GSC has been hacked

[Scotty]

Well, I just found out that the Gay Sims Club has been hacked and deleted. I do not know if it can be restored. Someone changed the name to Gay Fags Club. I am deviststed. I put years of work into that site. And I am beyond upset. I'd love to know who did it. But I won't hold my breath. I'm just numb.

[Scotty]

The fuckers. I am restoring my site now. I'm glad I have a good hosting service, but if I EVER find out who hacked my site, I will hunt him/it down and fuck them up!

[J. M. Pescado]

My guess would be that it was an unrelated random Internet hacking performed by script kiddies. You need to update your stuff more and avoid using software and plugins you don't understand.

[Tikkititi]

Well, I just found out that the Gay Sims Club has been hacked and deleted. I do not know if it can be restored. Someone changed the name to Gay Fags Club. I am deviststed. I put years of work into that site. And I am beyond upset. I'd love to know who did it. But I won't hold my breath. I'm just numb.

Understandable. If that happened to me, I'd not just be deviststed, I'd be tottimented. Utterly musherable.

However, I doubt even my deep dipsolation would drive me to double posting. Get a hold of yourself.

[Scotty]

Did I double post? Sorry. I was posting from my iPod. The GSC has been around for several years, and this is my first hacking. But hey, it's been fixed. And Pes, the only mods I  have on my forum are official add ons from Invision. I update the software as much as I can. Or, as much as Invision updates their software.

[J. M. Pescado]

And Pes, the only mods I  have on my forum are official add ons from Invision. I update the software as much as I can. Or, as much as Invision updates their software.

Being official doesn't meant it ain't crap. And ultimately, shit happens. If a new breaking exploit just emerged, they may not have officially resolved it yet, so expect a wave of attacks on boards running that software. I wouldn't really call this a deep and particularly meaningful event. This is just typical Internet shit, you get used to this.

[Scotty]

I'm used to it. I'm sure it's just some random moron that thought he could put one over on some random site. I got called a Pirate Fag, so that's a bonus.

[J. M. Pescado]

...oh, a PIRATE fag now? See, that's a new wrinkle. Tell me more about this. I revise my previous opinion. I no longer believe this to be entirely random, and now suspect TSR involvement.

[Scotty]

Well, they deleted almost everything, all the posts, members and renamed the forum to the Gay Pirate Fag Club. I made a fake name and went in there to see what was going on, and someone that was signed in as me PMed me and called me a Gay Pirate Fag. And that's all he said. One of my members said it's probably TSR.

[J. M. Pescado]

I concur with this assessment. The MO of the attack implies that it was performed by someone of low technical skills, but possessing privileged information obtained by some means, and a directed motive. A random attack would not have specifically attacked on a member-and-post-level, but instead, would have simply just dropped all the DB tables and left the site completely inoperable, and/or defaced the front page. The fact that the underlying data was not wiped or replaced by a defaced page indicates that the attacker did not have the technical skills needed to perform such an act. So, indubitably a TSR attack.

[Anach]

Cannot argue with logic like that!

[Fat D]

Well, they deleted almost everything, all the posts, members and renamed the forum to the Gay Pirate Fag Club. I made a fake name and went in there to see what was going on, and someone that was signed in as me PMed me and called me a Gay Pirate Fag. And that's all he said. One of my members said it's probably TSR.

So your site is a "Jolly Buccaneer Cigarette Bludgeon"?

[Scotty]

Well, Ive never really made it a secret that I despise TSR. I can think of a couple people that hate me enough to do that. But fuck em. Ive worked too hard on the GSC, and even if I couldn't save it, I'd bring it back in some form. I'm not going to let some fuckin idiot run me off.

[ShortyBoo]

I wouldn't be surprised if TSR was the culprit, considering the things they've done in the past. The use of the word "pirate" also supports the theory since TSR loves calling people pirates like it's a bad thing. They called the people on the list they stole from that petition pirates too.

[Zazazu]

I concur with this assessment. The MO of the attack implies that it was performed by someone of low technical skills, but possessing privileged information obtained by some means, and a directed motive. A random attack would not have specifically attacked on a member-and-post-level, but instead, would have simply just dropped all the DB tables and left the site completely inoperable, and/or defaced the front page. The fact that the underlying data was not wiped or replaced by a defaced page indicates that the attacker did not have the technical skills needed to perform such an act. So, indubitably a TSR attack.

Hm. Atwat, perhaps? I'd generally think it beyond her ken, but it's the sort of lowball attack she'd love to do.

[dragonballz]

I'm beginning to think that T$R is run by a staff of twelves akin to the Oompa Loompas in Willy Wonka. Emerald-haired, tangerine-skinned, pirate-chanting twelves. With mullets. Bad mullets.

[Scotty]

I wish I would have gotten some screen shots of this, but my only thought was getting my forum working again.

And Oompa Loompas were the good guys. I was thinking more along the lines of winged monkeys from The Wizard of Oz.

[J. M. Pescado]

And Oompa Loompas were the good guys. I was thinking more along the lines of winged monkeys from The Wizard of Oz.

I dunno, man. Those Wonkans are pretty disturbing.

[Witchboy]

More info forth coming...

It seems as they were busy hacking GSC they were also hacking into my account on Simvention at or around the same time. This has been confirmed by Nei. They soft deleted all my creations, changed my e-mail  & password. Nei is working on getting my account back up so i can get in and change the e-mail & password.

From Nei on MSN

Bill said:
hi nei nei!! i cant log into simvention and it seems everything in my section has been deleted

Isilme :: at work says:
Looks like someone soft deleted your threads. The email you used for simv wasn't **** @ aol .com was it?

Bill said:
No it wasn't

Isilme :: at work says:
It might have been someone hacked into your account then :/ i've taken a look and the threads have been deleted by your own account .The IP Address is: 83.170.113.97. The host name is: server52555.uk2net.com.

i can help change the email back and then you can try to reset your password?

Bill  says:
ok please ty
thats not my ip

Bill says:
*is there a date on when they removed my downloads? and when they were logged in?

Isilme :: at work says:
4:43, 8th Jan 2010
Around that time
But it might be set to my local time. i'm at gmt +8

[Mirelly]

Are we talking about "hard" hacking here, where an evil genius gets by the host server's security to wreak havoc? Or maybe it was a case of "soft" hacking where some fuck wit lucked out on a less than secure password? Passwords should always be at least 8 characters long and contain a mixture of upper and lower case letters plus one or more numerals. One should also avoid using the same password for multiple applications, and never use the same password to protect strictly personal activity (banking for example) and interwebs tomfoolery like forum usage. Changing passwords often should [edit]not[/edit] be regarded as optional.

[J. M. Pescado]

This looks like the typical soft case, following the MO of all previous TSR-linked hackings: Compromise to specific user's password followed by application-level vandalism on multiple connected sites. It's not very sophisticated and demonstrates little foresight, planning, or skill.

[Johan]

How are they linked to TSR?

Have Witchboy and/or Scotty used the same password as an account on TSR and that password hasn't changed in a year or so?
Maybe Scotty could try and dig out the IP address from the server log to see if it matches the one used to "hack" Witchboys account?
The user agent string could also be interesting to compare (though i think our "hacker" have learned to hide it by now).

This really should go without saying but just for the record, TSR don't "hack" or in other ways mess up other websites.
We don't feel we need to destroy things, there's plenty of space out there

[J. M. Pescado]

This really should go without saying but just for the record, TSR don't "hack" or in other ways mess up other websites.
We don't feel we need to destroy things, there's plenty of space out there

Well, YOU probably don't. But like I've mentioned to you in the past, you've got at least one rogue operator, and you never caught him. Given that the rogue operator responsible for the initial leak was never actually caught, it is reasonable to believe he remains at large and continues to supply the person(s) responsible, even if he isn't specifically that person.

[Witchboy]

How are they linked to TSR?

Have Witchboy and/or Scotty used the same password as an account on TSR and that password hasn't changed in a year or so?
Maybe Scotty could try and dig out the IP address from the server log to see if it matches the one used to "hack" Witchboys account?
The user agent string could also be interesting to compare (though i think our "hacker" have learned to hide it by now).

This really should go without saying but just for the record, TSR don't "hack" or in other ways mess up other websites.
We don't feel we need to destroy things, there's plenty of space out there

No, Scotty & i both don't use the same password or even the same accounts anywhere let alone TSR. The IP used to hack into both GSC & SV was thru a proxy server.

Screenshot courtesy of Coconut.

[Johan]

Well, YOU probably don't. But like I've mentioned to you in the past, you've got at least one rogue operator, and you never caught him. Given that the rogue operator responsible for the initial leak was never actually caught, it is reasonable to believe he remains at large and continues to supply the person(s) responsible, even if he isn't specifically that person.

IF there is a rogue operator somewhere within TSR then i would certainly want him/her caught. If Witchboy or Scotty have any more detail about this i would like to know.
A good start would be to find out if they have used a password that has also been used on TSR.
We changed to hashed passwords about a year ago so even if someone with database access (that is one of the 5 owners me included) would be a rouge operator all he could supply is a password that needs to be brute forced.

If you by initial leak refer to the Buggybooz incident i have also told you before that i think that was someone on your side given the actual evidence we had.
 
Since we repeatedly get the blame for stuff like this i would like to help investigate this.