Jun 26, 2011 12:07 PM
(This post was last modified: Jun 26, 2011 12:59 PM by Omniscient.)
1. Lulz Sec did not compromise our DB. They only put it in their torrent which made it very popular as a download.
2. DB was compromised via a shell on Feb 19, 2011. I know who did it and I know how they did it. The exploit is fixed. The people who actually did shell us have never claimed responsibility in public and I don't name names.
3. Recent downtime from DDOS attacks are from a few parties but overall the downtimes were in part because of network problems related to changes in our setup. Not to say we can't be taken down but not all downtimes are because of significant attacks.
4. The question some ask is why didn't I do a full password reset when I found out the DB was leaked. It's a good question. At the time I felt MOST accounts were secured and I wanted to figure out some good methods to deal with a situation like this. I'm extremely busy all the time. I knew the best solution was a full scale password reset like we have now. So in the end it didn't matter if I reset all PW's then or now. Eventually it had to be done. Do I wish I did it before? Not really. I personally don't think it matters too much. In the end I had to do this anyways and accounts are not lost.
5. People are asking if their info is secured. The short answer is no. The DB contained your registration IP, last active IP (from feb 19), email, usernotes, and password hash. If any of that data being exposed represents a security risk to you then take appropriate measures.
6. Recent accounts signed up after Feb 19 are secure. They are not compromised. I believe it's around uid 687,123 (confirmed). So if you have a uid after that you're fine.
7. This is not the end or downfall of HF. It's a disruption. That's it. All upgraded accounts are secured and currently being recovered. Many inactive accounts have been placed into DEAD group. Many other passwords even on regular accounts were force changed. We get attacks, downtimes, and even get hacked every now and again. It happens. We're a huge target. My promise to you is that HF will always come back online. Activity on the site today is just as good as it was a week ago. For most it's business as usual and for others they are just waiting to regain account access.
Anyone spreading rumors or talking shit risk earning my wrath. I'm in no mood and way too busy for any crap. I have things to do but I needed to make this post because I'm getting all types of stupid PMs and emails. Just let me do my work please.
2. DB was compromised via a shell on Feb 19, 2011. I know who did it and I know how they did it. The exploit is fixed. The people who actually did shell us have never claimed responsibility in public and I don't name names.
3. Recent downtime from DDOS attacks are from a few parties but overall the downtimes were in part because of network problems related to changes in our setup. Not to say we can't be taken down but not all downtimes are because of significant attacks.
4. The question some ask is why didn't I do a full password reset when I found out the DB was leaked. It's a good question. At the time I felt MOST accounts were secured and I wanted to figure out some good methods to deal with a situation like this. I'm extremely busy all the time. I knew the best solution was a full scale password reset like we have now. So in the end it didn't matter if I reset all PW's then or now. Eventually it had to be done. Do I wish I did it before? Not really. I personally don't think it matters too much. In the end I had to do this anyways and accounts are not lost.
5. People are asking if their info is secured. The short answer is no. The DB contained your registration IP, last active IP (from feb 19), email, usernotes, and password hash. If any of that data being exposed represents a security risk to you then take appropriate measures.
6. Recent accounts signed up after Feb 19 are secure. They are not compromised. I believe it's around uid 687,123 (confirmed). So if you have a uid after that you're fine.
7. This is not the end or downfall of HF. It's a disruption. That's it. All upgraded accounts are secured and currently being recovered. Many inactive accounts have been placed into DEAD group. Many other passwords even on regular accounts were force changed. We get attacks, downtimes, and even get hacked every now and again. It happens. We're a huge target. My promise to you is that HF will always come back online. Activity on the site today is just as good as it was a week ago. For most it's business as usual and for others they are just waiting to regain account access.
Anyone spreading rumors or talking shit risk earning my wrath. I'm in no mood and way too busy for any crap. I have things to do but I needed to make this post because I'm getting all types of stupid PMs and emails. Just let me do my work please.
![[Image: KQ5rs.png]](https://i.imgur.com/KQ5rs.png)
