Author Topic: Computermix, Ipquarx, and Cca - CBM being hacked into to steal keys [chat+pics]  (Read 43515 times)

because if you write code that has no bugs in it whatsoever, then it cannot be exploited.
in theory i agree, but its not as easy as that to be honest. I mean you can exploit the OS the program runs on. you can inject the program. you can exploit other programs that co-run with it. you can edit its resources. many other ways. that's why security is always an issue. theres no easy way to fabricate something like this, or a way at all. theres always some hole even if no one will ever discover it

You're claiming that every piece of code ever written can be exploited (Within a reasonable amount of time) to the point of being 100% insecure.

You see, that's incorrect because if you write code that has no bugs in it whatsoever, then it cannot be exploited. And guess what? That's 100% possible.

Bugs can't always be found until they are tested, and I have never heard of any code that cannot be twisted or exploited in any way.

Bugs can't always be found until they are tested, and I have never heard of any code that cannot be twisted or exploited in any way.
Code: [Select]
echo("Hello!");

A key.dat file, by itself, is useless to 'hackers.' Only when you have a second key.dat file generated on the same computer with a key you know can you extract the key from the first key.dat. I explained the process here.

The issue is that CBMHost is not a secure or professional hosting service. Any legitimate hosting service would use FTP jailing AND access restrictions to prevent users from accessing other users' key.dat files. They'd also (hopefully) use secure passwords on administrator accounts. None of the people involved in this are known for RATing, so I highly doubt that a keylogger or other tool of its kind was used to break in. It was negligence on behalf of CBMHost that left some kind of access violation open for exploitation.

My server was hacked and exploited with a directory traversal attack according to my source.

They didn't get them through the FTP, they used my web server to access the files, which was basically like using a command line Windows Explorer. The problem has been dealt with though and the hole is no longer open.

Your web server's user account should not have read access for key.dat files regardless of holes in your programming.

Code: [Select]
echo("Hello!");

What if a byte of code is corrupted due to a glitch in the system caused by an attack (And this scenario is pretty stretched I know, but it can still happen). It can say something else as the system tries to find the bytes to display each letter.

What if a byte of code is corrupted due to a glitch in the system caused by an attack (And this scenario is pretty stretched I know, but it can still happen).
Not possible if the system is coded without any vulnerabilities, unless you count cosmic rays flipping bits in ram an attack.

unless you count cosmic rays flipping bits in ram an attack.
lol

What if a byte of code is corrupted due to a glitch in the system caused by an attack (And this scenario is pretty stretched I know, but it can still happen). It can say something else as the system tries to find the bytes to display each letter.
Assuming it's torque, the most that a corruption of a byte could do is cause a syntax error or unknown function error. One byte changed = one different letter in that code, and there are no functions with a name only one letter different from "echo". If the corruption occurred on (, ", ), or ;, a syntax error would occur, no attacks possible there. If the corruption occurred on any of the letters in "Hello!" it would simply change the message. The code is unexploitable.

depends on what you want to exploit in that code. If my goal was to exploit that to say another message than I guess I exploited it.

depends on what you want to exploit in that code. If my goal was to exploit that to say another message than I guess I exploited it.

The context is access violations, but sure I guess.

Vulnerabilities in the underlying operating system or vulnerabilities in how code is evaluated do not change the fact that, that code, by itself, nothing else, is not vulnerable to exploits.

Let's say I have a desktop computer as my system. Is it exploitable? (Just bear with me, you'll see where I'm going with this)

yes both on hardware and software levels

Jeez, this drama turned into a completely uninteresting dribble of a argument.
As was stated by me, Raven and a few others, only the last few characters of the keys were figured out
CCA is Jey/Zey
Computermix is Valcle/Compy