06:48

Well then, it does appear that I was right about Brain&Force faking being hacked, as neither of his accounts are on that list of people who really were.

Texium - 12-8-2014 at 08:53

Sorry, Brain&Force... I saw your tweets. It just seemed to me at first like the timing was a bit too perfect, and you weren't on Polverone's list.
Oh, and also, did the weird acetone peroxide thread where the issue was first noticed get deleted, or did it just "mysteriously disappear?"

Texium - 12-8-2014 at 09:14

DJF90's location changed to /dev/null and birthday to 1-1-1980
Also, Kapitan's location is /dev/urandom but birthday is none.

[Edited on 8-12-2014 by zts16]

plante1999 - 12-8-2014 at 09:24

I am compromised, please block my account

The Volatile Chemist - 12-8-2014 at 09:50

So I talked to B&F, and he said his password had upper and lowercase, numbers, etc. It's my theory this is just brute force of members someone hates.

The Volatile Chemist - 12-8-2014 at 09:54

Quote: Originally posted by plante1999

I am compromised, please block my account

Oh no! Some of the best members are compromised! Wait, does anyone know when they first saw the /root/ thing? I could have sworn seeing it 3 months ago (In someone's location) and thinking it was some form of a linux user's joke. They could have been waiting a while to amass a bunch of accounts to do something.
but lol to legitaccountdontdelete's account location. I wonder if he's the hacker

Check his IP Prov.

careysub now has the slashroot for her (or his) location, I noticed she had been visited by the 5. guy in the past. Of course Töilet Plünger's down too.
And Zyklon-A has the best location...

On a side note, this is possibly a would be spamming accnt. : http://www.sciencemadness.org/talk/member.php?action=viewpro...

[Edited on 8-12-2014 by The Volatile Chemist]

[Edited on 8-12-2014 by The Volatile Chemist]

[Edited on 8-12-2014 by The Volatile Chemist]

[Edited on 8-12-2014 by The Volatile Chemist]

[Edited on 8-12-2014 by The Volatile Chemist]

Texium - 12-8-2014 at 10:06

Last night was the first time I saw it, in the acetone peroxide thread that no longer exists. HeYBrO originally pointed out the /root/ thing. Then we realized that Mr_Magnesium, who started the thread, normally doesn't post crap like that, which led us to believe that the /root/ accounts were hacked. Curiously, every member who posted in that thread except for me and arkoma were compromised, although there are plenty of others that are too that didn't post there.

Zyklon-A - 12-8-2014 at 10:12

Weird. I haven't been online in a few days (except yesterday) and didn't see that topic.
This sucks, was Mr_Magnesium the first to be compromised?
I think I remember seeing the "/root/" thing some months ago too, although I can't be sure.

Texium - 12-8-2014 at 10:23

I'm not sure who was first, but maybe Polverone will find out since he's been looking through the archives and stuff.

Zyklon-A - 12-8-2014 at 10:33

I noticed, all of the accounts that have been compromised (in the top ten pages of members, by post count) do not have real words for usernames - especially with numbers and strange letter sequences.
Manifest is an exception, but I'm pretty sure he put /root/ as his location himself.

Texium - 12-8-2014 at 10:37

I think that that's probably a coincidence. And I don't think that Manifest faked it. His was already like that before we knew what was going on. I had reason to believe that B&F did, because it happened later and right after he posted something about how we might be dealing with an experienced hacker, and then the same thing happened to his Töilet Plünger account when he posted to say that Brain&Force was compromised. It looked a bit sketchy to me, but it seems like he was being serious.

arkoma - 12-8-2014 at 11:04

Well I may owe Mr_Magnesium an apology if that wasn't really him. Only he knows.

I DID just CHANGE my password.

@Polverone---thank you AGAIN for your tireless, mostly thankless, time consuming effort in keeping Sciencemadness.org the PREMIER home science spot on the web.

S.C. Wack - 12-8-2014 at 11:16

> What do the members on this list have in common?

Presumably past usage of a common exit node, not necessarily a scanning one at all.

Loptr - 12-8-2014 at 11:17

I would say that it is time that the SM forum required SSL to access it, instead of giving the option for either HTTP or HTTPS.

Everyone uses the HTTPS address, right?

You might want to because of this very reason.

Zyklon-A - 12-8-2014 at 11:19

All compromised members registered in between 2011 and 2014.
Also they all were active on 11-8-14.
None of this is new information though.

Texium - 12-8-2014 at 11:23

Quote: Originally posted by Zyklon-A

All compromised members registered in between 2011 and 2014.
Also they all were active on 11-8-14.
None of this is new information though.

If you look at my list, yes, but if you look at Polverone's list there were plenty of members who registered before 2011 who were compromised.
What I'm curious about is why DJF90's location says /dev/null. That happened more recently than the others.

[Edited on 8-12-2014 by zts16]

Polverone - 12-8-2014 at 11:56

Here is my updated list of assumed-compromised users, whose accounts have been frozen:

Code:


+----------------------+
| username             |
+----------------------+
| acetone              |
| bamboula             |
| BMN_1                |
| bobm4360             |
| Brain&amp;Force      |
| Ddan                 |
| DJF90                |
| DubaiAmateurRocketry |
| elementcollector1    |
| freedompyro          |
| gdflp                |
| GreyCatFin           |
| HeYBrO               |
| Manifest             |
| Mr_Magnesium         |
| numos                |
| Oscilllator          |
| plante1999           |
| SweetHomeSunscreen   |
| Tdep                 |
| TheChemiKid          |
| Töilet Plünger       |
| zebilol              |
+----------------------+

I have reactivated careysub's account with a strong password, since I was already in email contact with him at the time of the breech. His account did have a weak password. It will take me some time to work on reactivating other accounts because I have to attend to my day job for a few hours.

DrAldehyde - 12-8-2014 at 12:00

Quote: Originally posted by Loptr

I would say that it is time that the SM forum required SSL to access it, instead of giving the option for either HTTP or HTTPS.

Everyone uses the HTTPS address, right?

You might want to because of this very reason.

Actually, I don't use the HTTPS site, I have always gotten a site security certificate error loading the https site.

Screenshot_2014-08-12-13-00-05.png - 204kB

arkoma - 12-8-2014 at 12:04

speaking of HTTPS, I always get an "invalid security certificate" message. Use the HTTPS anyway, but do any y'all know how to tell chromium to accept it?

I run Mint17 Qiana

prof_genius - 12-8-2014 at 12:06

Happens to me too, but I have now started using HTTPS.

[Edited on 12-8-2014 by prof_genius]

gdflp2 - 12-8-2014 at 12:12

Polverone, just out of curiosity, how are you planning to contact the people who have had their accounts hacked? Thanks for all you do for this forum, it wouldn't be the same without you.

gdflp2 - 12-8-2014 at 12:16

Hmmm it seems that all of the hacked accounts have had their signatures erased as well.

Texium - 12-8-2014 at 12:40

Quote: Originally posted by gdflp2

Hmmm it seems that all of the hacked accounts have had their signatures erased as well.

Yeah, I noticed that too. And I also got a security error the first time I went to the HTTPS site, but I ignored it and told Firefox to trust it, and it's never given me any problems.

use the https site - ignore the message

quantime - 12-8-2014 at 12:56

That message is just a stupid message that says the certificate is not tied back to an authority. In reality all certificates on the net that are tied back to an authority are immediately insecure. That is what a certificate authority is. A certificate authority is suppose to lend credibility to a certificate. A certificate authority is suppose to tell your browser that a certificate is safe. In reality the certificate authority gives away the encryption keys to whatever agency wants it. In our case the browser warning deceives you into making the wrong choice. When setting up a system like this one, the best choice for security is to encrypt with a certificate, and not register the certificate. It looks weird to users, but we should be smarter than that. Whomever setup this site did it right. I assume Polverone.

[Edited on 12-8-2014 by quantime]

[Edited on 12-8-2014 by quantime]

Loptr - 12-8-2014 at 13:12

Quote: Originally posted by quantime

That message is just a stupid message that says the certificate is not tied back to an authority. In reality all certificates on the net that are tied back to an authority are immediately insecure. That is what a certificate authority is. A certificate authority is suppose to lend credibility to a certificate. A certificate authority is suppose to tell your browser that a certificate is safe. In reality the certificate authority gives away the encryption keys to whatever agency wants it. In our case the browser warning deceives you into making the wrong choice. When setting up a system like this one, the best choice for security is to encrypt with a certificate, and not register the certificate. It looks weird to users, but we should be smarter than that. Whomever setup this site did it right. I assume Polverone.

[Edited on 12-8-2014 by quantime]

[Edited on 12-8-2014 by quantime]

Yeah, it's a self-signed certificate. You can add the certificate to your local certificate authority, also possible to add it to the browsers list, and it will accept the certificate from that point on.

APO - 12-8-2014 at 13:56

I think you missed kentkams, who has been compromised.

Texium - 12-8-2014 at 14:04

Um, I don't think so. His account looks normal. At first I thought he was, because he was right below the /root/ people on the member list and I misread, but then later I noticed he wasn't.

S.C. Wack - 12-8-2014 at 14:06

It's weird that there are 10 people common to both lists, and not more or less. It would be interesting to know if anyone now locked had a strong password, or is it on the short list or "short" list of passwords. My password is on a higher level, but I log in https with tor anyways.

Polverone - 12-8-2014 at 14:25

Some "attacker" actions came from woelen's IP address. As far as we can tell his actual account was never taken over. It is possible that the attacker embedded a script or a script-loading iframe sandbox in a U2U or post that hijacked the browser in the background. One thing such a script could do is steal authentication cookies, because the XMB software was not setting the HttpOnly flag on cookies. Once the attacker has your xmbpw cookie he could run a dictionary attack against it to recover the actual account password.

I have now patched our XMB software so that cookies are set to HttpOnly, meaning they cannot be captured by a rogue script even if one is running: https://www.owasp.org/index.php/HttpOnly

I suggest that everyone log out and log in again so as to get the more secure HttpOnly cookies stored by their browser.

Texium - 12-8-2014 at 14:29

Alright, will do. Thanks Polverone.

forgotpassword - 12-8-2014 at 17:33

Okay Polverone, how are you going to contact us though to get our accounts back?
I hope it stops now that you've set cookies to HttpOnly.

You might recognize the jerk who hijacked accounts: help identify him

Polverone - 12-8-2014 at 22:35

I am working toward frozen account restoration soon. I will reset passwords manually and send them to the original email address associated with the frozen account. Unfortunately, a cat knocked my external hard drive to the floor while I was trying to retrieve the most recent forum DB backup. That drive is dead now. I have to go back to a backup from 2012 to find non-tainted email addresses for members, and not all affected members had yet registered at that time. I'll probably need to do a web-of-trust thing where members who have been in contact with a frozen-account member can vouch for the correct email address that should be associated with the account.

Some measures have been taken to improve security, which I won't describe in public yet so as to delay someone intent on circumventing them.

I think the attacker is a current or recent-past student of the Lumen Christi Catholic grammar school in Derry, Northern Ireland. I think he has an interest in pyrotechnics and may be known by members here or on other chemistry/pyrotechnics forums due to his interests.

I have uploaded the most interesting material that I mirrored from the attacker's web server:
http://www.sciencemadness.org/evidence/

For the story so far read this:
http://www.sciencemadness.org/evidence/READTHIS.html

There are videos including voice tracks and recorded phone calls that I grabbed from his server. It's unlikely that anyone would know him in person, but someone who understands the regional accents better than I do and/or has more time to listen to phone calls might find some interesting material among the recordings.

I hope that someone might be able to tease out clues to the attacker's identity that I have missed so far.

The most maddening thing is that I still have not figured out how compromised members' browsers were tricked into loading a file from the attacker's server. I have searched forum U2Us and posts here in various ways looking for weird iframes, scripts, or links, but no luck so far. If there is not a deeply disguised poison post somewhere here on sciencemadness, then the attack was initiated from a third party site. My best guess at current would be sciencemadness.wikia.com. The site loads such a multitude of scripts and third party content that it could take a very long time to inspect everything thoroughly for suspicious scripts, frames, or links.

APO - 12-8-2014 at 23:01

I'll have to break out the steganography on this one. Shall I call up dateline?

arkoma - 12-8-2014 at 23:17

fuck dateline--they'd bust us all as "terrorists"

edit--because we bother to think for ourselves

[Edited on 8-13-2014 by arkoma]

arkoma - 12-8-2014 at 23:24

someday I will stowaway on a freighter and sneak into Ulster. Ya fekking prick, ya better hope I don't figure out who you are.........................cuz then you are MINE

edit--I got family and friends in county monaghan...............

[Edited on 8-13-2014 by arkoma]

Polverone - 12-8-2014 at 23:31

This is an IRC log someone shared with me by private message. Look who claims to be from Northern Ireland. Also look at who has Youtube videos that match the ones on the attacker's server. Someone else who uses IRC should be able to corroborate the logs or refute them if they've been tampered with.

Code:


[09:12] <Manifest> I wish I lived in America
[09:13] <Manifest> Very dull and boring here, shit weather, etc
[09:13] <Manifest> free healthcare, that's a plus
[09:14] <bfesser> You don't like the climate there?
[09:14] <Manifest> No, it rains and is always cloudy
[09:14] <bfesser> The climate in my region is shit... arctic winters, and mosquito-ridden summers with tornadoes.
[09:14] <bfesser> I'd much rather have rain and clouds than sunshine.
[09:15] <Manifest> Have you ever been to Europe?
[09:15] <bfesser> Yes.
[09:15] <Manifest> Why?
[09:15] <bfesser> Because I like rain?
[09:15] <Manifest> Oooh, specifically?
[09:16] <bfesser> Spain via Amsterdam Schiphol International Airport.
[09:16] <Manifest> I'm from Northern Ireland
[09:16] <bfesser> Quite a bit of travel in Spain, though. Several trips. But when I was younger.
[09:17] <UC-235> I remembered where my camera was...on my lab bench for the last few months
[09:17] <bfesser> Oh, so you love the English? :P
[09:17] <Manifest> Yes, my best buddies.
[09:17] <bfesser> lol
[09:17] <Manifest> Is that on the news?
[09:17] <bfesser> Is it?
01[09:18] <The_God> I love rain
[09:18] <Manifest> Is the troubles like a world known thing?
01[09:18] <The_God> I hate the sun
01[09:18] <The_God> I was so born in the wrong country
01[09:18] <The_God> aside from the fact that I hate most Australians... ugh
[09:18] <UC-235> england's weather blows.
[09:18] <Manifest> ^^
01[09:18] <The_God> Australia's weather is shit
03[09:18] * BomberM (~bomberman@s1.v-m.no) has joined #sciencemadness
[09:19] <Manifest> UC-235 you're english?
03[09:19] * CHANFIX2 (chanfix@backup.services.int) has joined #sciencemadness
03[09:19] * backup.services.int sets mode: +o CHANFIX2
03[09:19] * CHANFIX2 sets mode: +o BomberM
[09:19] <@CHANFIX2> 1 client should have been opped.
03[09:19] * @CHANFIX2 (chanfix@backup.services.int) has left #sciencemadness
01[09:19] <The_God> it's just varying degrees of hot
[09:19] <Manifest> Why is that bad
03[09:19] * BomberM sets mode: +o BomberMan
01[09:19] <The_God> summer = omg it's so hot I'm going to die and winter = meh, it's less hot, at least
[09:19] <Manifest> Here it rains 24/7
[09:19] <bfesser> I don't know if it's a "world known thing," but I like to think that I have at least a loose grasp on world history and current affairs.
[09:20] <Manifest> oh.
[09:20] <UC-235> Manifest, no. murica. but my brother did reasearch in england for a few months and I spent about 2 weeks of moist and cloudy there.
[09:20] <Manifest> >:/ Fertiliser is exceedingly difficult to come by here due to the IRA.
[09:21] <@BomberMan> man I want a tractor
[09:21] <bfesser> Oh, good, you got OP fixed.
01[09:21] <The_God> you and your tractors
[09:21] <Manifest> Is bomber a mod?
[09:21] <bfesser> Time to replace "YOU A;; SUCL DICK!"???
[09:21] <Manifest> excuse my ignorance
[09:21] <bfesser> Use organic fertilizer, then.
[09:22] <UC-235> bomber made the channel
[09:22] <bfesser> Shit in the fields.
01[09:22] <The_God> yeah, it'll be replaced next time you're drunk
01[09:22] <The_God> hopefully with something even awesomer
[09:22] <Manifest> I am not a farmer, I want it for chemistry
[09:22] <UC-235> I use way less nitrates than I ever expected.
[09:22] <bfesser> N. Irish chemistry === bomb building.
[09:22] <UC-235> but then again, Im not into pyro
[09:22] <Manifest> I made ETN recently
[09:23] <bfesser> Precisely why you don't need nitrates!!!
01[09:23] <The_God> I think the only nitrate I have is a VERY tiny bit of silver nitrate I made myself a while ago
01[09:23] <The_God> no pyro for me
[09:23] <Manifest> But I was safe!
[09:23] <UC-235> I guess I do have that silver nitrate too...
[09:23] <bfesser> Right...
[09:23] <bfesser> Safe *amateur* energetics is such an oxymoron.
[09:23] <UC-235> and like 2kg of NaNO3, a kilo of KNO3, and some amount of ammonium.
[09:24] <Manifest> I'll send 1kg to the queen next week
[09:24] <bfesser> LOL
[09:24] <UC-235> some WFNA in the freezer.
[09:24] <bfesser> https://www.youtube.com/watch?v=8z2M_hpoPwk
[09:24] <Manifest> lolololol
[09:24] <Manifest> ETN is not particularily dangerous, it needs to be intentionally set off
[09:25] <UC-235> unless you're the guy in energetics who insisted you can melt it with a free flame
[09:25] <UC-235> because hot water is too much effort
[09:25] <Manifest> lololol
[09:25] <Manifest> Yeah, the bother of boiling a kettle, it's too much hassle!
[09:26] <UC-235> and the guy who had to have glass shards removed from the entire front of him when he accidentally heated a few mg in a test tube over a flame
[09:26] <bfesser> The Sex Pistols were always sellouts... the Dead Kennedys are just sellouts now--except for Jello Biafra.
[09:26] <bfesser> >accidentally heated over flame
[09:26] <Manifest> you guys have facebooks?
[09:26] <bfesser> >accidentally over flame
[09:26] <bfesser> >ACCIDENTALLY
[09:26] <Manifest> yeah, how can that be done accidentally
[09:26] <bfesser> Facebook?
[09:27] <Manifest> yes
[09:27] <bfesser> I stopped using it when they allowed non-students to register.
[09:27] <UC-235> I can find the thread. he'd casted most of it with hot water. few crumbs in a test tube...didnt think.
[09:27] <Manifest> I do not see why Twitter is so great
[09:27] <Manifest> Personally it is shit
[09:27] <bfesser> Because why the fuck would I 'friend' my sister-in-law's parents!?
[09:27] <Manifest> You don't
[09:27] <Manifest> You block them
[09:28] <bfesser> https://www.youtube.com/watch?v=ksKWonVOAgE
[09:28] <UC-235> http://www.sciencemadness.org/talk/viewthread.php?tid=16612
[09:28] <Manifest> https://www.youtube.com/watch?v=eebsL0gzx6w
[09:29] <Manifest> lol what a fucking retard
[09:29] <UC-235> speaking of which, I still have a half kilo of erythritol that Ill probably never use.
[09:29] <Manifest> It is very expensive
[09:29] <UC-235> not sure why I bought it. but that was like 7 years ago
[09:30] <UC-235> for $10
[09:30] <Manifest> I may try making Chlorate for profit.
[09:30] <bfesser> Jello Biafra is fucking awesome.
[09:31] <Manifest> 1 kg here sells on Amazon/ebay for the equivilent of $42 for you guys
[09:31] <Manifest> idiots actually buy it!
[09:31] <UC-235> i bought it as a non-calorie sweetner...
[09:31] <Manifest> Potassium Chlorate I mean
[09:31] <UC-235> oh
[09:31] <Manifest> Sorry to stray off topic
[09:32] <UC-235> I made like 15g of KClO3...never have needed it
[09:32] <bfesser> "How low have we sunk when it's up to a thug like Putin to show us a way out?"
[09:32] <Manifest> hah
[09:32] <Manifest> Cheddite looks easy
[09:33] <bfesser> Is that your video?
[09:33] <Manifest> At the end of my exams 20th June I am going to have a firework party with my friends
[09:33] <Manifest> Is is.
[09:33] <Manifest> it*
[09:34] <bfesser> I gave it an "I dislike this."
[09:34] <Manifest> Oh no
[09:34] <bfesser> Consider using a failsafe remote detonator next time, and I'll give it a thumbs up.
[09:34] <Manifest> But it was a long fuse!
[09:34] <bfesser> Lighting a fuse and running is too amateurish and dangerous.
[09:35] <bfesser> If you tripped, fell, and broke your ankle three feet away...
[09:35] <bfesser> You'd be crawling for your life.
[09:35] <Manifest> It was not enough to damage me
[09:35] <Manifest> maybe my eardrums
[09:35] <bfesser> Precisely.
[09:36] <bfesser> Also, detonating without taking any measurements... what's the point?
[09:36] <bfesser> "Ooh, it blowed up!"
[09:36] <Manifest> I did, but then I gave up
[09:36] <bfesser> "Keeeeeeewl."
[09:36] <Manifest> https://www.youtube.com/watch?v=A9YJbw0DyT0
[09:36] <Manifest> Another one
[09:39] <Manifest> Oh come on! You can't say it is not fun to simply blow a little up
01[09:40] <The_God> There was a good video on youtube by a guy who blew his hand off with acetone peroxide... I used to just show that to people... he decided it wasn't fun
[09:41] <Manifest> Does it still exist
[09:41] <bfesser> LMAO: https://www.youtube.com/watch?v=SeJyorNbvWg
01[09:41] <The_God> I couldn't find it last time I looked... but I think I did finf others by him... so probably not
[09:41] <bfesser> Back in a minute... laundry.
01[09:42] <The_God> it wasn't a video OF him blowing his hand off
[09:42] <Manifest> oh
[09:42] <Manifest> meh!
01[09:42] <The_God> it was about how he did it, how he foolishly thought it was safe because he'd done it many times before, and how wrong he ended up being... begging people not to make it... and some pictures of the new stump where his hand used to be
01[09:43] <The_God> he had apparently had a bunch of videos about how to make it, which he'd removed at that time
[09:44] <Manifest> Why do people bother with organic peroxides
[09:45] <bfesser> I found an EEPROM in the bottom of the washing machine. I don't think most people have these problems...
[09:46] <Manifest> Nah
[09:47] <Manifest> I am really tempted to attempt to make nitrates from urine

[Edited on 8-13-2014 by Polverone]

arkoma - 12-8-2014 at 23:35

OMG--polv, how can you STAND the unity desktop LMFAO

edit--I'm a cinnamon man myself

[Edited on 8-13-2014 by arkoma]

Polverone - 12-8-2014 at 23:57

I have updated the READTHIS file with the screenshots and a link to a large (4.8 MB) IRC log containing the excerpt above and much more.

arkoma - 13-8-2014 at 00:19

not even imaginative--looks like they were using "straight out the box" Kali Linux....

Polverone - 13-8-2014 at 00:32

I was able to also find uncorrupted email addresses from backups for bobm4360, DJF90, elementcollector1, and plante1999. I have reset their accounts with strong passwords and emailed a notice to each of them.

I will need help making contact with the owners of the remaining frozen accounts listed here, if you know or can get their email addresses from IRC, U2U messages, Facebook, etc. Of course I will also need to do some cross-checking to make sure that the email addresses are actually those of the account holder and not an attacker.

Code:


+----------------------+
| username             |
+----------------------+
| acetone              |
| bamboula             |
| BMN_1                |
| Brain&amp;Force      |
| Ddan                 |
| DubaiAmateurRocketry |
| freedompyro          |
| gdflp                |
| GreyCatFin           |
| HeYBrO               |
| Mr_Magnesium         |
| numos                |
| Oscilllator          |
| SweetHomeSunscreen   |
| Tdep                 |
| TheChemiKid          |
| Töilet Plünger       |
| zebilol              |
+----------------------+

plante1999 - 13-8-2014 at 00:48

Got control back.

woelen - 13-8-2014 at 02:48

I reset the password of gdflp and HeyBRO and let them know the password, but the accounts still seem to be blocked. Polverone, can you activate these accounts again, without resetting their passwords?

[Edited on 13-8-14 by woelen]

The Volatile Chemist - 13-8-2014 at 05:51

If you read the top comments on this video, you can communicate with tdep and B&F. Thanks for all your work!

So are we accusing Manifest? That seems a bit rash, there are lots of N.Irish people on this site, b/c in ireland it's harder to get chemicals than in America (Very surprisingly).

[Edited on 8-13-2014 by The Volatile Chemist]

gdflp2 - 13-8-2014 at 06:20

Just found something interesting, it seems he commented on NurdRage's testing video, and NurdRage replied. Apparently, he was the first one to donate to NurdRage's bitcoin, so maybe NurdRage knows something about him.

The Volatile Chemist - 13-8-2014 at 06:26

So is it certain he did it? Regardless, his title should be Ferrel Script Kiddie

careysub - 13-8-2014 at 06:36

Quote: Originally posted by arkoma

OMG--polv, how can you STAND the unity desktop LMFAO

edit--I'm a cinnamon man myself

[Edited on 8-13-2014 by arkoma]

Cinnamon here too (though I run Ubuntu LTS on another machine as well).

Unity is okay if you install Classic Menu and ignore it.

I have learned after several Ubuntu installs over the years two rules: I you use Ubuntu only use LTS releases, and always use the default desktop environment - it is the only one that is not fatally buggy.

But if you use Mint you are golden.

Lambda-Eyde - 13-8-2014 at 06:40

I unfortunately don't have an IRC log since my ssh box went down a little while back, but I remember the conversation clearly.

The Volatile Chemist - 13-8-2014 at 06:43

Yea... Just run Win XP. Regardless, is it certain it is manifest?

arkoma - 13-8-2014 at 06:49

Quote: Originally posted by careysub

But if you use Mint you are golden.

Mint17 Qiana

gdflp2 - 13-8-2014 at 06:52

Quote: Originally posted by The Volatile Chemist

Yea... Just run Win XP. Regardless, is it certain it is manifest?

Pretty sure, the IRC logs prove that that Google+ Page is his and one of his friends on G+ say that they are attending Lumen Christi College which is the other site he tried to hack, along with the uniform shown in one of his videos.

The Volatile Chemist - 13-8-2014 at 06:56

Quote: Originally posted by gdflp2

Quote: Originally posted by The Volatile Chemist

Yea... Just run Win XP. Regardless, is it certain it is manifest?

OK, but why would he do it? Just have to make sure it's him. And thanks for posting his IP provolone...
Yay, 500th post, now I'm an international hazard

[Edited on 8-13-2014 by The Volatile Chemist]

gdflp2 - 13-8-2014 at 07:08

All of the mp3 files seem to be prank calls using a service like PrankOwl. This service connects two phones and each person thinks the other one called them. All of them seem to involve Culmore Taxi Service, while the others vary being McDonald's and other places.

The Volatile Chemist - 13-8-2014 at 07:34

Did some pinging and such of his server. It doesn't seem to be on port 80, and I did a router trace too.

So his server has an SSH port on 22.

[Edited on 8-13-2014 by The Volatile Chemist]

[Edited on 8-13-2014 by The Volatile Chemist]
Someone just saved my butt on a picture I posted... WTMI on it

[Edited on 8-13-2014 by The Volatile Chemist]

[Edited on 8-13-2014 by The Volatile Chemist]

Texium - 13-8-2014 at 07:37

Besides, when it first started happening, Manifest tried to discourage me from starting this thread and said it was probably just a bug due to software updating. I know that it's not conclusive proof of anything, but it certainly makes sense and backs up everything else.

[Edited on 8-13-2014 by zts16]

MrHomeScientist - 13-8-2014 at 07:45

Very interesting and disturbing. I did enjoy reading your detective work, Polverone. If Manifest = Mike Ehrmantraut = juvenile catholic school hacker, that would be a big surprise to me. Mike has commented on several of my videos with insightful thoughts and good info.

Then again, on the internet, nobody knows you're a dog.

Edit: Hyperlink problems, probably because of all the punctuation in the original link.

[Edited on 8-13-2014 by MrHomeScientist]

WGTR - 13-8-2014 at 07:56

Things like this are a huge hassle, and an insult to the efforts of people who have worked hard to build this forum to where it is today. A lot of information on here is quite valuable an irreplaceable.

Thanks for all the hard work that you've put into this, Polverone. It's certainly appreciated. Do you have any particular hardware or funding issues that need taking care of?

The cat has probably been suffering from this too. When they feel neglected, they have ways of getting your attention (I wonder what happens when I push this database backup onto the floor. Will that get his attention?)

The Volatile Chemist - 13-8-2014 at 08:04

Quote: Originally posted by WGTR

Things like this are a huge hassle, and an insult to the efforts of people who have worked hard to build this forum to where it is today. A lot of information on here is quite valuable an irreplaceable.

Thanks for all the hard work that you've put into this, Polverone. It's certainly appreciated. Do you have any particular hardware or funding issues that need taking care of?

The cat has probably been suffering from this too. When they feel neglected, they have ways of getting your attention (I wonder what happens when I push this database backup onto the floor. Will that get his attention?)

Lol, you're right about the cat. Polverone, I suppose you wouldn't give us manifest's old password? Not so that we can log into his SM account.

elementcollector1 - 13-8-2014 at 09:08

Alright, thanks for getting me back in on the action. Remind me - what's his IRC name? I'll see if I ever had any contact - which I doubt, but still.

gdflp - 13-8-2014 at 09:15

Back in control of my account. Thanks woelen!

Lambda-Eyde - 13-8-2014 at 09:30

Quote: Originally posted by elementcollector1

Alright, thanks for getting me back in on the action. Remind me - what's his IRC name? I'll see if I ever had any contact - which I doubt, but still.

He mostly went under "Manifest" on the channel AFAIK.

DrAldehyde - 13-8-2014 at 09:48

It was interesting reading through those chat logs. Really helps develop a sense of personality, what drives people, the chips on their shoulders. Also serves to remind how everything we do online is documented. Glad the admins were able to catch this, hopefully somebody will get a spanking.

arkoma - 13-8-2014 at 09:58

I see Manifest has a "kewl" shiny new forum title LMFAO.

The Volatile Chemist - 13-8-2014 at 10:43

Quote: Originally posted by arkoma

I see Manifest has a "kewl" shiny new forum title LMFAO.

You got a pretty great one too

Wish I had a personality or sumptin to put up there, but oh well... :/

[Edited on 8-13-2014 by The Volatile Chemist]

[Edited on 8-13-2014 by The Volatile Chemist]

forgotpassword - 13-8-2014 at 10:56

I'm sorry SM, I am Manifest or that guy from Derry.
/root/ was a way to identify who's account had an email change after a successful bruteforce, unfortunately people caught on...
Believe it or not my intentions were good, my plan was to maybe take over an admin account and on the front page post about the security flaw and then inform Polverone as a joke.
If you don't believe me I have informed Polverone about a security flaw in the past.

arkoma - 13-8-2014 at 10:58

Quote: Originally posted by forgotpassword

I'm sorry SM, I am Manifest or that guy from Derry.
/root/ was a way to identify who's account had an email change after a successful bruteforce, unfortunately people caught on...
Believe it or not my intentions were good, my plan was to maybe take over an admin account and on the front page post about the security flaw and then inform Polverone as a joke.
If you don't believe me I have informed Polverone about a security flaw in the past.

Boy, have you got BALLS

Edit--and that is NOT a compliment

[Edited on 8-13-2014 by arkoma]

forgotpassword - 13-8-2014 at 11:05

It is what it is.
This really did backfire on me, I wasn't planning anything malicious, I was just going to have fun before telling Polverone.
I really, really really must commend Polverone, he is a fantastic admin and his detective work regarding that server and everything else, the IRC logs is just brilliant, I wanted to see how long it would go on before he got me.
I must emphasise that I did not mean any malice by this, I was just dicking about.
I'm sorry arkoma.

Loptr - 13-8-2014 at 11:09

Quote: Originally posted by forgotpassword

The intention of white/grey hat hacking is not to cause embarrassment to the staff and administrators. If you find something, it is not responsible for you to go making changes to members accounts, or the site. If you were in the USA, you could be brought under charges of computer misuse and fraud.

I used to be a staff member at GSO, but have since moved on to bigger and better things, and a family.

[Edited on 13-8-2014 by Loptr]

[Edited on 13-8-2014 by Loptr]

Polverone - 13-8-2014 at 11:20

Where/how did you hide the iframe? I have scoured recent posts looking for suspicious iframes and turned up nothing. Was the iframe sandbox code on a third party site, or right here in a post on the forum? If you had a clever way of obfuscating the iframe sandbox loading that is worth knowing as much as how the attack itself worked (which I think I have sussed out by now -- and it also explains why certain habits of mine made me invulnerable to your implementation).

arkoma - 13-8-2014 at 11:26

Quote: Originally posted by forgotpassword

It is what it is.

I'm sorry arkoma.

Accepted.

Think of the WORK it caused--Polverone has a REAL JOB, earning money to live on, and had to muck around figuring this out.

DrAldehyde - 13-8-2014 at 11:26

Round of forum applause for Polverone, for fending off the attack and then flushing the culprit out. As to the guilty party pleading mercy, hmm, if you ever watch sentencing in court, you would know that the guilty are always the most repentant once they are caught.

The Volatile Chemist - 13-8-2014 at 11:42

So Manifest, I recommend changing your SSH port... 22 is NOT a good place for it. And I always knew forgottenpassword was was a malicious guy... Now I have proof...

elementcollector1 - 13-8-2014 at 11:45

While I appreciate the intention? Don't hack my account. It ain't fun or fair to be blocked from the forum for a few days after returning from a trip.

forgotpassword - 13-8-2014 at 11:53

Quote: Originally posted by The Volatile Chemist

So Manifest, I recommend changing your SSH port... 22 is NOT a good place for it. And I always knew forgottenpassword was was a malicious guy... Now I have proof...

Sorry elementcollector, your account wasn't hacked, just the email and location changed but I am sorry.

Port 22 is the default port and if changed a port scanner will pick up a new port anyway.
Forgottenpassword is innocent, he's not malicious(that I know of) he isn't me.
I am 'forgotpassword'
You can't bruteforce that IP address, you will be blocked out after 5 failed attempts and have your IP banned.
That's not my router btw that's a VPS.

[Edited on 13-8-2014 by forgotpassword]

Texium - 13-8-2014 at 11:57

Quote: Originally posted by The Volatile Chemist

I always knew forgottenpassword was was a malicious guy... Now I have proof...

That isn't forgottenpassword, that's FORGOTpassword, which was an account created yesterday. Not the same person. So good job Volatile, you just insulted an innocent member of the forum!

Polverone - 13-8-2014 at 12:03

After you have finished initial server configuration, use public key authentication for SSH and disable password based authentication altogether. Any password that's strong enough to trust is too hard to memorize anyway, so you might as well resign yourself to needing a stored key instead of a memorized word to log in.

I'm still waiting to hear about where the iframe sandbox was hidden, if you're really contrite and want to help clean up the mess you made.

arkoma - 13-8-2014 at 12:03

Quote: Originally posted by zts16

Quote: Originally posted by The Volatile Chemist

I always knew forgottenpassword was was a malicious guy... Now I have proof...

That isn't forgottenpassword, that's FORGOTpassword, which was an account created yesterday. Not the same person. So good job Volatile, you just insulted an innocent member of the forum!

Emotions are understandably running a bit high, zts. Why I already said I figured I owed Mr_Magnesium an apology--I flamed him pretty good in the now deleted acetone peroxide thread.

Brain&Force - 13-8-2014 at 12:16

Manifest, if you really did just "expose a security flaw" why were my posts regarding the matter deleted? And why was Mr_Magnesium's account sockpuppeted?

[Edited on 13.8.2014 by Brain&Force]

forgotpassword - 13-8-2014 at 12:19

I deleted your posts because you were exposing me early so I deleted your posts and locked your account to attempt to stop more people noticing.
Mr_Magnesium's account was sockpuppeted to spread the hack basically.

Dany - 13-8-2014 at 12:28

After all, all this mess was caused by a school boy... wait until he gets his university degree

Dany.

elementcollector1 - 13-8-2014 at 12:48

If, as you say, it was just my email and location, why couldn't I log in? Sounds like you changed my password as well.
Also, if your intentions were as good as you say, you could have privately contacted Polverone, and saved both yourself and the rest of us the trouble.

forgotpassword - 13-8-2014 at 13:08

You could not login because Polverone froze your account to prevent more damage.
I could have done that but I was bored and when I reported a flaw in the past I didn't even get a thanks, so I decided to have more fun before informing Polverone, it was the wrong thing to do, I'm sorry, I was just bored to be honest, why am I called a script kiddie when I did not use scripts, in fact a google search will not show you the exploit I used.
I am very impressed with Polverone's detective skills, my intentions while not exactly great were not malicious.

arkoma - 13-8-2014 at 13:10

Take your Kali Linux disc and insert it in your rectum

Edit--you seem to have ABSOLUTELY NO REMORSE. Here in the US of A we tell people like you to "Fuck Off", but since you are in the UK "Bugger Off" seems more appropriate.

[Edited on 8-13-2014 by arkoma]

Brain&Force - 13-8-2014 at 13:12

And you could have foregone the signature wiping. Mine is loaded with BBCode and HTML, and I was lucky to have saved it somewhere.

Pages: 1 2