About the recent attack - page 4. | Bitcointalksearch.org

ErebusBat

hero member

Activity: 560

Merit: 500

I am the one who knocks

Quote from: tspacepilot on October 07, 2013, 02:38:12 PM

Quote from: Fiyasko on October 07, 2013, 08:49:46 AM

In the reddit thread...
[snip]

Theymos says it was someone from SA, How does he know that? If he KNOWS who it was, why not tell us all?

[snip]

What's SA?

Something Awful, often abbreviated to SA, is a comedy website housing a variety of content, including blog entries, forums, feature articles, digitally edited pictures, and humorous media reviews.

tspacepilot

legendary

Activity: 1456

Merit: 1076

I may write code in exchange for bitcoins.

Quote from: Fiyasko on October 07, 2013, 08:49:46 AM

In the reddit thread...
[snip]

Theymos says it was someone from SA, How does he know that? If he KNOWS who it was, why not tell us all?

[snip]

What's SA?

tysat

legendary

Activity: 966

Merit: 1004

Keep it real

Quote from: deslok on October 07, 2013, 01:52:21 PM

that's funny, I used to be a hero member with something on the order of 1500 posts, i guess i've been reduced in rank for not liking ads?

Your rank is different because it's based off of activity now instead of post count. Been like this for almost 4 months, see https://bitcointalksearch.org/topic/activity-new-membergroup-limits-237597

deslok

sr. member

Activity: 462

Merit: 250

It's all about the game, and how you play it

Quote from: malevolent on October 07, 2013, 01:12:42 PM

Quote from: deslok on October 07, 2013, 11:33:21 AM

You mean you've taken this opportunity to force ads on all of us(which are disabled by the actual SMF default theme) by defaulting to your custom theme.

Once you become a Hero Member in two weeks max, you'll be able to disable the ads in the profile settings.

https://bitcointalksearch.org/user/deslok-23737
and scroll down to "Disable ads".

I personally have them enabled, compared with other websites' solutions the ones here are rather unintrusive.

By keeping them disabled you also miss some of the interesting quotes:
https://bitcointalk.org/adrotate.php?adinfo

that's funny, I used to be a hero member with something on the order of 1500 posts, i guess i've been reduced in rank for not liking ads?(the other layout also included a few things not shown with the bitcointalk one that were nice to have on occasion) back on topic i'm glad the forum is back at least

malevolent

legendary

Activity: 3472

Merit: 1721

Quote from: deslok on October 07, 2013, 11:33:21 AM

You mean you've taken this opportunity to force ads on all of us(which are disabled by the actual SMF default theme) by defaulting to your custom theme.

Once you become a Hero Member in two weeks max, you'll be able to disable the ads in the profile settings.

https://bitcointalksearch.org/user/deslok-23737
and scroll down to "Disable ads".

I personally have them enabled, compared with other websites' solutions the ones here are rather unintrusive.

By keeping them disabled you also miss some of the interesting quotes:
https://bitcointalk.org/adrotate.php?adinfo

TravisE

full member

Activity: 121

Merit: 100

Good to see it back up!

I'm trying to change my password, but it's confusing because whenever I log in, make changes, etc., I just get a completely blank page, so it's hard to know if it was even successful. Does this happen to anyone else or is it just my browser?

dragonkid

member

Activity: 84

Merit: 10

Quote from: ?? on ??

Some things that should be done (but probably won't be done because Theymos would have to spend some of the money he collected)

-Use a reverse proxy service such as Cloudflare or Akami
-Run vulnerability scanners against the site such as HP web inspect.
-Develop a living risk matrix and list the mitigation steps for each vulnerability.
-Hire a company to do penetration testing.

Posting the code is not a good idea since it would be only for this site and it would not be an "open source" project. It would be someone looking to get something for free when they should pay an expert.

Web Inspect is rubbish, since you recommend hiring Pen Tester. It works out cheaper just using Pen Tester then getting Web Inspect.

Also consider using Tripwire, so you know when the code has been modified.

greyhawk

hero member

Activity: 938

Merit: 1009

Quote from: deslok on October 07, 2013, 11:33:21 AM

Quote from: theymos on October 07, 2013, 01:18:33 AM

The forum is now on a new server inside of a virtual machine with many extra security precautions which will hopefully provide some security in depth in case there are more exploits or backdoors. Also, I have disabled much SMF functionality to provide less attack surface. In particular, non-default themes are disabled for now.

You mean you've taken this opportunity to force ads on all of us(which are disabled by the actual SMF default theme) by defaulting to your custom theme.

You need to see the ads. The forums need money to upgrade their security.

deslok

sr. member

Activity: 462

Merit: 250

It's all about the game, and how you play it

Quote from: theymos on October 07, 2013, 01:18:33 AM

The forum is now on a new server inside of a virtual machine with many extra security precautions which will hopefully provide some security in depth in case there are more exploits or backdoors. Also, I have disabled much SMF functionality to provide less attack surface. In particular, non-default themes are disabled for now.

You mean you've taken this opportunity to force ads on all of us(which are disabled by the actual SMF default theme) by defaulting to your custom theme.

zeeshanblc

sr. member

Activity: 390

Merit: 250

Thanks Admin, Glad to see this forum is back again.

surebet

hero member

Activity: 495

Merit: 507

Cloudflare was identified on our end as well.

theymos

administrator

Activity: 5166

Merit: 12850

Quote from: phelix on October 07, 2013, 08:43:10 AM

It is somewhat scary that admins can modify forum code from within the forum itself if I understand correctly.

That's how Satoshi set it up (maybe the SMF default), but I fixed it a while ago.

surebet

hero member

Activity: 495

Merit: 507

Quote from: Fiyasko on October 07, 2013, 08:49:46 AM

In the reddit thread...

Theymos says it was someone from SA, How does he know that? If he KNOWS who it was, why not tell us all?

Because all the "zOMG FBI ARE WATCHING!!!" threads amuse him?

Fiyasko

legendary

Activity: 1428

Merit: 1001

Okey Dokey Lokey

In the reddit thread...

Theymos says it was someone from SA, How does he know that? If he KNOWS who it was, why not tell us all?

Aside from that little peice of wonder, IM HAPPY THE FORUMS ARE BACK! Grin

surebet

hero member

Activity: 495

Merit: 507

Quote from: btceic on October 07, 2013, 06:23:59 AM

Any idea what this is about?

http://www.reddit.com/r/Bitcoin/comments/1nw4py/something_awful_forums_admit_responsibility_for/

I guess it means you guys shouldn't only screen cap the gibbis thread.

In case anyone missed it, here's a backup of the assets of the hack.

http://crymore.com/btc/

I guess I should mention that I didn't do it.

phelix

legendary

Activity: 1708

Merit: 1019

Bounties for reporting future vulnerabilities would be nice.

It is somewhat scary that admins can modify forum code from within the forum itself if I understand correctly.

stylesuxx

newbie

Activity: 14

Merit: 0

Quote from: ?? on ??

Attackers never really get anything out of their efforts in the end.

Mhhh,... the only ones to know what they got are the attackers, I guess.
To say that they did not get anything is just speculation.

aigeezer

legendary

Activity: 1450

Merit: 1013

Cryptanalyst castrated by his government, 1952

Great to see the site back up. While it was down there was a lot of media mischief to the effect that "BTC is dead and will never recover". (I won't dignify the FUD with sample links). With that in mind, for "next time", I'd suggest putting up a brb splash page of some kind during an outage. This time people could go to reddit if they knew how, but otherwise were left in the dark to be spun by the FUDsters.

Also, given the nature of some of the spin out there, is there an informed "official" position on the (lack of?) correlation between the forum attack and the SR takedown? Is there an "official" position on the absence of a major BTC price crash during the dark period?

b!z

legendary

Activity: 1582

Merit: 1010

Thank you for the information, theymos. I'm glad the forum is back.

simonk83

hero member

Activity: 798

Merit: 1000

If only all those thousands of dollars in donations had actually been put to purpose hey Roll Eyes

Topic: About the recent attack - page 4. (Read 13991 times)