FORUM ALERT--ALL MEMBERS PLEASE READ!!!

[motub]

The forums were hacked over the weekend.

The hacker downloaded all our passwords and may attempt to hack members, using their IP address, which is logged by the forums.

Please DO NOT change your pw at this time, as the system has not yet been totally cleaned, but DO change any passwords for other sites that may be the same as the one you used for the MURC.

Secure your PC from intrusion. Check your firewall logs, if you have a firewall, for attempted intrusion from the suspected IP address -- anything going back to a Telekabel.Chello.nl address (starts off with 212.187.xxx.xxx). If you find anything, email Ant and GA (at admin@gagames.com).

If you lost your PW because you changed it during the intrusion, email Ant.

And go to this thread in The Soap Box for the story.

---------------------------
Holly

[RickJansen]

May i remind you, that all those IPs are static, and there are _alot_ of dutch folks that have a 212.187.x.x address, just like i do.

[HollyBerri]

I understand that, Rick... but I don't think that "a lot of Dutch folks" would be showing up on my firewall logs, either, no matter what their IP address.

-------------------
Holly

[Rags]

Yah, and all of a sudden right at this time, when there were NONE before.

Rags



------------------
Partnership for an idiot free America

[Jorden]

Rick, the IP addresses aren't that static when used by a hacker wannabe, using a cable connection. Modem users might lose their IP address when reboot or re-attaching, I don't think that'll happen too quickly with a cable connection.

En je mag mij gerust in het Nederlands aanspreken. Yay! Weer een Nederlander...

Then again, how do we know you're not one of the notorious hackers??

Jord.

[DuRaNgO[MU]]

hmmmm

[Jorden]

I just read the Tweakers page of RickJansen, and boy, either Unexplained took your forums down as well, or you're in to it, somehow. I can't say I like the look of this Rick. I do hope you'll be able to give Ant some more info on the subject though.

Vuurwerk down as well, around the same time?? A DoS attack?? And that's coincidence??
Yeah Right !!

Jord.

[Greebe]

212.187.63.14 is Unexplained's IP addy and it is static. I have this addy on my BID logs too, but a tcp port scan does not make a hack attempt. I'm not trying to say what happened over the weekend was ok (which it was not!) but to calm the mass's from dissinformation I must.

[HollyBerri]

Yeah, Greebe, well tell that to dZeus.

You run BID, so all you got was a TCP port scan. Do you think that if you didn't have your firewall up, you would not have gotten more??

And you could still be 'fingered'(marked for later action).

I understand your call for calm, but just because you don't want us to overreact is no reason to <u>under</u>react.

I don't want any contacts from a known hacker in my firewall logs-- and these occurred during a time that he was known to be hacking a site that I was on. So if I have a contact, that means that a specific person (given his IP address) was after me, personally (since he got my IP from the server he was hacking at that time).

I love you, Greebe, but I'll be damned if I'll be "calm".

------------------------------
Holly

[Jorden]

So, the IP address is static. And a tcp port scan from any address 212.187.xxx.xxx is not a hacking attempt... like I said before, Pimmetje WAS NOT IN THIS ALONE !!!! He's got a whole bloody site up on the internet, with at least 6 other guys in the crewlist for that site... now just imagine that he called them and said, "Hey, I hacked into these forums, and these people with those IP addresses are bugging me, go get them!!" ???

As far as I can read on Tweakers.net, they downed the forums there as well. "They"? They, yes. And only because tweakers has multiple admins, were they on to it during the weekend.

Now I don't know how far Tweakers is a forum and site that lets hackers do these kinds of things, provoked or not, without going to the local police, but that he downloaded the passwords and memberfiles from their forum is as illegal as hell. (Wetboek van Strafrecht kijk maar eens in Computercriminaliteit II, Rick)

As far as I'm concerned, this joker stepped on my toes, someone tried to get on my turf, and I'm about to call Pauly and ask for those .45's

Jord.

[Kaj]

Jorden-> I can guarantee you that RickJansen is genuine, and has nothing to do with the hack.
Ofcourse, there is no way to make sure, this coming from a fellow Admin of Rick, but you'll just have to take our word for it.

I've been following the Hackthread, and I've had a little argument with Un about his course of action, because he did the same thing to us , as you've already noticed.

(Ja, klopt, nog een Nederlander, ik doe dit alleen in het Engels, zodat de anderen het ook kunnen lezen. )

[Jorden]

It's okay Kaj, I already took Rick for genuine, for I've snooped around Tweakers before this weekend
You saw the double winking smiley after what I said there

I just hope something will be done against this kid.

Btw, may I ask how come all Tweakers are all of a sudden visiting MURC?

(Voel jezelf welkom trouwens. Altijd goed om een medelotgenoot te ontmoeten )

Jord.

[GinoCyber]

"And you could still be 'fingered'....."

Wanna explain to me how you can be fingered? Providers close off the necessary finger port. Some schools leave it open because the're just stupid MCSE people trying to configure it.

And could someone explain to me how someone can hack into your pc without you having a trojan installed?

Yeah there are a few other ways of doing which require more intelligence but UN doesn't look to be too smart.

Ciao

[Rags]

Gino,

And could someone explain to me how someone can hack into your pc without you having a trojan installed?

Sure, one way is to install Norton Antivirus 2000, enable email protect, and bingo, port 110 is opened through their "POPproxy". If the individual knows how popproxy works, then it should be no biggie getting by. Symantec still hasn't fixed this flaw, even though they say they have patched it.

Rags




------------------
Partnership for an idiot free America

[GinoCyber]

LOL, that ain't too brite of them.

I wonder if this will allow anyone to see a netmeeting call going on on the victim's comp

I was going more towards the netbios thingy

Ciao