Continuing further:
On Saturday the 14th, the hosting site was contacted and the situation was explained to the security department. An investigation was opened and within several hours, I was sent the results.
Host Gator: wrote:Looking through the logs, I see that the IP 72.224.96.8 mostly viewed various topics on the site but never registered for an account. On August 30th we see that this user logged into the dcooper account and from there, they accessed the admin area and modified permissions on the accounts. This suggests that the password for the dcooper user was compromised.
We have reset the following logins:
Username: Hut Master
Password: xxxxxx
Username: Rose
Password: xxxxx
Username Kim
Password: xxxxx
Username Lager:
Password: xxxxx
Please update the following vulneravble software installations to prevent future security compromises:
Here is a sample of some of the logs from the host site:
Logs:
72.224.96.8 - - [31/Aug/2012:18:20:46 -0500] "GET /forum/adm/index.php?i=users&mode=overview&u=55&sid=032ddfb88d23c9a12e1123c1a269c67a HTTP/1.1" 200 12141 "http://www.ttownsendbrown.com/forum/memberlist.php?mode=viewprofile&u=55" "Opera/9.30 (Nintendo Wii; U; ; 3642; en)"
72.224.96.8 - - [31/Aug/2012:18:20:46 -0500] "GET /forum/styles/milky_way_red/theme/images/tbl_f_l.png HTTP/1.1" 404 3354 "http://www.ttownsendbrown.com/forum/adm/index.php?i=users&mode=overview&u=55&sid=032ddfb88d23c9a12e1123c1a269c67a" "Opera/9.30 (Nintendo Wii; U; ; 3642; en)"
72.224.96.8 - - [31/Aug/2012:18:20:46 -0500] "GET /forum/styles/milky_way_red/theme/images/tbl_f_c.png HTTP/1.1" 404 3354 "http://www.ttownsendbrown.com/forum/adm/index.php?i=users&mode=overview&u=55&sid=032ddfb88d23c9a12e1123c1a269c67a" "Opera/9.30 (Nintendo Wii; U; ; 3642; en)"
72.224.96.8 - - [31/Aug/2012:18:20:46 -0500] "GET /forum/styles/milky_way_red/theme/images/tbl_f_r.png HTTP/1.1" 404 3354 "http://www.ttownsendbrown.com/forum/adm/index.php?i=users&mode=overview&u=55&sid=032ddfb88d23c9a12e1123c1a269c67a" "Opera/9.30 (Nintendo Wii; U; ; 3642; en)"
72.224.96.8 - - [31/Aug/2012:18:21:16 -0500] "POST /forum/adm/index.php?sid=032ddfb88d23c9a12e1123c1a269c67a HTTP/1.1" 200 8019 "http://www.ttownsendbrown.com/forum/adm/index.php?
The IP that dcooper originally joined the forum from is 72.224.96.8 and the join date was Fri Jul 06, 2012 4:31 pm. The IP is identical to the intruder's IP.
It should be noted that dcooper has claimed that he always uses his Wii for he can't afford a computer and a Wii is the system that the intrusion originated from.
Later on the same day, the software was updated to correct certain security defects but the "code" that was allowing Linda Brown's account to have full authority remained. To find and remove this code is not cost productive so it will remain but Linda Brown will not have access to the Hut.
As to dcooper admitting that he was in there, here are the communications that occurred between him and one of the admins who monitor this site.
Here he was asked about transferring permissions;
dcooper wrote:Re: Care to explain?
Sent: Sun Sep 02, 2012 6:27 pm
by dcooper
I was trying to figure out some things on this forum that I am not shore of, Clicked that to see what it was it said needs to be restored...... I am sorry if I cause any trouble, I did not know what it was so I clicked it, I did not know that I was unable to do some things, Agian I'm sorry, If i caused any trouble.
But I still do not know what Permission transferred from Mikado14 I clicked it and said needs to be restored is?
Please do not banned me, I'm sorry -dcooper
It should be noted that even for a Moderator or Admin, the transfer of permissions to check out a members settings can only be done from the admin panel. So, if this young man clicked on anything it is apparent that he was into the admin panel.
And another correspondence:
dcooper wrote:Re: And yet another
Sent: Sun Sep 02, 2012 6:36 pm
by dcooper
Yes indeed I was viewing a profile, I sometimes do that on linda's forum and the living moon to see when they were last login or/and to see what the post,(quicker results if you wan't to find a post by them) I looked at linda's to see the same thing, I also notice I can not see all the members (to see who's here) Agian I was not aware that I am unable to do that and I'm sorry. I did not ment for trouble. -dcooper
No member should have the permission to view another's profile which proves the logs found by Host Gator that permissions were transferred.
And here is Lager's response:
Lager wrote:dcooper wrote:dcooper wrote:
Re: And yet another
Sent: Sun Sep 02, 2012 10:44 pm
by Lager
dcooper wrote:
Yes indeed I was viewing a profile, I sometimes do that on linda's forum and the living moon to see when they were last login or/and to see what the post,(quicker results if you wan't to find a post by them) I looked at linda's to see the same thing, I also notice I can not see all the members (to see who's here) Agian I was not aware that I am unable to do that and I'm sorry. I did not ment for trouble. -dcooper
dcooper wrote:I was trying to figure out some things on this forum that I am not shore of, Clicked that to see what it was it said needs to be restored...... I am sorry if I cause any trouble, I did not know what it was so I clicked it, I did not know that I was unable to do some things, Agian I'm sorry, If i caused any trouble.
But I still do not know what Permission transferred from Mikado14 I clicked it and said needs to be restored is?
Please do not banned me, I'm sorry -dcooper
First of all, you never had permissions to access the Administration Control Panel and you just can't inadvertently just "click" on something. The log clearly shows that you were in the admin section. Secondly, there is another log that shows the same thing through the cpanel of the server. So please don't insult me with your poor grammar and misspellings when I have noticed that you are capable of so much better.
Secondly, it is impossible for any member to have the ability, unless you are a Moderator or an Administrator to have the ability to transfer permissions from any user. Again, the log indicates something other than an accident both on the php and the cpanel of the server.
On the off chance that this is a glitch, I will accept your explanation but understand that it has been reported to the host, a log has been made, your IP has been reversed traced. From what I understand, you are a minor and you wouldn't want to this to go further so, if it was an accident then I suppose there will be no more logs. If this happens again, that would be the second infraction and it will go further.
Host Name: cpe-72-224-96-8.maine.res.rr.com
Browser/OS: Opera/Nintendo
IP Address: 72.224.96.8 —
dcooper Mobile Device: Nintendo Wii
Location: Bangor, Maine, United States
Resolution: 800x472
Your IP has been reversed traced to the local switching station.
We will let this ride for now but I will have to report this to the owner of the site.
However, there remains this:
index.php
2 Sep 05:10:35 PM
The Quonset Hut • Who is online
viewonline.php
2 Sep 05:10:38 PM
The Quonset Hut • Who is online
index.php
2 Sep 05:10:46 PM
The Quonset Hut • Who is online
ucp.php?mode=login
2 Sep 05:10:47 PM
The Quonset Hut • Index page
The times are Pacific, you responded at approximately 6:30 EST on your PM's. Notice a problem? The above times are 8 PM EST which are a little later than when you sent the PM's. You are still accessing the "who is online" function and your permissions are not set to allow that. How is it that you are able to?
Your permissions have been reset. This is your last and only warning.
Lager
The evidence strongly suggests that for all the past months, Linda has expressed that she would never come on the Hut and post...ever again. Two weeks after the above, Linda wants her password reset so that she can post. This woman changes her mind more times than the sun changes position in the sky during the day. But all of a sudden she wants on. What would she have done if I just resent the password? I believe that she knew exactly what she was doing and when the dust settled, she would have claimed it was Morgan or twigsnapper or even Chuck Norris. But then she would be an accessory if she took advantage of it and I know she would have for she feels bullet proof. Oh, and here is a bit of a warning to you, you are being watched for they have come to me and asked questions. I have repeatedly told you to shut the hell up but you won't, history shows that.
Now it should be noted that what dcooper has done is a felony. He is a kid. A misguided one and I hope that this little incident will teach him a lesson and I will let it go. A part of me feels violated in that he hacked into this site. At whose beckoning was this done? Did he do this alone? Did he hope to gain favor with someone? There was talk in Linda's circle that I might do something as this. Never. It is wrong. I have always spoke the truth when it came to Linda and her phantom alphabet agencies...oh hell, say it like it is...when it came to Dave Smith and Harold Garrity and Chuck Norris. She took real people and gave them lives they never knew existed for them and she expected everyone to believe her, even when the truth came out.
But look at what has happened. I was bombarded with email from Linda for the past several days but after I posted the above...nothing. Truth stings, doesn't it?
You will get your wish Linda, your account is being deactivated just as some of the others requested but you must understand this, your name and all the posts will remain just as theirs have.
Your IP will also be banned but not until you have had time to read this. Have you wondered why I haven't been posting? Because you aren't worth it anymore. You are surrounded by those that neither have much or are worth much. They need stories and fables to hang their hat on and they will certainly get it from you. I feel compassion for you. You are trying so hard to gain recognition by hanging onto your Father's coattails and you will do and say anything to that end. Even use a 17 year old boy from Maine. I will not ruin his life. You already have for he was reported by IP and name ( shouldn't have used your real name Dylan) in a database of hackers. Don't get caught again Dylan but I really don't know what they would do but don't do so here, I won't be magnanimous.
Mikado