Forum Issues

[alaskan thunderfuck]

Mind explaining what you mean by "broke in"?
I enjoy the specifics of things, and I think I ought to know what may/may not bring me issues

from what i heard no one changed the DB password since it was leaked 8 months ago, unless some of your admins are making up bull shit on the spot

admins are full of shit, not only did we change the password multiple times since then but its IP locked so it wouldn't matter

what really happened was a certain group of kiddies got a hold of two admins passwords which happened to be incredibly insecure and decided to ban all
Nothing on CGs side was compromised.

If nothing was compromised, why are we being told to change our passwords?

It never hurts to do it and a lot of people do have incredibly insecure passwords.

Mind explaining what you mean by "broke in"?
I enjoy the specifics of things, and I think I ought to know what may/may not bring me issues

from what i heard no one changed the DB password since it was leaked 8 months ago, unless some of your admins are making up bull shit on the spot

admins are full of shit, not only did we change the password multiple times since then but its IP locked so it wouldn't matter

what really happened was a certain group of kiddies got a hold of two admins passwords which happened to be incredibly insecure and decided to ban all
Nothing on CGs side was compromised.

If nothing was compromised, why are we being told to change our passwords?

Using the SMF adminCP, assuming these admins had access to it, you can backup any sql table. And yes SMT, passwords are salted and hashed, but they can still be bruted.

Admins did not have access to it.

[Adam S]

Mind explaining what you mean by "broke in"?
I enjoy the specifics of things, and I think I ought to know what may/may not bring me issues

from what i heard no one changed the DB password since it was leaked 8 months ago, unless some of your admins are making up bull shit on the spot

what really happened was a certain group of kiddies got a hold of two admins passwords which happened to be incredibly insecure and decided to ban all
Nothing on CGs side was compromised.

My assumption was a lot of RTLK's scripts for handling bans were completely insecure and required no authentication, only a steamID.

If he actually followed the new developer guidelines instead of assuming he's above them, as usual, that wouldn't be a problem. It's most likely that it was a type of SQL injection.

Which one makes more sense? How could 2 admins out of the entire staff be the ones targeted.  Blt is not a idiot to have a easy password.  Acorn is also not that dumb.  The question is how they got ahold of them.  Someone77 made sense out of it but no one wants to make a confession.

[Martinerrr]

My assumption was a lot of RTLK's scripts for handling bans were completely insecure and required no authentication, only a steamID.

If he actually followed the new developer guidelines instead of assuming he's above them, as usual, that wouldn't be a problem. It's most likely that it was a type of SQL injection.

Which one makes more sense? How could 2 admins out of the entire staff be the ones targeted.  Blt is not a idiot to have a easy password.  Acorn is also not that dumb.  The question is how they got ahold of them.  Someone77 made sense out of it but no one wants to make a confession.

This was posted after the announcement was made, no response.

[smt]

And yes SMT, passwords are salted and hashed, but they can still be bruted.

assuming peoples password here are usually+ 6 characters and have numbers whatever, no one is going to waste a machine capable of bruting these hashes quicker than a year or two on cg (no offence xdia)

and ty for clearing things up rofl

[the.derp]

What happened is admins had insecure passwords (easy passwords and passwords that had not been changed in months) that got accessed by the wrong people and were then used to ban every user as well as break a SMF script and cause an error log to generate that caused the site to lag and become inaccessable.  It had nothing to do with any system or anything.  All possible things that could cause issues have been disabled for all but waffle and myself for the time being.  The error log has been fixed, and by changing passwords it will prevent accounts from being accessed.  Full access should be restored for admins by tomorrow unless another account is suspected of being accessed.

Both admins were demoted to prevent access, and (per waffle) Blt will be getting his back once the system is secure again.  Acorn will stay demoted due to inactivity.