Paycom or NATS spamming our members?

[spacedog]

Seems to me when looking at both of these together it appears there is a smoking gun here. I don't have access to that forum or know where it's at. Spacedog can you tell us what that post is in context too?

For all we know he could be talking about a cheerleader squad. I realise it's likely not that, so what was his post a response too?

The post is irrelevant.. He's talking about a video game.. screencap was only to show that he works for, or used to work for TMM/NATS.

He hasn't posted on that forum since august and then that freelance job thing in Sept.

Hacker or whoever is using his name or whatever.. who fucking knows

[D]

Good luck to all parties involved in getting this matter sorted out.

[Doctor Dre]

I'm sorry to hear that.

Did you hire a PR guy to answer all the previous questions too ?
Shit John, you're turning into a PR pro following all the rules
(That's a compliment btw)

[V_RocKs]

I finally just saw where someone accused their lead programmer of being a smoking gun... Now that is funny.

[quantum-x]

Fred is the lead programmer of CARMA and NATS at TMM.
It's probably normal that admin accounts are under his name, it would be the most logical. I don't think you can conclude that it's Fred that's doing it, simply because that's the name on the admin account.

As if you'd leave your full name on you own hack..

[SmokeyTheBear]

Fred is the lead programmer of CARMA and NATS at TMM.
It's probably normal that admin accounts are under his name, it would be the most logical. I don't think you can conclude that it's Fred that's doing it, simply because that's the name on the admin account.

As if you'd leave your full name on you own hack..

i think that would be a bit premature of a guess as well , but its obvious his account was compromised.

you would think as head programmer he might have built in some safeguard to keep his own account in check.. certainly not allowing it to login to multiple nats sponsors at the same time every few minutes and get data.

[poto]

good to see NATS is finally doing something to fix this for everyone...

it's a bit overdue tho...

[kmanrox]

i *may* have always been under the understanding that the processors sold off their email lists... i *may* have heard this from many webmasters that it *may* be an assumed occurence.. that's all i will say

*disclaim the above is not implying, implicating, suggesting or accusing anyone of doing anything uncuth or unlawful. the above is simply things one *may* have heard thru the 'grapevine'

[AlienQ - BANNED FOR LIFE]

Of course.

It was the lead admins account but it was not him and uhh uhh...


How Convenient!
If I knew that people were really that easy to pull one over on I would certainly be alot wealthier today.

ROFLMAO!

I mean NATS is a top notch crew it was just a glitch!

[kmanrox]

surely i cant the only one who may have hypothetically heard for years of the availablility of processor dbases for a hefty price?

[will76]

Fred is the lead programmer of CARMA and NATS at TMM.
It's probably normal that admin accounts are under his name, it would be the most logical. I don't think you can conclude that it's Fred that's doing it, simply because that's the name on the admin account.

As if you'd leave your full name on you own hack..

One thing that surprised me was seeing that the guy was looking for side jobs on a rentacoder type site. I have 2 full time programmers i keep real busy. It just seemed odd to me that if he is the head guy he would have extra time on his hands to look for side jobs. Maybe I am the only one to think that but that was my opinion when i read that part.

[stevo]

Count me in too...

NATS was originally installed on my server in 2005. The account they created during the original install, is the one that got replaced by "Fred Schank".

I won't go into details or opinions, but if i remember correctly it was a very generic username/password that was probably easily cracked.

[TheSenator]

I nominate this thread for DRAMA of the year award.

[quantum-x]

Of course.

It was the lead admins account but it was not him and uhh uhh...


How Convenient!
If I knew that people were really that easy to pull one over on I would certainly be alot wealthier today.

ROFLMAO!

I mean NATS is a top notch crew it was just a glitch!

I'd trust you to be as stupid to sign your own name to a hack job. Hell, you'd probably put on your best myspace face and take a photo of yourself, grinning madly through the pain of your buttplug, giving a thumbs up.

Not everyone is a big of an arsehole as you are

[will76]

I nominate this thread for DRAMA of the year award.

2007 or 2008 ?

[Mutt]

i *may* have always been under the understanding that the processors sold off their email lists... i *may* have heard this from many webmasters that it *may* be an assumed occurence.. that's all i will say

*disclaim the above is not implying, implicating, suggesting or accusing anyone of doing anything uncuth or unlawful. the above is simply things one *may* have heard thru the 'grapevine'

i can't believe so many people in this industry don't and refuse to believe that.

[quantum-x]

I was looking for a fake account to post under, then though what the fuck.
Here's where it stands.
There are 2 scenarios:
1- Internal Job. Won't even speculate on this, I've got nothing to say. It's just an option.

2- Exploit.
If it's an exploit, it'll be coming in via SQL injection attacks.
I know this, because [as demonstrated] previously, NATS filtering of $_REQUEST variables has been incredibly poor. In what I've glimpsed of source code, and played with [I'm by no means a 'black hat', but I know an exploit when I see one] - they weren't even using mysql_real_escape_string for passing strings to the databases.

6-12 months ago I did a POC where I dropped an entire database by injecting the SQL through a NATS [or CARMA, can't remember] URL.
I notified them via ticket. Have things improved? Not sure.

So, if it's as above, it doesn't matter how good your sql restrictions are, because the SQL requests come from the localhost anyhow.

It's easily conceivable that you can have full control over the database, hence the creation / deletion of accounts.

[stevo]

3- Generic admin username/password created by installer. For example, if i remember correctly:

Username: (employee/installer name)
Password: (i wont post on a public board, but also very generic)

If this employee, used the same technique on several installs, i could see a problem... This could also explain why the problem is small scale.

[quantum-x]

3- Generic admin username/password created by installer. For example, if i remember correctly:

Username: (employee/installer name)
Password: (i wont post on a public board, but also very generic)

If this employee, used the same technique on several installs, i could see a problem... This could also explain why the problem is small scale.

Good point.
However people have pointed out in this thread that the account is reappearing after deletion.

[quantum-x]

Hit stats for a NATS sponser. 2006. Hmm.

This is thin, thin 'evidence' though.

[TheSenator]

Hit stats for a NATS sponser. 2006. Hmm.

This is thin, thin 'evidence' though.

Do you hear that?

That is the sound of a company lawyering up!!!


Follow the money....

[AlienQ - BANNED FOR LIFE]

Quantum I was being sarcastic above there fella.

I raged about some things regarding NATS I was even banned for it in the past. Do a history on John Albright here in GFY. Ya will know where I stand about all this.

All I am saying now is, none of this surprises me in the least.

[Mutt]

Hit stats for a NATS sponser. 2006. Hmm.

This is thin, thin 'evidence' though.

so shouldn't all NATS program owners be checking their server stats now for that IP?

[tdfcash3]

theres no stopping this thread is there

[borked]

so shouldn't all NATS program owners be checking their server stats now for that IP?

Why? Every time they log in to the admin in response to the ticket, you'll find that IP shows up in the logs. All normal behaviour. Noting out of the ordinary in that screencap.

If you reread the thread again, I think you'll find it's other, non-TMM IPs that are the problem.

[Johny Traffic]

theres no stopping this thread is there

what you doing over these parts with all the yanks

[Mutt]

owning a hosting company or affiliate software company would be about as stressful as it gets in this industry.

what if this isn't a hack of NATS but a new or even unknown exploit of mysql or apache - then NATS is just an innocent bystander and hosting companies are as much or more responsible?

[Tempest]

I'd say about 70% of the nats programs I sign up to (each with a very unique email address just for that program)... within about 3-5 weeks I start getting spam on that email address... Been mentioning it to some programs for a long time now but no one knows what to do about it... However... When I sgned up to topbucks as a member.. within 4 weeks I was getting spam on that unique email address.. processor Epoch... signed up to silvercash as a member.. within 4 weeks I was getting spam on that unique email address.. processor Epoch... I think the issue isn't just tied to 1 thing.

[tdfcash3]

what you doing over these parts with all the yanks

Says u with 4000+ posts!

[quantum-x]

Why? Every time they log in to the admin in response to the ticket, you'll find that IP shows up in the logs. All normal behaviour. Noting out of the ordinary in that screencap.

If you reread the thread again, I think you'll find it's other, non-TMM IPs that are the problem.

Right, I was just having fun with google, and posted the similar disclaimer under the photo. People like screengrabs, though.

[Drake]

I'd say about 70% of the nats programs I sign up to (each with a very unique email address just for that program)... within about 3-5 weeks I start getting spam on that email address... Been mentioning it to some programs for a long time now but no one knows what to do about it... However... When I sgned up to topbucks as a member.. within 4 weeks I was getting spam on that unique email address.. processor Epoch... signed up to silvercash as a member.. within 4 weeks I was getting spam on that unique email address.. processor Epoch... I think the issue isn't just tied to 1 thing.

What sites/products were being spammed?

[Mutt]

Why? Every time they log in to the admin in response to the ticket, you'll find that IP shows up in the logs. All normal behaviour. Noting out of the ordinary in that screencap.

If you reread the thread again, I think you'll find it's other, non-TMM IPs that are the problem.

so why did quantum-x post that screencap?

[RazorSharpe]

owning a hosting company or affiliate software company would be about as stressful as it gets in this industry.

what if this isn't a hack of NATS but a new or even unknown exploit of mysql or apache - then NATS is just an innocent bystander and hosting companies are as much or more responsible?

If that were the case then i would assume that it wouldn't be just the nats staff admin account that was compromised and being used. These people, (and i say people because the logins are from various areas like Tampa, San Deigo, UK) are specifically logging in with the nats staff admin account.

Furthermore, if it were a issue specific to mysql or apache then the internet itself would be ablaze with speculation about it in more than the adult affiliate sector.

...

[RazorSharpe]

You sure yap'd alot of nonsense in that post of yours, however, i don't think anything, unlike you. I know, since i have been shown emails where program owners have been notified, or i have notified them myself, and they ignored problem, untill it is brought up in a thread like this for example (i didn't say ALL, nor did i mean you since i dont even know you). So again, think before you speak, or don't speak at all, at least don't attack the person you know nothing about.


I don't have to point you anywhere since i dont owe you anything. I trade info, and you are not on my list of clients. Those that i speak of know it's them and they won't dispute my post. If they do, it'll get even funnier. I just stated how things are, whether you chose to believe it or not, it's your business, but i'm not gona stand by when clueless people attack me for what i know.


Furthermore, there's alot of backstabbing in this thread from people that supposedly "want to help". So nats got hacked. WOOO HOOO... What do you (or other in the thread) know exactly of the time that Mansion got hacked? Strongbox? Sitedepth? AdultWebware? Or any other shit that people use?
So some are furious that they have not been notified? LOL. Get a grip. Ofcourse John is not gona make a public statement their server is compromised (if it is), or that they have a problem in the code. It'd be a suicide. Same as when any other porn company gets hacked, you don't see a public apology here that people's emails/personal info got harvested do you? No, they fix the shit and move on (or don't even fix it and blame someone else). Or when software companies fix faults in their software on your server without you even knowing that it was a live exploit through which your server got hacked?

Shut the fuck up about "who you are" already, i think I have made it quite clear that I don't care who you are or what you do. I know all i need to know about you; most important of which is you have an extremely high estimation of yourself and think you know it all.

If there is anyone that needs to think before they speak, it's you. You're sounding more of an idiot with each passing post.

...

[chupacabra]

surely i cant the only one who may have hypothetically heard for years of the availablility of processor dbases for a hefty price?

no, your not... a couple of peeps from two now defunct processors *suggested* the same to me years ago, not mentioning any names here (TransCharge, Paymonde) so yeah... your not alone mang..

[RazorSharpe]

Okay, it seems banning the account makes no difference as the person is still able to login:

67.19.188.250 - 2007-12-22 09:30:32
67.19.188.250 - 2007-12-22 03:30:31
67.19.188.250 - 2007-12-22 00:23:23

I submitted a ticket to TMM yesterday telling them I could not secure the admin via IP since i run on a dynamic IP. They said they couldn't help me till tomorrow. I said it was serious and they said if I had banned the account it would be fine. Obviously not the case.

...

[DVTimes]

Good luck to all

[ladida]

Now as for this comment. I feel that if John knew it, HE doesn't need to make a public statement, but he does in fact need to let their clients, EVERY SINGLE CLIENT, know that one one of their servers has been compromised. But only if their server contains data about a clients machine (server ip, ssh port, ssh user, ssh pass, etc, etc). But at the same time, it'd be public because a client would post on GFY or one of the other boards. This also brings up the fact that any machine visible on the web should have a software firewall on their machine, iptables is fine. Block every port except those needed by web server (port 80, 443 and any others). Then only allow say for SSH the IP addy's needed for the certain people.

It might be a pain in the ass, but that's the best way to keep somebody out, even if they have your information, atleast they can't FTP or SSH into your box.

Yea, that would be the RIGHT thing to do.

But then, when a program gets hacked through other means then nats, and their whole customer base with info gets stolen, and affilate data gets stolen, would they also need to issues such a statement? Informing all of the affiliates that the data might be breached and that they should change their passwords? Hmm.. Double standards?

@RazorSharpe
Buuuhuuu, did i burst your buble of the perfect world?

[Chio]

Change your own admin pass after you deleted the admin account used to get in (if you haven't already)

If the attacker was able to get in to gank emails etc. Chances are he has your username/pass as well.

I've never used nats so I'm not sure if it's possible with the account they had but to be safe...

[JOKER]

Okay, it seems banning the account makes no difference as the person is still able to login:

67.19.188.250 - 2007-12-22 09:30:32
67.19.188.250 - 2007-12-22 03:30:31
67.19.188.250 - 2007-12-22 00:23:23

I submitted a ticket to TMM yesterday telling them I could not secure the admin via IP since i run on a dynamic IP. They said they couldn't help me till tomorrow. I said it was serious and they said if I had banned the account it would be fine. Obviously not the case.

...

Might want to think about setting up a VPN for this kind of secure access and the feature of a fixed IP then?

Is it not possible to .htaccess protect the admin-area of NATS as well, as an added layer of security on top of limiting the User-IP NATS internally? Just an idea.
I'm not running NATS as Admin so I wouldn't know, so this is just a suggestion.

[HS-Trixxxia]

I'd say about 70% of the nats programs I sign up to (each with a very unique email address just for that program)... within about 3-5 weeks I start getting spam on that email address... Been mentioning it to some programs for a long time now but no one knows what to do about it... However... When I sgned up to topbucks as a member.. within 4 weeks I was getting spam on that unique email address.. processor Epoch... signed up to silvercash as a member.. within 4 weeks I was getting spam on that unique email address.. processor Epoch... I think the issue isn't just tied to 1 thing.

Tempest - I can guarantee you, Topbucks never sent you one email. I STRONGLY suggest you send a copy of 'that' email or any email that you got with the account specifically to them to support. I will point them to this post either way.

[ladida]

Tempest - I can guarantee you, Topbucks never sent you one email. I STRONGLY suggest you send a copy of 'that' email or any email that you got with the account specifically to them to support. I will point them to this post either way.

No program has sent an email ever. That's the beauty. If you're at that stage that you receive email on the account, your data has already been traded. Hackers hack you and share info with their fellow hackers. Then spammers buy from hackers. So, when you start receiving spam on a dedicated email to a program, you're already few months behind the hackers.

[Barefootsies]

AlienQ invented suspecting

[RazorSharpe]

Yea, that would be the RIGHT thing to do.

But then, when a program gets hacked through other means then nats, and their whole customer base with info gets stolen, and affilate data gets stolen, would they also need to issues such a statement? Informing all of the affiliates that the data might be breached and that they should change their passwords? Hmm.. Double standards?

@RazorSharpe
Buuuhuuu, did i burst your buble of the perfect world?

Like I said, inflated opinion of yourself. You really need to learn how to be more humble. As it stands, you've neither busted my bubble or changed my opinion of you. You're still an arse ....

[TMM_John]

The amount of wrong information, assumptions, and completely wrong accusations here is astounding.

This will be my last post in this thread and possibly on this board. I am tired of people running around saying whatever they want and there being no repercussions for it. It is ridiculous and I'm not going to sit here and argue with them.

This fully appears to be a compromised password list. It is not an "exploit" in the software. It is not Fred spamming your members, etc. We have changed our policy so that we no longer maintain ANY passwords to ensure this does not happen via us ever in the future. We are also continuing to implement other protective measures.

Those of you who have actual valid feedback and comments I appreciate them. Anyone is welcome to contact us regarding this with their questions or concerns and we will be further communicating directly with our clients about it.

However as to dealing with the people who make their living making things up about other people, I'm done here.

[Ycaza]

Called Caz and threaten to sue for what - Letting people know about a serious exploit?? wtf

As the day goes on and more people keep coming to me saying "Thank You" it just keeps getting better and better. I'm at a loss for words right now.

Yep, threatened to sue me, and thats really all i am going to say here. OC3 has done a lot of work to help resolve this issue for our clients but our clients deserve most of the credit for helping us to find the problem. And for the record, when john said to me " I need yours and OC3's lawyers info, I twice told him that my cell number is in the thread about the issue, and invited him to call me. He never did.

[3xTom]

Just a simple statement that my momma taught me along time ago

Why does the farmer let the fox fix the whole in the fence?

Im not IMPLYING ANYTHING here guys ....
Just looking at the POSSIBILITY not any facts here at all

and john why is it immediatly blame on all your customers servers and no blame at all on yourself? Im just looking at all this here and I see alot of people having a problem INCLUDING US .......

And im seeing you blaming us and our servers/hosting its easy to point a finger.....

ANYWAYS THAT IS ALL I HAVE TO SAY....

[tdfcash3]

The amount of wrong information, assumptions, and completely wrong accusations here is astounding.

This will be my last post in this thread and possibly on this board. I am tired of people running around saying whatever they want and there being no repercussions for it. It is ridiculous and I'm not going to sit here and argue with them.

This fully appears to be a compromised password list. It is not an "exploit" in the software. It is not Fred spamming your members, etc. We have changed our policy so that we no longer maintain ANY passwords to ensure this does not happen via us ever in the future. We are also continuing to implement other protective measures.

Those of you who have actual valid feedback and comments I appreciate them. Anyone is welcome to contact us regarding this with their questions or concerns and we will be further communicating directly with our clients about it.

However as to dealing with the people who make their living making things up about other people, I'm done here.

What a total wanker you are!

[Drake]

It's very widespread and has been brought up on numerous occasions. Whenever it is brought up it gets the classic GFY response of belittling the messenger.
This is one that comes to mind, although it has come up many times before.
I use to use a unique email for every sponsor I joined, and with NATS sponsors the result was always the same, so I quit signing up to sponsors using NATS.
http://www.gfy.com/showthread.php?t=752142

The weird relationship that John and Quickbuck have doesn't make me feel any easier about the whole situation either. Considering the Quickbuck system is all NATS, I find this quote a bit odd. Business may be business, but how can either one of these companies do business with each other?

Originally Posted by Quick Buck
John albright owned porngraph and fucked all the porngraph users because it was not making any money... then he used the money he earned to build nats.

is this really news?.. are you really that dumb?

Quickbuck uses Nats and they said this? wtf

[Trixxxia]

Okay, it seems banning the account makes no difference as the person is still able to login:

67.19.188.250 - 2007-12-22 09:30:32
67.19.188.250 - 2007-12-22 03:30:31
67.19.188.250 - 2007-12-22 00:23:23

I submitted a ticket to TMM yesterday telling them I could not secure the admin via IP since i run on a dynamic IP. They said they couldn't help me till tomorrow. I said it was serious and they said if I had banned the account it would be fine. Obviously not the case.

...

RazorSharpe - I have an idea, want to hit me up?