***** NATS Issue - What we know about it ***** - Page 2 - GoFuckYourself.com

milan · 12-22-2007, 07:33 PM

Quote:

Originally Posted by BoyAlley

You know what, maybe OC3 should have fucking come out about this issue MONTHS ago instead of rolling over because their clients, whoever they are, were fucking scared of the wrath of TMM John of all god forsaken people.

Instead who knows how many people have been fucked up their ass worse than me without lube in the 4 months since.

Now TMM's John is coming forward with some pathetic little "Oopsie daisy my fault I'm so sorry have cybersex with my on ICQ now", and OC3 is all "so what are you wearing".

Fucking retarded.

Not everyone are angry little man and in seek of drama...

We respect first and foremost OUR customers, I have no problem with that do you? and if you saw the post we had a few months back you will see we did alerted the industry but I guess the subject of the post was not appealing enough for people to ask Q's.

V_RocKs · 12-22-2007, 07:36 PM

Nice... When it comes to security, there is no competition among hosting companies. I love that!

On a side note...

IP RESTRICTION...

But my IP address changes....

Bullshit. You make enough money to call your provider and request a PERMANENT one. But they don't provide one. What the fuck? Are you on Dialup because most Cable, DSL, Broadband providers WILL give you a permanent IP if you pay monthly for leasing. Usually $20. Consider it a cost of doing business and a tax write off.

OK... But I AM ON DIALUP! So pay an admin here to setup a proxy on a dedicated server with a NON-ADULT hosting company picked at random. Have that proxy password protected.

Case closed...

The fact that a village idiot can get into this industry if he has $100,000 in inheritance money frightens me. It frightens me because when it comes to security you are all village idiots! Every last one of you!

90% of you have hackers on your boxes because they hacked your forum, your support system, your webcam software or by some other means. You don't know because all the hacker wants is your password DB and not the Emails.

They trade those DB's like Pokemon cards. They give 1 account away to each person who asks for them on newsgroups and IRC channels. It NEVER trips your strongbox, pennywize, proxy pass, etc, because they give each requester a different account. So even if the real user and the fake one use it at the same time they fall with in the AOL threshold (5 IP's in 15 minutes).

You all think.. Impossible because those previously mentioned programs shut this kinda shit down! No... They don't... Because each request gets a different account. This isn't password boards where 15,000 people get the same account. This is the designer version where everyone gets their own unique, free account.

But bandwidth is so cheap I don't give a fuck!... I know.. But in one channel on the IRC alone you will have up to 1000 people receive a password in a day. You are pissing away $35,000 a day! Smaller programs a few thousand...

Industry wide? About $800,000,000 a year is just pissed away...

OK.. Back to your original programming where you just bury your heads in the sand.

BoyAlley · 12-22-2007, 07:37 PM

Quote:

Originally Posted by milan

Not everyone are angry little man and in seek of drama...

We respect first and foremost OUR customers, I have no problem with that do you?

Yes you're right, a huge portion of the fucking industry potentially having personal details stolen, not to mention who the fuck nows how many unsuspecting members, that's just me seeking out drama huh?

As for your second comment, basically what you're saying is, people have to pay you if they expect to be let in on little secrets like major vulnerabilities with the most used affiliate management software in the industry, huh? Did I understand that correctly?

BoyAlley · 12-22-2007, 07:39 PM

I, for one, would absolutely LOVE to know who these chickenshit clients were that told OC3 networks to keep their mouth shut cuz they were scurred of TMM John.

TheDoc · 12-22-2007, 07:46 PM

Quote:

Originally Posted by BoyAlley

Yes you're right, a huge portion of the fucking industry potentially having personal details stolen, not to mention who the fuck nows how many unsuspecting members, that's just me seeking out drama huh?

As for your second comment, basically what you're saying is, people have to pay you if they expect to be let in on little secrets like major vulnerabilities with the most used affiliate management software in the industry, huh? Did I understand that correctly?

Damn near every processor and a ton of other affiliate programs lists have been for sale for years, just ask around. People talk about it, hell posts have been deleted about them on GFY.

Every day hosting companies go through exploits, hacks, all types of shit. You don't see all the other Major Hosts posting what they found. They all host different programs with and without nats and nobody, no program, ever comes out and says shit about hacks/exploits.

And yes, you can guarantee that every host and affiliate program has gone through it's share of hacks and exploit issues. It's part of the business.

TheDoc · 12-22-2007, 07:49 PM

Sad as it is to say, this is a 10+ year problem and is probably one of the biggest reasons we have seen a down turn in our industry over the last 5ish years.

I have heard it from people straight up, and we all know it to be true to. Stolen email lists or not... If you signup for a porn site you will get spamed at some point down the road.

shuki · 12-22-2007, 07:57 PM

Quote:

Originally Posted by V_RocKs

Nice... When it comes to security, there is no competition among hosting companies. I love that!

On a side note...

IP RESTRICTION...

But my IP address changes....

Bullshit. You make enough money to call your provider and request a PERMANENT one. But they don't provide one. What the fuck? Are you on Dialup because most Cable, DSL, Broadband providers WILL give you a permanent IP if you pay monthly for leasing. Usually $20. Consider it a cost of doing business and a tax write off.

OK... But I AM ON DIALUP! So pay an admin here to setup a proxy on a dedicated server with a NON-ADULT hosting company picked at random. Have that proxy password protected.

Case closed...

The fact that a village idiot can get into this industry if he has $100,000 in inheritance money frightens me. It frightens me because when it comes to security you are all village idiots! Every last one of you!

90% of you have hackers on your boxes because they hacked your forum, your support system, your webcam software or by some other means. You don't know because all the hacker wants is your password DB and not the Emails.

They trade those DB's like Pokemon cards. They give 1 account away to each person who asks for them on newsgroups and IRC channels. It NEVER trips your strongbox, pennywize, proxy pass, etc, because they give each requester a different account. So even if the real user and the fake one use it at the same time they fall with in the AOL threshold (5 IP's in 15 minutes).

You all think.. Impossible because those previously mentioned programs shut this kinda shit down! No... They don't... Because each request gets a different account. This isn't password boards where 15,000 people get the same account. This is the designer version where everyone gets their own unique, free account.

But bandwidth is so cheap I don't give a fuck!... I know.. But in one channel on the IRC alone you will have up to 1000 people receive a password in a day. You are pissing away $35,000 a day! Smaller programs a few thousand...

Industry wide? About $800,000,000 a year is just pissed away...

OK.. Back to your original programming where you just bury your heads in the sand.

So how do we stop the theft?

shuki · 12-22-2007, 08:00 PM

Quote:

Originally Posted by TheDoc

Sad as it is to say, this is a 10+ year problem and is probably one of the biggest reasons we have seen a down turn in our industry over the last 5ish years.

I have heard it from people straight up, and we all know it to be true to. Stolen email lists or not... If you signup for a porn site you will get spamed at some point down the road.

Yep...I think part of the problem is that some in this industry will accept and capitalize on this activity.....as long as you can make money off the stolen lists and spamming people it won't stop.

V_RocKs · 12-22-2007, 08:30 PM

Well, how many programs support password lists through advertising?

Tons!

minusonebit · 12-22-2007, 08:44 PM

Quote:

Originally Posted by milan

I can't answer #1 as I knew they are trying to resolve this, they did not sit on their ass... (I still think letting the customers know would be first priority)

as for #2 I will repeat that we still have respect for the idea that security issues should be secret until their fixed. and was urged by our clients that we located the issue on their server NOT to go public or something bad will happen to them, who know what bad is but lawsuit and revoke of license is what I heard... can't confirm the second one.

Well, you gotta do right by your clients, I suppose... Milan, I know what a nice guy you are and in this case, I think you might have been a little bit too nice to the TMM folks. Thats what I was trying to say. From the TMM response, it doesn't sound like they were doing alot to fix the issue but were working overtime to keep it hush hush. I know what you are saying about the keeping it secret part, but there is a balance there. If they are not working on fixing it, then someone needs to disclose it to force their hand for the greater good. I don't blame anyone other than NATS/TMM for this.

Ycaza · 12-22-2007, 10:16 PM

woh, I am taken aback and happy to accept the apology. Thank you john, I just saw this. It is our pleasure to try and help the situation. If there is more I or we can do to help resolve this, let us know.

oh and boy alley we did, months ago. I helped not only our clients, but a bunch of nats customers called me personally for the fix. I had assumed the problem was fixed from there. We just uncovered it again, In what I am told is a slightly different form.

minusonebit · 12-22-2007, 10:41 PM

Quote:

Originally Posted by Dirty F

Wtf? Youre so fucking fucked in your head, you should seek help you fucking imbecile. I had my chance but got quiet? Had what chance you retard boy? Oh yeah now i remember, you said i stopped posting on gfy for 3 weeks after you said you would beat me up

Man, if you read all this shit back about yourself dont you just want to shoot yourself?
Please explain to me how exactly i got quiet and scared?

Fucking delusional piece of password sharing shit!

Real simple. You stopped posting. Like I said. You signed off and no one heard from you for a while and you avoided the challenge thread like the plauge. But thats OK, I'll give you another chance. Any time you want to come and back your shit up Franck, lets go for it. I promise you I'll win and you will be a little bloody mess of broken bones and oozing sores.

st0ned · 12-22-2007, 11:02 PM

Quote:

Originally Posted by ronaldo

If I understand correctly from the other thread, OC3Networks is working with, or assisting MojoHost and quite possibly others as well.

If that's true, I have to give props to a company (that I don't host with btw) for working DIRECTLY WITH their competition to help solve an issue that effects our entire industry instead of capitalizing on it for their own gains.

That deserves the utmost respect.

No kidding, they just got themselves a new customer

TMM_John · 12-22-2007, 11:03 PM

Quote:

Originally Posted by Ycaza

woh, I am taken aback and happy to accept the apology. Thank you john, I just saw this. It is our pleasure to try and help the situation. If there is more I or we can do to help resolve this, let us know.

oh and boy alley we did, months ago. I helped not only our clients, but a bunch of nats customers called me personally for the fix. I had assumed the problem was fixed from there. We just uncovered it again, In what I am told is a slightly different form.

You're very welcome. I made the mistake of lumping you in with some of the assholes here by assuming things others told me to be true rather than looking for myself which I something I always try to do in life. I'm sorry for that.

We also believed the issued had been fixed when it first popped up and was addressed. We also fully believed we had spoken with everyone it affected. Some people here would rather perpetuate the drama than listen to things tho

If we can be of any aid to you in helping your clients or if you have any info that we could use please know that the lines of communication are always open. I look forward to sitting down with you in Vegas also.

Paul Markham · 12-23-2007, 12:36 AM

Quote:

Originally Posted by milan

We respect first and foremost OUR customers, I have no problem with that do you? and if you saw the post we had a few months back you will see we did alerted the industry but I guess the subject of the post was not appealing enough for people to ask Q's.

I'm sorry but with an issue this big and TMM's response I would have found a few different ways to bring this to light. There are many posters who would of posted it for you without naming you as the source, there's opening a new GFY account and bouncing an old thread with new in depth info and there is finding a list of big NATS users you're not hosting and giving them a Heads up.

You backed off because John threatened legal action to your clients. Which is partly understandable, reflects badly on John as he must of known the last place he would go with this is court.

John I see you are still calling people names. If you're 101% innocent in this you're a bad businessman. Because the problem was shown to you and instead of fixing it and informing clients you chose to hide it and threaten VICTIMS with court action.

The problem continued, with your knowledge. Or did you not believe all the warning signs that were being shown to you while you were threatening people with court action?

Paul Markham · 12-23-2007, 12:44 AM

Quote:

Originally Posted by TheDoc

Sad as it is to say, this is a 10+ year problem and is probably one of the biggest reasons we have seen a down turn in our industry over the last 5ish years.

I have heard it from people straight up, and we all know it to be true to. Stolen email lists or not... If you signup for a porn site you will get spamed at some point down the road.

Sadly true. A large proportion of the people in the Adult Net have ethics that leave you wondering if they act like this in the rest of their life. Stealing anything on the Net is done by them on a basis of "If I can do it I will and it's acceptable." It seems they feel Internet propert can be taken at will.

I wonder how they would feel if someone drove off with their car because they had not totally disabled it?

xxxjay · 12-23-2007, 02:13 AM

Holy shit...

Zester · 12-23-2007, 04:51 AM

i'm getting depressed again...

RazorSharpe · 12-23-2007, 06:22 AM

Quote:

Originally Posted by PBucksJohn

You're very welcome. I made the mistake of lumping you in with some of the assholes here by assuming things others told me to be true rather than looking for myself which I something I always try to do in life. I'm sorry for that.

We also believed the issued had been fixed when it first popped up and was addressed. We also fully believed we had spoken with everyone it affected. Some people here would rather perpetuate the drama than listen to things tho

If we can be of any aid to you in helping your clients or if you have any info that we could use please know that the lines of communication are always open. I look forward to sitting down with you in Vegas also.

John, please give your clients a little respect. You are accussing us of perpetuating drama in an environment that YOU have made condusive to drama. What did you expect?

Oh and don't sit too close to Caz in vegas ... if his wallet gets lost you're totally fucked!

...

D-man · 12-27-2007, 12:50 AM

Quote:

Originally Posted by Headless

holy shit this isnt good...

lol and even headless posted on this

dicknixon · 12-27-2007, 01:51 AM

I bow down to Dale. He's the best admin I've ever dealt with.

Iron Fist · 12-27-2007, 06:43 PM

Blogs are linking to this thread

Dirty F · 12-27-2007, 07:00 PM

Carmella Bing gets a hot load of jizz in her anus

Click here for her free movies!

Paul Markham · 12-28-2007, 05:23 AM

Quote:

Originally Posted by milan

After many MANY emails and VM's I will post what OC3 Networks discovered back in October after routine audit of 2 of our clients security.

We know this issue exist since mid Aug 2007, secured our customers and blocked the intruder IP?s from any access to our network.

We posted the thread http://www.gfy.com/fucking-around-and-business-discussion/779742-oc3-networks-customers-urgent.html and got some lawsuit treat to sue us that we could have care less? BUT when our customers that we tracked the breach on their servers got treats as well and requested us to NOT come out public with it, we honored their request.

Just as a side info, I think NATS is a great product and it's a shame that after the months they had to fix or come clean with their clients it never happened...

Credit for this below info should go to our SUPER SYSADMIN/Security fanatic Dale that has never posted on this board so I'm doing this for him, He wanted to come out with this long ago!
=====
The issue with this "intruder" does not seem to be an exploit of the nats software itself. *Someone* has access to TMM's clients database with your admin logins and passwords. That?s what the issue is. I'm not posting this to bash TMM. I'm posting this because they have had month to fix this issue and have apparently failed. They didn't even let (some of?) their customers know they implemented this "Admin activity log" and installed it behind their backs.

I've been involved with a high number of NATS clients and have found the following to be true:
*) Changing all admin level account passwords stops the intruder. He still attempts to login, but in vain.
*) As soon as TMM has admin access to NATS the intruder is back. Sometimes the same day.
*) Intruder is using an automation script that dumps the NATS members list. In some cases he is doing this every hour on the hour.
*) If you have web logs, look for hits against "admin_reports.php?report=surfer_stats&member=#### ##". You will see a number of those hits in sequential order.
*) NATS was vulnerable to SQL injection attacks. I haven't investigated whether it still is.

I have some suggestions for people using NATS:
*) Change all your admin level passwords.
*) Do not give TMM an admin account they can use anytime they want. Change the pass when they are done.
*) Restrict access to the admin*.php files by IP. This is inconvenient, but if you can do this it will circumvent any future intrusion. There may be other files you want to do this with. You can do this with apache easily (syntax depends on your version. this is for 2.0):
<Files "admin*">
Order deny,allow
Deny from all
Allow from your.ip.addr.here
</Files>
*) Keep an eye on the ssh user you have given TMM to fix/maintain your NATS install. Change their password every time they need access and as soon as they are done. I have experience with TMM ssh-ing in and making changes to NATS software without permission.
*) Be thankful of many things I'll not get into.

Time to bump this so people know.

Paul Markham · 12-28-2007, 11:10 AM

It's time for another and another part in bold.

Quote:

Originally Posted by milan

After many MANY emails and VM's I will post what OC3 Networks discovered back in October after routine audit of 2 of our clients security.

We know this issue exist since mid Aug 2007, secured our customers and blocked the intruder IP?s from any access to our network.

We posted the thread http://www.gfy.com/fucking-around-and-business-discussion/779742-oc3-networks-customers-urgent.html and got some lawsuit treat to sue us that we could have care less? BUT when our customers that we tracked the breach on their servers got treats as well and requested us to NOT come out public with it, we honored their request.

Just as a side info, I think NATS is a great product and it's a shame that after the months they had to fix or come clean with their clients it never happened...

Credit for this below info should go to our SUPER SYSADMIN/Security fanatic Dale that has never posted on this board so I'm doing this for him, He wanted to come out with this long ago!
=====
The issue with this "intruder" does not seem to be an exploit of the nats software itself. *Someone* has access to TMM's clients database with your admin logins and passwords. That?s what the issue is. I'm not posting this to bash TMM. I'm posting this because they have had month to fix this issue and have apparently failed. They didn't even let (some of?) their customers know they implemented this "Admin activity log" and installed it behind their backs.

I've been involved with a high number of NATS clients and have found the following to be true:
*) Changing all admin level account passwords stops the intruder. He still attempts to login, but in vain.
*) As soon as TMM has admin access to NATS the intruder is back. Sometimes the same day.
*) Intruder is using an automation script that dumps the NATS members list. In some cases he is doing this every hour on the hour.
*) If you have web logs, look for hits against "admin_reports.php?report=surfer_stats&member=#### ##". You will see a number of those hits in sequential order.
*) NATS was vulnerable to SQL injection attacks. I haven't investigated whether it still is.

I have some suggestions for people using NATS:
*) Change all your admin level passwords.
*) Do not give TMM an admin account they can use anytime they want. Change the pass when they are done.
*) Restrict access to the admin*.php files by IP. This is inconvenient, but if you can do this it will circumvent any future intrusion. There may be other files you want to do this with. You can do this with apache easily (syntax depends on your version. this is for 2.0):
<Files "admin*">
Order deny,allow
Deny from all
Allow from your.ip.addr.here
</Files>
*) Keep an eye on the ssh user you have given TMM to fix/maintain your NATS install. Change their password every time they need access and as soon as they are done. I have experience with TMM ssh-ing in and making changes to NATS software without permission.
*) Be thankful of many things I'll not get into.

P.S. Im hearing that there is a backdoor that TMM can use to get into your NATS, but I havent investigated so its speculation. Only reason I even mention this is because NATS is encrypted and you dont know. Im not interested in decrypting NATS just to find out. There are other ways. I hope this isn?t true.

NATS is a great program.

minusonebit · 12-29-2007, 06:12 PM

Back up to the top. At least Milan brought this forward. Most people probably wouldn't have had the stones.

TidalWave · 12-29-2007, 10:12 PM

OC3 Networks ROCKS!

www.oc3networks.com

12-22-2007, 07:49 PM	#56
TheDoc Too lazy to set a custom title Industry Role: Join Date: Jul 2001 Location: Currently Incognito Posts: 13,827	Sad as it is to say, this is a 10+ year problem and is probably one of the biggest reasons we have seen a down turn in our industry over the last 5ish years. I have heard it from people straight up, and we all know it to be true to. Stolen email lists or not... If you signup for a porn site you will get spamed at some point down the road. __________________ ~TheDoc - ICQ7765825 It's all disambiguation

12-22-2007, 10:16 PM	#61
Ycaza Confirmed User Industry Role: Join Date: Feb 2005 Location: the 805 Posts: 4,290	woh, I am taken aback and happy to accept the apology. Thank you john, I just saw this. It is our pleasure to try and help the situation. If there is more I or we can do to help resolve this, let us know. oh and boy alley we did, months ago. I helped not only our clients, but a bunch of nats customers called me personally for the fix. I had assumed the problem was fixed from there. We just uncovered it again, In what I am told is a slightly different form. __________________ Caz Thrush Head Honcho [email protected] http://thrushtech.com ICQ: 304883574 do people still icq?

12-23-2007, 02:13 AM	#67
xxxjay Tube groupie. Industry Role: Join Date: Aug 2002 Location: LoScandalous, CA Posts: 13,482	Holy shit... __________________ http://donttellmehowtoruinmylife.com/ - http://www.jmdigitalmarketing.com/my...s-and-reviews/ - http://www.wouldyouhitit.org - http://shinyobjectreviews.com/

12-23-2007, 04:51 AM	#68
Zester Confirmed User Industry Role: Join Date: Jul 2003 Posts: 5,344	i'm getting depressed again... __________________ * Mainstream ? $65 per sale * new male contraception

12-27-2007, 06:43 PM	#72
Iron Fist Too lazy to set a custom title Join Date: Dec 2006 Posts: 23,400	Blogs are linking to this thread __________________ i like waffles

12-22-2007, 07:36 PM	#52
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,405	Nice... When it comes to security, there is no competition among hosting companies. I love that! On a side note... IP RESTRICTION... But my IP address changes.... Bullshit. You make enough money to call your provider and request a PERMANENT one. But they don't provide one. What the fuck? Are you on Dialup because most Cable, DSL, Broadband providers WILL give you a permanent IP if you pay monthly for leasing. Usually $20. Consider it a cost of doing business and a tax write off. OK... But I AM ON DIALUP! So pay an admin here to setup a proxy on a dedicated server with a NON-ADULT hosting company picked at random. Have that proxy password protected. Case closed... The fact that a village idiot can get into this industry if he has $100,000 in inheritance money frightens me. It frightens me because when it comes to security you are all village idiots! Every last one of you! 90% of you have hackers on your boxes because they hacked your forum, your support system, your webcam software or by some other means. You don't know because all the hacker wants is your password DB and not the Emails. They trade those DB's like Pokemon cards. They give 1 account away to each person who asks for them on newsgroups and IRC channels. It NEVER trips your strongbox, pennywize, proxy pass, etc, because they give each requester a different account. So even if the real user and the fake one use it at the same time they fall with in the AOL threshold (5 IP's in 15 minutes). You all think.. Impossible because those previously mentioned programs shut this kinda shit down! No... They don't... Because each request gets a different account. This isn't password boards where 15,000 people get the same account. This is the designer version where everyone gets their own unique, free account. But bandwidth is so cheap I don't give a fuck!... I know.. But in one channel on the IRC alone you will have up to 1000 people receive a password in a day. You are pissing away $35,000 a day! Smaller programs a few thousand... Industry wide? About $800,000,000 a year is just pissed away... OK.. Back to your original programming where you just bury your heads in the sand.

12-22-2007, 07:39 PM	#54
BoyAlley So Fucking Gay Join Date: Nov 2004 Posts: 19,714	I, for one, would absolutely LOVE to know who these chickenshit clients were that told OC3 networks to keep their mouth shut cuz they were scurred of TMM John.

12-22-2007, 08:30 PM	#59
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,405	Well, how many programs support password lists through advertising? Tons!

12-27-2007, 01:51 AM	#71
dicknixon Confirmed User Industry Role: Join Date: Jun 2003 Location: Chicago Posts: 548	I bow down to Dale. He's the best admin I've ever dealt with.

12-27-2007, 07:00 PM	#73
Dirty F Too lazy to set a custom title Industry Role: Join Date: Jul 2001 Posts: 59,204	Carmella Bing gets a hot load of jizz in her anus Click here for her free movies!

12-29-2007, 06:12 PM	#76
minusonebit So Fucking Banned Join Date: Feb 2006 Location: [email protected] Posts: 7,391	Back up to the top. At least Milan brought this forward. Most people probably wouldn't have had the stones.

12-29-2007, 10:12 PM	#77
TidalWave Confirmed User Industry Role: Join Date: Sep 2007 Location: Los Angeles Posts: 2,706	OC3 Networks ROCKS! www.oc3networks.com