Author Topic: Y/N Hacking?  (Read 780 times)

On a particular website I've been active on for a while, there was recently a pretty big hacking attempt on an administrator's account- Actually, attempt would be wrong, since they pulled it off and vandalized a fair amount of the site's content.
After this, they apparently had the nerve to predictably claim it was "to expose problems in the security" and then had a list of complaints regarding the site.

My post on the site's forum regarding this:
Quote
WERE YOU AWARE?: All hackers are stupid. It's a fact, mate! I use to mess around with hacking (i mean come on, who hasn't been that bored?) and honestly some of the people I knew seemed really just way too damn aggressive and power hungry. I think that when someone is hacking they are really only after the power that it offers, like a child, regardless of they say. There is no good hacking.
People will usually attempt to gain power in a website through an aggressive manner, then once this fails, they claim it was "all in good fun," or "a lesson in the weaknesses of your security." Pardon me, but frankly that's bullstuff. That's just a lazy attempt at a cover-up.
A hacker does not even have the right to make complaints regarding the website. You know what rights they do have? The right to remain silent as anything the person says will be used against that person in court and that they have the right to consult with an attorney and to have that attorney present during questioning and that if he or she is indigent, an attorney will be provided at no cost to represent her or him. Hacking a criminal activity and hackers ought to be treated as such.

Some other notable posts on the subject:
Quote
Wow. I read that topic here, which I'm guessing is what started all of this mess...

~viewtopic.php?t=78100

... and I've got to say, some people may not like what I'm going to say but I'm going to say them anyway.

Like his post is loving amazing - amazingly loving stupid that is.

Quote from: Hacker, posting as "
ananonymoususer"
To perhaps cast light on some discussion, I put forth a suggestion.

My solution is: Back up the code base, back up the manga. Allow me monitored administrative access to the code base, through SVN (which I can set up). Then we can just dump SVN comments to the front page every month or so to show the bug fixes and to encourage further work from myself and Jacob. If I do anything horrendous, SVN has a backup of all of the code base from before I started.


This is the type of post that makes you look like you're threatening someone. "I've shown I can have control of something. My proposition is for you to give me some sort of power. Or else this could happen ~or~ to prevent this from happening."

Yeah... I highly doubt when you basically threaten someone on the internet - which is what was done here if you read between the lines - that person is going to cede to you.

There's something people need to realize here. THIS IS JACOB'S "HOUSE". You're in his home. If you don't like being here, GET, THE, forget, OUT. Plain and simple folks. Jacob doesn't have to do a damn thing for any person here.

First, Jacob does this on his OWN TIME, for us. I thought it was utterly absurd when I read that post further up in that topic when the OP suggests this is ALL Jacob does. Yes, I'm pretty sure Jacob just sits around on his computer ALL loving DAY doing absolutely NOTHING else. Man, if you believe that crock of horse stuff you're an idiot.

Second, all of this is FREE. People take WAY too much for granted. Jacob lets people freely join (hell, you don't even have to join if you don't want to), read the material on his site, and Jacob handles all the issues like making sure the server space is paid for every month and such. Remember, THIS IS HIS "HOUSE". He could be an ass and do some stuff like set it up to where you have to pay to join, or make it where basic membership just allows posts in the forums. No. He's a good guy though. He lets people join, read the doujinshi that our esteemed translators (who you should also thank EVERY TIME something new is posted) take THEIR TIME to translate and edit the scans, and post essentially whatever they please in the forums.

But somehow all of that's not good enough? Ok. What ever. Don't like it. loving leave.

The subject matter by which my screen name comes has one of the greatest automotive forums on the net. It really is. The WHOLE place - and it's a large place - is moderated by ONE guy. Just one. Even here, there are moderators for each section, but this man handles EVERY section. How does he do it? The forum self-moderates. If a troll appears, the members can quickly down-rate and speed-ban. If there are other issues, it's typically easy to actually notify the moderator if something drastic needs to be done. Honestly that happens every blue moon.

Yet again, here is the underlying point, it's the moderator's "house". He runs the show. If you don't like the show he's running, leave.

Fakku has something really special going on here. It's actually one of the few places on the net that is able to present doujinshi the way it does. I myself will admit there are some issues with the overall presentation of the page. However, if I really didn't like it, I wouldn't come here. Do I just leave then? No. I understand the intricacies that it took to come up with everything here and the dedication it takes to keep this place going.

Remember, Jacob can "pull the plug" at any point.

The point of this is that Jacob can run this place however he pleases, and if you don't like it, go somewhere else.

Quote
If some of you are thinking that this was too much to make a point, then I'm not sure you really understand the gravity of what took place, and the goodwill these hackers showed once they showed they could do what they did as easily as they did. Imagine you break into a bank, take hostages, and break into the vault, and then don't steal anything. You did it not steal the money, but to show that bank just how easy it was to do what you did.

It's the exact same situation here, someone got their stuff rightfully slapped to the ground, but then were extended a hand to get back up. They could have just as easily forgeted over the entire website, gotten into a lot of peoples personal information, and then go on from there.

But they didn't. These people aren't douche bags or starfishs, they're people of character. I can tell people to do something they don't want to do all I want, but they sure as stuff aren't going to do anything until I show them the consequences of non-compliance. Asking will only get you so far, and some people need to get a swift kick in the ass before they switch their gears into action.

Quote
Seems like the majority of the hackers complaints were technical ones. I disagree with the hacker in that website development is an easy thing. Perhaps for them it is, but I think any amount of programming stuff and the like is as complicated as trying to solve a rubiks cube in 30 seconds while on fire and blindfolded. It's not like website developers just come up to Jacob and offer their services for free. There's an incredible demand on the working force for them, not only because these kinds of things are virtually needed everywhere, but also because there's simply not enough of them.

If web development was so easy, we'd have a lot more programmers and all of this wouldn't have happened. So instead of trying to ruin the site (they did cause damage (albeit minor), see the first post) they should've asked whether they could help out. If you think this site is so easy to fix, then loving do it. Shut up about it and help Jacob. I'm sure he'll be more than happy about that.

Edit: I saw some technical things in the post though. That's a lot better than randomly complaining.

@Above: It doesn't matter if the end result is good. You don't go and break the law because it somehow is convenient for you. That will hurt people. If I needed to from point A to B and didn't have a car, I wouldn't steal one. I would walk. Having no moral values doesn't give you character, it takes character away and brings you down to something distintively non human. It's different sorts of ethics that make the world spin.

What do you guys think about the ethics of hacking anyway? I personally find it pretty set in stone that it's the wrong way to go about anything, but nonetheless, discussion is always a good thing.

I say hacking Is very nes.

Isn't hacking forceful access through the alteration of code? He could have just guess the password right.

Isn't hacking forceful access through the alteration of code? He could have just guess the password right.
No, it's a fact that it was legitimate hacking (Haha, there's an oxymoron for you!), as the hacker did make fair points regarding some security holes on the site.

Oh, also, wow how'd I forget this, here's the post the admin made announcing the issues:

Quote
Earlier tonight one of our administrators accounts was broken into and used maliciously. Around 500 manga were re-tagged and had most of their information vandalized. But outside of the one administrator account and the manga corruption, no private information was lost. A post was made on the front page by the perpetrators outlining their reasons for doing so, which revolved entirely around me. They made some good points. I could be a better administrator and I still have a lot to learn, but I have and will continue to do my best to keep FAKKU online and mostly stable.

The administrator's account was broken into because they were using the same password for FAKKU that they were using elsewhere. When a website stores your password it encrypts it inside of the database, most often using md5 encryption. The problem with md5 is that it's widely used and once the encrypted form of the password is known you can easily look up the reverse and figure out common passwords. This is why websites prompt you to choose passwords with numbers, special characters, and uppercase letters.

Up until now FAKKU was using md5 encryption (which was left over from phpbb, the CMS FAKKU was originally built on). But from now on we will be using a form of salting along with bcrypt to secure all user accounts so that their passwords (if they are ever compromised) cannot be figured out using a reverse md5 lookup. All you have to do is login to your account and change your password, and you should take this opportunity to make sure it's something secure (fakku123 is not a good a password to use).