Compromised Security
Recovered from the Internet Archive. This page comes from a ListenSmart.com capture saved by the Wayback Machine on October 17, 2000. The original text is preserved where it survives; links and layout have been adapted for this restoration. Historical account, search, posting, voting, playback and download features are inactive; their labels remain as plain text. Images that were never archived are left out. Audio files were not recovered for this archive.
Source: Wayback Machine capture of ubb.listensmart.com:80/ubb/Forum12/HTML/002354.html.
Removal requests: email seanfenlon@yahoo.com with the page address.
Email This Page to Someone! |
 Artist Only Boards [all categories]
 Artist Area
 Compromised Security
Post New Topic |
| next newest topic | next oldest topic |
| Author | Topic: Compromised Security |
| #1
Sean Fenlon Administrator Posts: 192 |
posted 10-03-2000 11:01 PM
Click Here to See the Profile for Sean Fenlon  Edit/Delete Message 
Upon investigation, it appears as though an unknown malicious perpetrator hacked directly into our UBB Server control panel, thereby gaining the ability to broadcast a bulk email to all registered bulletin board users. This is the same function I used to send the forgery "alert" from. Anyone registered with the ListenSmart BB who has the "Allow Bulletin Board Administrators and Moderators To Send You Email Notices?" option set to "YES" in their profile would have received these messages. We have changed all username/password combinations needed to gain access to the control functions and we have also contacted the folks at UBB to report the potential breach in the security of their software. In the meantime, we will be closely analyzing our server logs for evidence to the identity of the perpetrator. The forged message was utterly appalling to us. Be assured that ListenSmart.com will continue to operate on the web while we continue to search for solutions to implement a new business model for compensating artists. It is extremely disturbing to have been the victim of such a malicious and calculated act. If anyone has any information regarding the identity of the perpetrator, please contact me directly @ sean@listensmart.com. Sean P. Fenlon ------------------ IP: Logged |
| #2
dond Guru Posts: 141 |
posted 10-03-2000 11:48 PM
Click Here to See the Profile for dond Edit/Delete Message
I got both emails, and, it is scary! You have my sincere sympathy for what an attack like this can do to your site credibility, at the worst possible moment! For what it's worth, your's isn't the only site being attacked tonight. MP3.com, and EZ board are also being hit, although, so far, their security systems are marginally coping, and, only experiencing Partial interference. I hope you succeed in finding the perprators, and, I hope you nail them to a cross!!!! ------------------ IP: Logged |
| #3
notesleb Guru Posts: 441 |
posted 10-04-2000 12:28 AM
Click Here to See the Profile for notesleb Edit/Delete Message
That really sucks Sean, I hope you find out who it is. IP: Logged |
| #4
jasonwu Newbie Posts: 30 |
posted 10-04-2000 12:45 AM
Click Here to See the Profile for jasonwu Edit/Delete Message
Does this mean that the UBB mailer is not Y2K compliant? Cuz all three emails were sent out in the year 100. ------------------ IP: Logged |
| #5
CBH3 Records Guru Posts: 460 |
posted 10-04-2000 02:31 AM
Click Here to See the Profile for CBH3 Records Edit/Delete Message
I would guess that the email feature of the UBB isn't Y2k compliant due to the version they are running. I run a UBB and once someone get's into the controls page they can delete posts, threads, forums, or send a bulk email to all registered users which is what happened. You don't need to be an artist on the site to be in the email list. It's when you signed up to the UBB to be able to post, that your email got on the list. This is separate from being an artist or for that matter a listener because that email info goes into LS's perl/SQl database. No I didn't do it either. Frankly, it's beyond me how they figure out the password unless there is a bug in the UBB itself... CBH3 ------------------ IP: Logged |
| #6
Tundead The One and Only Guru Posts: 162 |
posted 10-04-2000 03:04 AM
Click Here to See the Profile for Tundead The One and Only Edit/Delete Message
Maybe an inside job! You think? IP: Logged |
| #7
KennyLee Guru Posts: 1104 |
posted 10-04-2000 04:45 AM
Click Here to See the Profile for KennyLee Edit/Delete Message
Well, I had a gig and missed it. Damn! Looks like a case of "kick somebody when they're down", to me. Of course, Rod Underhill posting the info on the mp3.com board is in poor taste. The email was preposterous on the face of it. He's a lawyer and a representative of mp3.com, he should know better. But I guess he hears that a lot. ------------------ IP: Logged |
| #8
mimo Newbie Posts: 25 |
posted 10-04-2000 04:08 PM
Click Here to See the Profile for mimo Edit/Delete Message
Rod always lives up to his name. ------------------ IP: Logged |
| #9
mimo Newbie Posts: 25 |
posted 10-04-2000 04:20 PM
Click Here to See the Profile for mimo Edit/Delete Message
Being a UBB operator myself, I know there are a few different ways to hack the sucker. I tried a couple just now on yer system, and it looks like you have the basics covered there.... So unless your password was really obvious or you haven't been keeping up on NT security patches, I am not sure how they could have got in. UBB stores the user files right on the drive, so if someone were able to sneak in through NT security holes, then they would be able to get into the UBB pretty easily. We get around that problem partially by renaming the control panel and related files to something else...So that if someone does manage to nail down a password, they still cant get at the files unless they can guess the name. In addition, we set NTFS permission on the files, and disable Anonymous logon (using only NT Challenge/Response). This makes it a pain to login, as you have to have 2 different sets of UserIDs and Passwords, but it makes pretty sure that no-one is going to sneak into messing with our board... Just a few suggestions.... Mimo. ------------------ IP: Logged |
| #10
bobp Guru Posts: 517 |
posted 10-04-2000 06:28 PM
Click Here to See the Profile for bobp Edit/Delete Message
Sorry this happened Sean. I hope any real impact is minimal. Bob P. ------------------ IP: Logged |
All times are ET (US) | next newest topic | next oldest topic |
Post New Topic  |
Hop to: Go |
Contact Us | ListenSmart.com
Powered by: Ultimate Bulletin Board, Version 5.41a
© Infopop Corporation (formerly Madrona Park, Inc.), 1998 - 1999.