+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: Terrible News (continuation part 3) (/showthread.php?tid=3242369)
Terrible News (continuation part 3) - Omniscient - Feb 8, 2013
Orders Dump Latest Data (part 3)
This is a continuation thread of "Terrible News".
https://hackforums.net/showthread.php?tid=3235050 (part 1)
https://hackforums.net/showthread.php?tid=3235989 (part 2)
I've had a back and forth conversation with the person responsible for the penetration. While I loathe having to do this I feel it's in the best interest of the community. I've allowed him to have an open account (still subject to site policies), upgraded him to ub3r, and given him appropriate awards. In return he's agree to not publically dump the database.
What that means is most members for now might consider themselves safe. Currently I'm only aware of a small handful of members who have seen the dump. It's also common knowledge that the group Legion had all their members data released. So far there appears to be no known public release of the entire DB.
I'm hoping this move minimizes risk to members. It may allow them time to change anything they felt could be used against them. Things like email addresses or phone numbers. Note that I don't recommend you change your phone number unless harassment becomes a problem. You may consider changing your email on site like PP or your bank if you feel these can be used to steal accounts.
Members are still at risk of having their data sold or dumped public but I'm hoping the person lives up to the agreement by not releasing the dump public. He has unfortunately stated that he'll likely sell data from the dump one user at a time. In other words if you have an enemy. They might seek out this person to obtain your oder info. So please consider how that might effect you.
In an effort to add more security to this data I'm taking these steps:
1. Random domain at random registrar with random whois.
2. Random host which I currently don't use.
3. Random cloudflare account with random email address.
4. Encrypt the uid table in the database.
I assume that's enough layers that unless my home computer is compromised (always a possibility) that the data will be near impossible to gather.
While you would still order at Witza.com the notifications and the database will be somewhere obscure and hidden. And certain data would be encrypted. I don't claim this to be a 100% secure method but I honestly can't think of how I would strengthen it beyond these measures.
Once all this implemented I will announce it along with a coupon for upgrades. I may even step up and release the Pow3r group soon after.
I seriously thank the many members who have shown support towards HF and me personally. I was sure we would rebound from this but the great support the community has shown only proves to me that we are a very strong community.
Thanks to everyone.
* - Grizz - Feb 8, 2013
Glad to see you'll be encrypting UID tables. Hopefully that will be the last time something like this happens. 🤝
* - ๖ۣۜMind_๖ۣۜControl™ - Feb 8, 2013
Thank YOU, Omni.
Shit like this happens, but you honestly know how to take care of it.
Pow3r group :3
* - StarCraft 2 - Feb 8, 2013
Omni thanks for securing us thannks man
* - Zain - Feb 8, 2013
Glad you decided to be the bigger man and do this for the sake of the users. Hopefully he lives up to his end of the agreement.
* - PowerzGFX - Feb 8, 2013
Can we ask this but, who was the hacker?
- Powerz
* - Leafs - Feb 8, 2013
Yikes, just read all those. I didn't see them till today.
* - Polarity - Feb 8, 2013
Omni! I found a grammar error in your post. :p
"So far there appears to be know known public release of the entire DB. "
* - #YOLO - Feb 8, 2013
What was the user name of the hacker? If you don't mind saying.
* - SoulZeh - Feb 8, 2013
Quote:"I've had a back and forth conversation with the person responsible for the penetration. While I loathe having to do this I feel it's in the best interest of the community. I've allowed him to have an open account (still subject to site policies), upgraded him to ub3r, and given him appropriate awards. In return he's agree to not publically dump the database"
What if something happens and he does publicly dump the database? After you doing this for him or is that a risk you're going to take.
* - C A R L O S - Feb 8, 2013
Its pretty obvious who it is...
https://hackforums.net/member.php?action=profile&uid=1664159
* - CrashedStar1337 - Feb 8, 2013
(Feb 8, 2013 01:48 PM)PowerzGFX Wrote: Can we ask this but, who was the hacker?
- Powerz
He was a person of what seems to be quite above normal intelligence.
* - ЯѲβ ӍѲβ - Feb 8, 2013
Wow so he penetrates the security of the site that you do not allow or condone blackhat activity and you award him for it , I am sure the members are in safe hands.Most likely its a another agent friend.
* - not gay - Feb 8, 2013
cool, i guess.
to be honest, i don't know why this wasn't done before.
and i'm assuming we aren't allowed to know who the person is?
because he could just continue on with his account, and become known as a safe member.
wow. C A R L O S found out who it was.
that was fast.
* - CrashedStar1337 - Feb 8, 2013
(Feb 8, 2013 01:50 PM)ЯѲβ ӍѲβ Wrote: Wow so he penetrates the security of the site that you do not allow or condone blackhat activity and you award him for it , I am sure the members are in safe hands.Most likely its a another agent friend.
From the exchanges I've had with him, he doesn't seem like a fed.