The Hack . . and the Aftermath

[Broli]

Well, this is a good example
of how our club is not ready to handle situations as they arrise,

this is no ones fault!
but that doesn\'t mean we shouldn\'t take the time to learn from this and
get things better organized, should we need to deal with this sort of thing again
or even something different!


1. We need to expidite the board relocation, to a more secure form
2. We need to address the cause of this problem, if necessary we may need to move to a religon free
board
3. We need to have some way to stay in contact with members when this occurs, an email list should
be had for all members, updated weekly, and should be given to a few key memebers to hold, for
contacting members
4. We need to have a core crew of members who can act in this sort of situation to quickly and
efficiently get things working again, or handle whatever problem arrises, ideally it would be
executive, so for now that is TM3 and Xenon.
5. I am probably gonna use this an excuse to start the restructuring debate again. there is no
reason to not have a commitee, be it only an emergency committe, that has the ability to act in
these sorts of circumstancs.


well thats it for now, but we need to get out stuffs in order! so that this sort of thing doesn\'t happen again!!

[majic]

Originally posted by Broli

2. We need to address the cause of this problem, if necessary we may need to move to a religon free
board



LOL!!!!! LMAO!!!!!!!

hackers do it for FUN (most of the time) and as a challenge.. i\'m sure that a few comments made by yours truly ;) did not offend them and make them want to take out TM3.. oh the horror..

they probably targeted old releases of OBB and since it\'s not being maintained it\'s easy to exploit..

besides.. we shouldn\'t make this board agnostic or atheist.. that\'s the beauty of canada and freedom of speech.. how else do you think you\'re allowed to talk ;)

[Broli]

lol

i wasn\'t talking about you!

asshat!


I hope that the attack was simply on easy targets
and not spirited by things on the board

i was wondering how someone would have seen this what was on our boards, i mean it would have been
quite a coincidence for them to come across it by fluke, therefore

it seems more probably that

1. your right majic and it was just tageting us because we have no security
2. some sort of inside, job, which seems rather unlikely,



but 1. seems more probable!!

[majic]

Originally posted by Broli


it seems more probably that

1. your right majic and it was just tageting us because we have no security
2. some sort of inside, job, which seems rather unlikely,



but 1. seems more probable!!




perhaps.. :D

[Broli]

here is a top post for ya!

now, i am sure that there is another options . . .
the hackers were some noobs that got majoogled and they came back for revenge!!!

lol





Originally posted by majic



Originally posted by Broli


it seems more probably that

1. your right majic and it was just tageting us because we have no security
2. some sort of inside, job, which seems rather unlikely,



but 1. seems more probable!!




perhaps.. :D:p :p

[TheProfessor]

Do we actually know for certain that the board was hacked, or is that speculation?

[Broli]

we know now

the board was hacked
not directly
but rather because the server we were on
got hacked because of security flaws!

[justin]

Allow me to throw in my 2 cents.

As far as moving to a religion free board, **** THAT. That has nothing to do with it.

The cause of the problem is some dickweed with a bone to pick with Israel decided to hack our server and post some pro-Hezbollah crap. Plain and simple. Believe me, it happens all the time and unfortunately, it happened to us. Hell, in one week I got stared at, and accused of being a terrorist all because I\'m Jewish and because Israel is alledgedly killing innocent civilians. Again, **** THAT is what I say. And to end this part, I find it funny that these terrorist idiots can talk shit to a camera, but when the bombs drop, they go hide in holes like the cowards they are.

However, this post has nothing to do with any of that. That debate can be raged somewhere else, at some other time.

It has everything to do with what I think should happen.

We should start looking into converting everything over to phpbb, which is far more secure than OpenBB. I\'ve been using phpBB for years now, and it is, by a landslide, much better than what we have right now. We might lose profiles, posts, etc. We might not. If we do, then, well, c\'est la vie.

I\'d like to drop my hat into the ring to volunteer with getting the forum setup again, from installation to configuration to migrating as much as data as possible from the old to the new.

However, Broli has it right when he said:

1. We need to expidite the board relocation, to a more secure form
2. We need to address the cause of this problem, if necessary we may need to move to a religon free
board
3. We need to have some way to stay in contact with members when this occurs, an email list should
be had for all members, updated weekly, and should be given to a few key memebers to hold, for
contacting members
4. We need to have a core crew of members who can act in this sort of situation to quickly and
efficiently get things working again, or handle whatever problem arrises, ideally it would be
executive, so for now that is TM3 and Xenon.
5. I am probably gonna use this an excuse to start the restructuring debate again. there is no
reason to not have a commitee, be it only an emergency committe, that has the ability to act in
these sorts of circumstancs.

I\'d like to, if that\'s ok with everyone (don\'t want to step on any toes) volunteer for this emergency committee in the off chance that someone does manage to figure out how to hack phpBB (a miraculous feat at best) and we end up getting farked again.

Phew... there... I think I\'ve said everything I need to. :)

[Xerox]

I work at a web hosting co. so I\'ve seen stuff like this before.
Political messages are often seen on hacked sites.
This is not necessarily a direct target on TM3.
The entire server could have been breached. (I assume this site is hosted on a shared environment) if permissions are set poorly on the server, all you need is a breach in one site to take over the entire server and all other sites on it. They usually replace common start files like index and default with the hacked page. If permissions were set correctly on the server, even if one site was breached it would not have spread to other sites.

Where\'s this site hosted anyway? Is it GNAX (Global Net Access)?
I\'m surprised these guys are taking this long to restore the server.

My ass would be fired if I took this long to restore a server.

[justin]

Ok... so how long are we going to have to wait until we can get our forums back?

This is not rocket science getting it back. All that needs to happen is that part of the control of this community is given to a web savvy person to fix the problem. Takes 30 seconds to do.

[S.F.W.]

well, we are back now. But soon \"our\" forum will be better than ever;)

[TM3]

Hey, we\'re back everyone...
Sorry, not sure why it took so long, but here\'s the low down.

The entire server was hacked and this was in no way directed to TM3. Only main page content was fully comprimised... meaning, files that began with index, default, etc which normally points to a home page was lost permenantly and was not able to be restored by the host. So, the rest of our content is safe which is a very positive thing...

I didn\'t read this whole thread regarding all the suggestions yet, but we do for sure plan on migrating to phpBB. But converting will take lots of time and preparations.

[Mica3SGT]

Not having TM3 forums available was a minor inconvenience but has served to point out the weaknesses in the present setup. The political message crap was unfortunate - clearly those responsible have no concept on what it takes to make a meaningful contribution to this planet.

This was a criminal attack as it is for anyone to impose or deprive others of freedom to choose or to spread hatred amongst our species. Regardless of political or religious beliefs, this action cannot be condoned or excused. Find them, seek them out and remove this ability to disrupt our lives in the future wherever it is found.

You know what has to be done - make the right choices. History teaches us the implications of actions taken. Learn from it or it will be repeated.

[TM3]

I really hope you guys didn\'t go on that much withdrawl haha

1. We need to expidite the board relocation, to a more secure form

There is no guarantee that any other hosts are more secure. Although there are better ones for sure that would have issues like this resolved real quick. It wasn\'t a matter of the forum software having poor security.

2. We need to address the cause of this problem, if necessary we may need to move to a religon free
board

?? then we need to move to a religion free world... or web... the hacked material was not directed at us

3. We need to have some way to stay in contact with members when this occurs, an email list should
be had for all members, updated weekly, and should be given to a few key memebers to hold, for
contacting members

Agreed

4. We need to have a core crew of members who can act in this sort of situation to quickly and
efficiently get things working again, or handle whatever problem arrises, ideally it would be
executive, so for now that is TM3 and Xenon.

I\'m open.

5. I am probably gonna use this an excuse to start the restructuring debate again. there is no
reason to not have a commitee, be it only an emergency committe, that has the ability to act in
these sorts of circumstancs.

Depends on how serious everyone takes it and how involved they want to be. I have nothing against structuring the club.

[Broli]

originally i assumed based on the content that this was a religious attack
but it had nothing to do with our boards and its content

strike that part from what i said!

TM3
what can we do to help with the switch

1. how much money do we need to raise?
2. do you need help, if so, how many people,
maybe you could take a lead role and have some delgate helpers?





3. structuring the club, just a few members who will step up to plan for emergencies, or
inconviences. basically, anyone who wants, i know alot of people are against structuring the
club, but we have a big club, and big turnouts, look at MOM over 40 cars, we are not so little
compared to the protege club, it might be ok to start getting thing planed, not necesarrily
acted upon, but planned - there is no reason to not be prepared, it doesn\'t have to change
anything, TM3 will still be head admin, Xenon will still be president, but you guys will be
expected to act in your roles, and a few other members will be involved in planning for the club
in cases of emergencies, in planning for the future of the club, and all that jazz, doesn have
to be structured, how about just a voluntary exec committee that meets once ever month or 2 to
discuss and plan things!


we dont need positions and stuff, we can decide what needs to be done at these meetings and people can volunteer to do it for now. this should suffice for now

does that sound more balance and reasonable to everyone??

and this is how i break the even 5000, damnit . . .
lol
i was tempted to start a new account!
lol


:p

[3GFX]

There is no need to switch boards, come on Alex. Security can be breached on any website, forum or server. If a hacker wants in, he/she will get in.

I for one am very happy with this forum, its setup and its people. I see absolutly no reason to start a new forum, or switch from openBB.

After 3 business days of downtime, I see no reason to complain. The site was down, no biggie. 3 days is nothing. AND if this every happens again, which probably won\'t, it will most likely take less than 3 days.

In conclusion, LEAVE TM3 ALONE!!!

Over a 1000 members like it the way it is, and I\'m sure the majority of regular posters in the top 50 wouldn\'t change it.

My two cents.

[Cardinal Fang]

Although you can\'t prevent an attack from a determined hacker I do think the board should be converted to a better discussion board software like vbulletin.

[3GFX]

why though?...someone please give e a few reasons why a different forum would be better?

-faster?
-posts easier?

The only benifit I could see is more smileys :p

[Cardinal Fang]

Originally posted by 3GFX


why though?...someone please give e a few reasons why a different forum would be better?






phpBB is a great forum software for a freeware, BUT it does not have nearely the features, speed functionality, security and support. New features are almost always slow in coming and the guys writing it are not in a hurry to add any at any time. The moderating control panels is easy to use making the moderators life easier. They can track IP addresses and clamp down on duplicate handles.

*Coughs*

Hacking into phpbb is easy by hacking standards. And yes......... way cool smileys.

On an added note, has anyone received and invitation to join www.majic.ca?

[majic]

Originally posted by 3GFX

Over a 1000 members like it the way it is, and I\'m sure the majority of regular posters in the top 50 wouldn\'t change it.


prove it..

i guess you haven\'t been on \'other\' forums.. this one is very cumbersome to use and is missing a lot of features (well prolly b/c it\'s free) that other boards have..

maybe you\'re just an average joe blow.. but i like to use all the notifications, custom smileys, being able to delete a few PMs at once.. etc etc..

EDIT: doh.. too slow hitting that \'submit button\' lol :p

[Cardinal Fang]

phpBB feature list: http://www.phpbb.com/features.php

vBulletin feature list: http://www.vbulletin.com/features.php

[Broli]

yeah,
everything is good this time
there is no reason to believe that we won\'t lose the whole board is it was desired by a hacker

u heard about the features from the other members,
there is no reason this board can be up and running while the coversion is going on
to a point anyways!

dave, go check out a few other boards and see for yourself!

not saying this is bad, just saying i think we may have outgrown it!

[3GFX]

I\'ve been part of other forums before (ATVtime, and some bimmer sites) and they are all pretty similar to this one.

Focus Canada in particular seems more capable than this site although its colors and setup can be intimidating for first timers.

Really I\'m open to change, but I still like this forum the way it is.

I only have two requests.

1. don\'t lose Torontomazda3.com (i know we won\'t)

2. don\'t lost the post count! ( I know if we change I will, oh well)