Title: whiskers75 Hacked Post by: peapodamus on October 31, 2013, 04:21:32 PM Just a quick note: the account `whiskers75` was recently hacked along with his chat site. Please do not trust or trade with this member until everything is resolved. Will update with proof when I have it.
EDIT: Got GPG proof, this is signed with his known GPG key: Code: -----BEGIN PGP SIGNED MESSAGE----- Title: Re: whiskers75 Hacked Post by: Boelens on October 31, 2013, 04:50:52 PM Confirmed.
Title: Re: whiskers75 Hacked Post by: DiamondCardz on October 31, 2013, 05:11:05 PM Mhmm. Confirmed.
Title: Re: whiskers75 Hacked Post by: BadBear on October 31, 2013, 05:12:56 PM Banned the account until one of the admins get it sorted.
Title: Re: whiskers75 Hacked Post by: theymos on October 31, 2013, 09:37:58 PM Have him sign a message with 1whiskrpGeZVd5ormX2ihifc9uB2YSz82 or some other address associated with the account.
Title: Re: whiskers75 Hacked Post by: dexX7 on November 01, 2013, 03:18:19 AM Have him sign a message with 1whiskrpGeZVd5ormX2ihifc9uB2YSz82 or some other address associated with the account. He created back then a locked thread with his GPG key: https://bitcointalk.org/index.php?topic=291161.msg3115725#msg3115725 Quote from: whiskers75 Below is my current PGP key. Code: -----BEGIN PGP PUBLIC KEY BLOCK----- Title: Re: whiskers75 Hacked Post by: theymos on November 01, 2013, 03:50:38 AM OK, have him send me (signed) the email address I should use for the account. He can then use the forgotten password feature.
Title: Re: whiskers75 Hacked Post by: Boelens on November 01, 2013, 08:28:29 AM OK, have him send me (signed) the email address I should use for the account. He can then use the forgotten password feature. Theymos, I believe you own this website. As new users, do we have to worry about account security? Why are individual accounts being hacked? What purpose would it serve to hack user accounts of an online forum? Thank you. - Safvan Malik The forum database wasn't compromised. There was a site he owned and that database got compromised, his password probably got compromised too, maybe from the database, a virus, etc. But none of it was due to a security leak in the forums. Title: Re: whiskers75 Hacked Post by: 🏰 TradeFortress 🏰 on November 01, 2013, 09:01:09 AM How was whiskers & whiskchat hacked?
Title: Re: whiskers75 Hacked Post by: Bullionado on November 01, 2013, 09:46:02 AM OK, have him send me (signed) the email address I should use for the account. He can then use the forgotten password feature. Theymos, I believe you own this website. As new users, do we have to worry about account security? Why are individual accounts being hacked? What purpose would it serve to hack user accounts of an online forum? Thank you. - Safvan Malik The forum database wasn't compromised. There was a site he owned and that database got compromised, his password probably got compromised too, maybe from the database, a virus, etc. But none of it was due to a security leak in the forums. Right. Thank you. Title: Re: whiskers75 Hacked Post by: r3wt on November 01, 2013, 09:48:17 AM How was whiskers & whiskchat hacked? kind of ironic we were all there last night. i'll just go ahead and say it wasn't I. must have been someone who was mad at him. /me casts glare at tradefortress :D Title: Re: whiskers75 Hacked Post by: DiamondCardz on November 01, 2013, 12:06:05 PM How was whiskers & whiskchat hacked? Probably his password or account was compromised and that probably led to the database being compromised. I did hear something about an old hotmail account, but that's about it. Title: Re: whiskers75 Hacked Post by: theymos on November 01, 2013, 01:05:55 PM Whoever owns your account email owns your account. So you should be careful about using non-existent webmail accounts, mailinator-type sites, etc.
Title: Re: whiskers75 Hacked Post by: r3wt on November 01, 2013, 03:14:38 PM Whoever owns your account email owns your account. So you should be careful about using non-existent webmail accounts, mailinator-type sites, etc. It just keeps getting better. look what i found in my email Code: We have come accross your personal information on the internet located at http://pastebin.com/raw.php?i=d1Wafvab. Someone may have stolen this information and posted it online. We are in no way affiliated with the stealing or posting of the information. As a public service, we let you know when your information is posted online and stolen so that you can minimize the damage. That paste contains every username and password of whiskchat, including mine. Title: Re: whiskers75 Hacked Post by: ekiro on November 02, 2013, 11:47:49 AM I wonder how often this forum gets it's servers violated unknowingly.
Title: Re: whiskers75 Hacked Post by: anonameous on November 02, 2013, 10:10:00 PM Whoever owns your account email owns your account. So you should be careful about using non-existent webmail accounts, mailinator-type sites, etc. I think you nailed it. A while ago, I remember WhiskChat's inputs.io account used a disposable yopmail.com email that I was able to access...although it wasn't much use as if I remember correctly you cannot reset password by email using inputs.io. I also remember Whiskers used at least one other disposable email account for other purposes too. I'm assuming this is how his website and forum account were compromised. On a related note during my "security audit" I noticed there was also an IP filter on inputs.io. I found out that it can be circumvented by tricking the account owner into visiting a site with some simple JS that takes advantage of an old DNS rebinding attack and allows me to essentially use their browser as a proxy to access inputs.io or any other website of my choosing. Title: Re: whiskers75 Hacked Post by: 🏰 TradeFortress 🏰 on November 03, 2013, 01:14:39 AM On a related note during my "security audit" I noticed there was also an IP filter on inputs.io. I found out that it can be circumvented by tricking the account owner into visiting a site with some simple JS that takes advantage of an old DNS rebinding attack and allows me to essentially use their browser as a proxy to access inputs.io or any other website of my choosing. Thanks for the report, this has been patched :)Title: Re: whiskers75 Hacked Post by: anonameous on November 03, 2013, 05:14:17 AM Thanks for the report, this has been patched :) Do I get a bounty? :D I'll test it out later and ensure it is patched correctly. If you feel compelled to tip for any reason: http://1v.io/m8r-74xku9@mailinator.com Note: I haven't actually scammed anyone, this account received a precautionary scammer tag. Title: Re: whiskers75 Hacked Post by: 🏰 TradeFortress 🏰 on November 03, 2013, 05:30:12 AM Thanks for the report, this has been patched :) Do I get a bounty? :D I'll test it out later and ensure it is patched correctly. If you feel compelled to tip for any reason: http://1v.io/m8r-74xku9@mailinator.com Note: I haven't actually scammed anyone, this account received a precautionary scammer tag. You only receive a bounty / reward if you disclose something responsibly (ie email it to support@inputs.io). Let us know if you have any other reports. Title: Re: whiskers75 Hacked Post by: anonameous on November 03, 2013, 05:40:15 AM You only receive a bounty / reward if you disclose something responsibly (ie email it to support@inputs.io). Let us know if you have any other reports. I see, yes I knew that oh well, I didn't have the time to fully demonstrate it or create an email account that can send emails as I do not own one. Oh well, maybe next time. Actually I think I've found something else, it's an isolated attack but possibly much more severe (don't worry I found this same problem on linkedin.com and a large number of other sites). I'll email you when I get a fully working demonstration together. Title: Re: whiskers75 Hacked Post by: whiskers75 on November 04, 2013, 05:18:32 PM Thanks everyone for helping get my account back! :D
GPG proof: Code: -----BEGIN PGP SIGNED MESSAGE----- Title: Re: whiskers75 Hacked Post by: Lamigo on November 04, 2013, 06:06:33 PM Thanks everyone for helping get my account back! :D Congrats :)GPG proof: Code: -----BEGIN PGP SIGNED MESSAGE----- |