Advertisement:
« previous next »
Pages: 1 ... 3 4 [5] 6 7 ... 27   Go Down

Author Topic: IMPORTANT: Community security breach  (Read 2052393 times)

Offline Kindred

  • The Mean One
  • Support Specialist
  • SMF Legend
  • *
  • Posts: 58,710
  • Gender: Male
    • Kindred-999 on GitHub
Re: IMPORTANT: Community security breach
« Reply #80 on: July 23, 2013, 03:43:17 PM »
SimpleSite...

Maybe so... but the point is: we used the internal announcement/mailing system.
To do anything else would have required more delays while we built a mailer to target everyone.

Groovy,

Excuse me? The entire community got informed (as per this announcment) as soon as we had concrete data about what happened, how it happened and what was potentially compromised. Why would we have sent you a special one-off message before we knew enough to make an official notification to everyone?
Logged
Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

Offline xrunner

  • Sophist Member
  • *****
  • Posts: 1,019
  • Gender: Male
  • Karma +584/-1
Re: IMPORTANT: Community security breach
« Reply #81 on: July 23, 2013, 03:44:27 PM »
Since this is theft I assume it's been reported to the authorities?
Logged

Offline wynnyelle

  • SMF Hero
  • ******
  • Posts: 2,569
    • Warrior Cats RPG
Re: IMPORTANT: Community security breach
« Reply #82 on: July 23, 2013, 03:44:34 PM »
So there was no period of time when it was known but the knowledge wasn't divulged?

I'm sorry, then, my bad.
Logged

Offline Trekkie101

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 8,157
  • Gender: Male
  • Ad Astra!
    • https://www.facebook.com/DLRPRoundup on Facebook
    • @dlrproundup on Twitter
    • DLRP Roundup
Re: IMPORTANT: Community security breach
« Reply #83 on: July 23, 2013, 03:47:16 PM »
Quote from: Groovystar on July 23, 2013, 03:41:13 PM
...You guys knew about this hours before you chose to tell me? I could have changed everything pass word wise long before this, then?

All you had to do was let me know there might have been a security issue and to change my passes. I would've just gone and done it, it would've been that easy.

The problem with notifying immediately is that the exploit may have still been live. We had to find the hole and figure out if it could be reused, or if there was anything left behind. If we notified immediately, changing your password could have been ineffective.

I promise you, this was dealt with as fast as it could be.
Logged

Offline wynnyelle

  • SMF Hero
  • ******
  • Posts: 2,569
    • Warrior Cats RPG
Re: IMPORTANT: Community security breach
« Reply #84 on: July 23, 2013, 03:47:42 PM »
I see. Thank you for explaining.
Logged

Offline Deaks

  • SMF Friend
  • SMF Super Hero
  • *
  • Posts: 22,183
  • Gender: Male
    • pouvik on GitHub
Re: IMPORTANT: Community security breach
« Reply #85 on: July 23, 2013, 03:47:51 PM »
xrunner: we are looking into it
Logged

Offline Kindred

  • The Mean One
  • Support Specialist
  • SMF Legend
  • *
  • Posts: 58,710
  • Gender: Male
    • Kindred-999 on GitHub
Re: IMPORTANT: Community security breach
« Reply #86 on: July 23, 2013, 03:50:55 PM »
groovy,

Why would we have held off on the announcement?
As I have already said:
We were informed that there had been a breach.
We investigated said report using the logs and investigating files and database details.
We confirmed that the breach was NOT due to a flaw in SMF (which was our biggest concern)
We cleaned up the crap payloads...
We confirmed what was the most likely target data
We composed a message that told the details
We proofread said message (not closely enough, of course, since there are several mistakes that we have ben quietly fixing. :) )
We sent said message.

Frizzle is a just a drama-monger

Quite honestly - a 16 hour turn around for a notification like this is nothing short of stellar activity on the part of our Server Guy!


xrunner - we are investigating our options for reporting this.


edit - ninjad in both responses. :)
Logged
Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

Offline Simple Site Designs

  • Jr. Member
  • **
  • Posts: 100
  • Gender: Male
    • Simple Site Designs
Re: IMPORTANT: Community security breach
« Reply #87 on: July 23, 2013, 03:57:57 PM »
Quote from: Kindred on July 23, 2013, 03:43:17 PM
SimpleSite...

Maybe so... but the point is: we used the internal announcement/mailing system.
To do anything else would have required more delays while we built a mailer to target everyone.

Understood. For the record, I'm not questioning the way this is being handled. I always have, and continue to have the upmost respect for the smf team. It's just unfortunately something that can happen.
Logged

kat

  • Guest
Re: IMPORTANT: Community security breach
« Reply #88 on: July 23, 2013, 04:00:42 PM »
Even Microsoft got hacked, a while back. They copped a virus, too.

No website is 100% secure, unfortunately.
Logged

Offline walker

  • Semi-Newbie
  • *
  • Posts: 29
    • Occasion to be...
Re: IMPORTANT: Community security breach
« Reply #89 on: July 23, 2013, 04:23:21 PM »
Thanks for the heads up. why this childish bull is glorified by some folks is beyond me.
Logged

Offline FrizzleFried

  • Drama-Monger
  • Sr. Member
  • ****
  • Posts: 757
Re: IMPORTANT: Community security breach
« Reply #90 on: July 23, 2013, 04:24:31 PM »
Quote from: Kindred on July 23, 2013, 03:17:06 PM
So, yes, we took a few hours to examine the logs, to figure out what happened, to confirm that the breach was NOT a flaw in the SMF software and to get a handle on what we expect was the hacker's priority information to acquire.

Emphasis mine.  If being a "DRAMA MONGER" means pointing out when someone in power is attempting to blow smoke up our skirts,  GUILTY AS CHARGED.  16+ hours is NOT "a few hours" no matter how you look at it.  Had you been FORTHRIGHT from the get-go and posted something to the effect of "Yesterday at X:XX" or even "approximately 16 hours ago",  this DRAMA-MONGER wouldn't have to point out these things.
Logged

kat

  • Guest
Re: IMPORTANT: Community security breach
« Reply #91 on: July 23, 2013, 04:29:37 PM »
Friz, please... What's done is done.

If you disagree with what was done, fine. But, carping about it isn't going to change things.

The powers that be took what they considered to be the correct actions at the correct times.

You, obviously, disagree. Others don't.

No point in carping-on about it, here, now, is there?

Things may not have been mentioned, for obvious reasons. Things that may well have caused, or been instrumental in, that delay.

Let it go, willya? Please?
Logged

Offline wynnyelle

  • SMF Hero
  • ******
  • Posts: 2,569
    • Warrior Cats RPG
Re: IMPORTANT: Community security breach
« Reply #92 on: July 23, 2013, 04:30:00 PM »
It was going on for 16+ hours?

I could've at least changed my own site's information, though I think we already changed everything recently enough.

I have no site right now. My site went down over an hour and a half ago.
Logged

Offline Herman's Mixen

  • SMF Hero
  • ******
  • Posts: 7,257
    • HermanMixen on Facebook
    • @Hermans_Mixen on Twitter
    • Herman's Mixen
Re: IMPORTANT: Community security breach
« Reply #93 on: July 23, 2013, 04:32:15 PM »
This is an global anouncement, as we are in many different timezones .

diggin' the log files is a pretty time consuming job !!
Logged
Met vriendelijke groet, The Burglar!

 House Mixes | Mixcloud | Any Intelligent fool can make things bigger, more complex, and more violent.
It takes a touch of genius - and a lot of courage - to move in the opposite direction. - Albert Einstein

Former Godfather of our dutch community ;)

Offline wynnyelle

  • SMF Hero
  • ******
  • Posts: 2,569
    • Warrior Cats RPG
Re: IMPORTANT: Community security breach
« Reply #94 on: July 23, 2013, 04:33:16 PM »
I'm terrified that my site was destroyed and won't ever be coming back. It went down about an hour and a half after the announcement was made.
Logged

Offline Zirkon

  • Semi-Newbie
  • *
  • Posts: 95
Re: IMPORTANT: Community security breach
« Reply #95 on: July 23, 2013, 04:35:33 PM »
Same here, both my sites are down. The Graywebhost front site is down too. No replies from CoreISP or notification as to what is going on.
Logged

kat

  • Guest
Re: IMPORTANT: Community security breach
« Reply #96 on: July 23, 2013, 04:36:33 PM »
I suspect Core's VERY busy, at the moment.
Logged

kat

  • Guest
Re: IMPORTANT: Community security breach
« Reply #97 on: July 23, 2013, 04:41:53 PM »
I'm on your site, as I type, Groovy.

Liroy's good. But, even he can't be in two places at the same time. ;)
Logged

Offline wynnyelle

  • SMF Hero
  • ******
  • Posts: 2,569
    • Warrior Cats RPG
Re: IMPORTANT: Community security breach
« Reply #98 on: July 23, 2013, 04:43:07 PM »
Sure he can, he's a hosting god.
Logged

Offline Colin

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 7,879
  • Gender: Male
  • SMF Developer
    • colinschoen on GitHub
Re: IMPORTANT: Community security breach
« Reply #99 on: July 23, 2013, 04:43:40 PM »
It looks just fine from over here, too.
Logged
"If everybody is thinking alike, then somebody is not thinking." - Gen. George S. Patton Jr.

Colin
Pages: 1 ... 3 4 [5] 6 7 ... 27   Go Up
« previous next »