Forum hacked on 8/31/04

[admin]

Re: Re: Forum hacked on 8/31/04

Originally posted by JohnSanford
Hello Max, We see that all of the massges that we have seen on this "Family Tree DNA Forum" from March 16, 2004, until August 31, 2004, have been lost.
What is the chance that SOME or ALL of those messages can be restored soon? It is a shame to lose them, as many of them were very good. Surely someone has saved copies of them in this last few months. Sincerely, John Sanford

Sorry to say that, but on our end they were lost. Last night we created a mirror sytem that won't allow this to happen again.

[JohnSanford]

Re: Forum hacked on 8/31/04

Hello Max, We see that all of the massges that we have seen on this "Family Tree DNA Forum" from March 16, 2004, until August 31, 2004, have been lost.
What is the chance that SOME or ALL of those messages can be restored soon? It is a shame to lose them, as many of them were very good. Surely someone has saved copies of them in this last few months. Sincerely, John Sanford

Originally posted by max
Dear Friends,

Today, 8/31/04, a hacker somehow got the specific Forum ID/password - - - - Even though we have a backup up of all the messages and Forum user ID's, in the upload process to recover the lost information, some of the data was lost.
- - - - We thank all our customers for all the support messages that we have received.

[B52]

This is the second instance of such a stolen password I have seen in the last month on a web site.

I saw hacked from Hungary last month. Here is what I was told are their favorite methods:


1. Hackers brute force the web site. They try thousands of username and
Password pairs until they get one that works. Basically guessing your
password. This is sometimes called a "dictionary" attack, as they try
variations of words in the dictionary.

2. Hackers hack successfully into a web site and "steal" a master username and password list.

Hackers combine the results of both 1 and 2 to make password lists that they trade and update regularly.

The third method is the most effective and the most insidious:

3. Hackers use their compiled password lists against thousands of web sites looking for hits -- successful logins.

More 'BigCorporation' accounts are compromised by method #3 than any other method.

I and a coworker personally ran a test using method 3 at my former employers using method 3 and managed to get user/password combination there.

For you really important accounts and non-important accounts too (if you don't want to suffer the embarrassment Max just did), we all need to start creating, using all available characters, account names and passwords that bear no resemblance to any word, name, or common used number.

Max's assailant was nothing more than a skript kiddie, not able to do anything more than regurgitate what he copied elsewhere. An intelligent person could have forged an electronic trail so convincing that no one would believe Max if he claimed it was forged no matter how out of character said activity was for Max.

As a real life example, I graduated and took loans from the University of Massachusetts according to the Credit Rating firms. The truth is I graduated and took loans from the University of Kentucky. This mistake (which still stands by the way) was caused by the incompetence of the Credit Rating firms and not a hacker (as far as I know!). But given the impossibility to hold companies accountable for such falsehoods or to even to able to reasonably force them to correct these falsehoods. You don't want a hacker stealing your identity. You will become and forever remain who their computers say you are.

Computers store what information you tell them to, it is impossible that a computer can be made secure.

[nyfromca]

please disable the above link, Yikes!!!!!!

[nyfromca]

Hi Max, I don't know if this is of any interest, but I received an e-mail from you address, "[email protected]"
The content of this e-mail refers me to a web-site:
0500.hala.cc/vfr.zip with HTTP: in the front.
the subject line
of the e-mail said "for yuo", and it was spelled that way : )

My Norton anti-virus picked it up immediately and removed it from my computer.
Hopefully everything will work out. Sorry to hear about the breach, shame on the miscreant!! Kathy

[admin]

Dear Friends,

Today, 8/31/04, a hacker somehow got the specific Forum ID/password that belonged to our dear partner and head of IT Jim Warren, who passed away from cancer last year.
The hacker entered the Forum Admin area, deleted part of the messages as well as a large number of users.
Even though we have a backup up of all the messages and Forum user ID's, in the upload process to recover the lost information, some of the data was lost.
The hacker also managed to replace our Forum home page with a large banner and message in Arabic.
While the IP that was traced to the hacker points to a ISP in Saudi Arabia, no conclusions can or should be reached at this time.
The FBI was notified and is investigating.
Since we have recently changed all our Admin ID's and passwords, and no other ID/password that belonged to Jim are valid or are in the system, there should be no concern of further damage.
We thank all our customers for all the support messages that we have received.