Feb 8, 2013 01:45 PM
(This post was last modified: Feb 8, 2013 02:06 PM by Omniscient.)
Orders Dump Latest Data (part 3)
This is a continuation thread of "Terrible News".
https://hackforums.net/showthread.php?tid=3235050 (part 1)
https://hackforums.net/showthread.php?tid=3235989 (part 2)
I've had a back and forth conversation with the person responsible for the penetration. While I loathe having to do this I feel it's in the best interest of the community. I've allowed him to have an open account (still subject to site policies), upgraded him to ub3r, and given him appropriate awards. In return he's agree to not publically dump the database.
What that means is most members for now might consider themselves safe. Currently I'm only aware of a small handful of members who have seen the dump. It's also common knowledge that the group Legion had all their members data released. So far there appears to be no known public release of the entire DB.
I'm hoping this move minimizes risk to members. It may allow them time to change anything they felt could be used against them. Things like email addresses or phone numbers. Note that I don't recommend you change your phone number unless harassment becomes a problem. You may consider changing your email on site like PP or your bank if you feel these can be used to steal accounts.
Members are still at risk of having their data sold or dumped public but I'm hoping the person lives up to the agreement by not releasing the dump public. He has unfortunately stated that he'll likely sell data from the dump one user at a time. In other words if you have an enemy. They might seek out this person to obtain your oder info. So please consider how that might effect you.
In an effort to add more security to this data I'm taking these steps:
1. Random domain at random registrar with random whois.
2. Random host which I currently don't use.
3. Random cloudflare account with random email address.
4. Encrypt the uid table in the database.
I assume that's enough layers that unless my home computer is compromised (always a possibility) that the data will be near impossible to gather.
While you would still order at Witza.com the notifications and the database will be somewhere obscure and hidden. And certain data would be encrypted. I don't claim this to be a 100% secure method but I honestly can't think of how I would strengthen it beyond these measures.
Once all this implemented I will announce it along with a coupon for upgrades. I may even step up and release the Pow3r group soon after.
I seriously thank the many members who have shown support towards HF and me personally. I was sure we would rebound from this but the great support the community has shown only proves to me that we are a very strong community.
Thanks to everyone.
This is a continuation thread of "Terrible News".
https://hackforums.net/showthread.php?tid=3235050 (part 1)
https://hackforums.net/showthread.php?tid=3235989 (part 2)
I've had a back and forth conversation with the person responsible for the penetration. While I loathe having to do this I feel it's in the best interest of the community. I've allowed him to have an open account (still subject to site policies), upgraded him to ub3r, and given him appropriate awards. In return he's agree to not publically dump the database.
What that means is most members for now might consider themselves safe. Currently I'm only aware of a small handful of members who have seen the dump. It's also common knowledge that the group Legion had all their members data released. So far there appears to be no known public release of the entire DB.
I'm hoping this move minimizes risk to members. It may allow them time to change anything they felt could be used against them. Things like email addresses or phone numbers. Note that I don't recommend you change your phone number unless harassment becomes a problem. You may consider changing your email on site like PP or your bank if you feel these can be used to steal accounts.
Members are still at risk of having their data sold or dumped public but I'm hoping the person lives up to the agreement by not releasing the dump public. He has unfortunately stated that he'll likely sell data from the dump one user at a time. In other words if you have an enemy. They might seek out this person to obtain your oder info. So please consider how that might effect you.
In an effort to add more security to this data I'm taking these steps:
1. Random domain at random registrar with random whois.
2. Random host which I currently don't use.
3. Random cloudflare account with random email address.
4. Encrypt the uid table in the database.
I assume that's enough layers that unless my home computer is compromised (always a possibility) that the data will be near impossible to gather.
While you would still order at Witza.com the notifications and the database will be somewhere obscure and hidden. And certain data would be encrypted. I don't claim this to be a 100% secure method but I honestly can't think of how I would strengthen it beyond these measures.
Once all this implemented I will announce it along with a coupon for upgrades. I may even step up and release the Pow3r group soon after.
I seriously thank the many members who have shown support towards HF and me personally. I was sure we would rebound from this but the great support the community has shown only proves to me that we are a very strong community.
Thanks to everyone.
![[Image: d9s7.png]](https://imagizer.imageshack.us/v2/647x200q90/268/d9s7.png)
![[Image: FDc8cTo.png]](https://i.imgur.com/FDc8cTo.png)
