HOW they get ouer emails??????

[IndianScout]

Re: HOW they get ouer emails??????

I'm already on it..

[ZackAttack2005]

Re: HOW they get ouer emails??????

I got 3 emails from "admin@bf2s.com"

subject : "WARNING: New MXSecurity BF2 Aimbot..."

it got put in my junkmail, im not opening it though...

as smart as i am ( not really) i opened it, i dont think have a virus, but it was just a bunch of script...but it was encoded so i couldnt read it cause i dont know how to decode it.

[[MyIS]Spetsnaz]

Re: HOW they get ouer emails??????

there is a program that you can use to hacks sites if they have a pop up ussername an password option like we do here.
you run the program this will hack the site an give them (the hacker) a list of ussernames an passwords.
then all they do is go in to your account an check the email addys an send out the spam mail.

Wrong. You've been watching too many movies kid.

All passwords in our database are salted hashes. There is no way to decipher an SHA-1 hash, unless you brute force it and get lucky... something that you can't do over the web without being noticed really really quick.

[imported_cybercrow]

Re: HOW they get ouer emails??????

Wrong. You've been watching too many movies kid.

All passwords in our database are salted hashes. There is no way to decipher an SHA-1 hash, unless you brute force it and get lucky... something that you can't do over the web without being noticed really really quick.

^wrong kid^
first im not a kid im 32 ive been hackin websites for years,the ones that use pop up usernames an passwords are the easyest to get into.
an for watchin movies where do you think they get the ideas from what are in movies.
yes they get them from the real world sorry to say.
they got the email addys from some where so whats your point?
all this proves is that your site is harder to hack or not hackable at all.

[Eden]

Re: HOW they get ouer emails??????

Wrong. You've been watching too many movies kid.

All passwords in our database are salted hashes. There is no way to decipher an SHA-1 hash, unless you brute force it and get lucky... something that you can't do over the web without being noticed really really quick.

So true, two days after I got my server I had someone trying to access over 400 non-existent account about 4-8 times each :laugh:

I contacted the company who rented the server the guy used, not that they have done anything about it :|:

[[MyIS]Spetsnaz]

Re: HOW they get ouer emails??????

^wrong kid^
first im not a kid im 32 ive been hackin websites for years

Heh... no you haven't.

First of all, what you're referring to is cracking. Hacking is actually defined as plain ol' programming (hacking away at the keyboard). Cracking is basically defined as breaking into a system that isn't yours with tools created by the hacker.

When you say you've been hacking websites for years, you're telling us that you've been creating websites for years.

Regarding our information, what are "popup" usernames? You are aware that the "popup" when you click someone's profile is simply Javascript animating a DIV element that is absolutely positioned on the screen.. right? It has absolutely nothing to do with anything.

Don't make assumptions about our security if you don't know what you're talking about sonny.

[imported_cybercrow]

Re: HOW they get ouer emails??????

Heh... no you haven't.

First of all, what you're referring to is cracking. Hacking is actually defined as plain ol' programming (hacking away at the keyboard). Cracking is basically defined as breaking into a system that isn't yours with tools created by the hacker.

When you say you've been hacking websites for years, you're telling us that you've been creating websites for years.

Regarding our information, what are "popup" usernames? You are aware that the "popup" when you click someone's profile is simply Javascript animating a DIV element that is absolutely positioned on the screen.. right? It has absolutely nothing to do with anything.

Don't make assumptions about our security if you don't know what you're talking about sonny.

i stand corrected,sorry but 1 thing
"When you say you've been hacking websites for years, you're telling us that you've been creating websites for years."
stop talkin sh1t
"First of all, what you're referring to is cracking. Hacking is actually defined as plain ol' programming (hacking away at the keyboard). Cracking is basically defined as breaking into a system that isn't yours with tools created by the hacker.

When you say you've been hacking websites for years, you're telling us that you've been creating websites for years."
your contradicking your self here.
sorry for the spelling

[signa]

Re: HOW they get ouer emails??????

interestingly enough I got a blank email from webmaster@totalbf2.com the other day. maybe someone was phishing the login.

[SIZE="2"]X-Message-Status: n:0
X-SID-PRA: webmaster@totalbf2.com <webmaster@totalbf2.com>
X-SID-Result: TempError
X-Message-Info: 6sSXyD95QpU8Dp2XXMRBoqjlxFHfpzprtlXS4Puy4wM=
Received: from apollo.myinternetservices.com ([64.27.28.153]) by bay0-mc5-f11.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.1830);
	 Wed, 19 Apr 2006 22:19:13 -0700
Received: from nobody by apollo.myinternetservices.com with local (Exim 4.52)
	id 1FWRZQ-0003cJ-MX
	for [i]removed[/i] ; Wed, 19 Apr 2006 22:19:12 -0700
To: [i]removed[/i]
Subject: 
From: "webmaster@totalbf2.com" <webmaster@totalbf2.com>
Message-ID: <200604200512.932b4f874179@www.totalbf2.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Date: Wed, 19 Apr 2006 22:19:12 -0700
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - apollo.myinternetservices.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - apollo.myinternetservices.com
X-Source: 
X-Source-Args: 
X-Source-Dir: 
Return-Path: nobody@apollo.myinternetservices.com
X-OriginalArrivalTime: 20 Apr 2006 05:19:13.0137 (UTC) FILETIME=[F618C610:01C66439][/SIZE]

[TokenBrit]

Re: HOW they get ouer emails??????

I think this thread is a good idea and it would be great if people would stfu about accusing this site or any other of having inadequate security. The most obvious way to figure it out is for each person to post which sites DO have their personal email addresses stored. There should be an obvious correlation that tells us which site(s) are responsible for losing our email addresses and possibly other sensitive information!

For my part I am registered here,
I received the email at my actual BF2 associated email address,
Also bf2tracker.com.

These are all I can remember off hand, I have personally received one email.
Anybody else?

[Sir. bzb]

Re: HOW they get ouer emails??????

You could gather a list via the error response when you enter an invalid user name or password, as in 'error invalid username' or 'error incorrect password' rather than the more security minded response of 'invalid username or password' for both errors (which i think the vbb gives). You cant get a list of pw's that way but you would be able to gather valid e-mail address's from a site using the e-mail address as the user. However it would take you forever to get a worthwhile list of address's that way and it would be the kind of activity that sticks out like a sore thumb.

Vbb's are pretty safe, weakest link is always the admin password, although that is the same risk for anything, as most attacks on vbb's are designed to crash the server running them they arent designed to allow the sort of spaming youd need to crack a password. Other options are a bit over the top just to get a mailing list. What sort of a robber breaks in and takes only your address book? Third party addons or misconfiguration can open up holes i suppose and the information did come from somewhere.

Im only reg'd here, bf2tracker and with ea on this address- in relation to BF2.
It does seem obvious that this is targeted at deffinate BF2 players, which would suggest someone has had access to a BF2 related database of e-mails and that doesnt mean they needed to hack anywhere, its even possible that EA released the information to third parties for research purposes or the like and that they had a leak. Its even possible an employee let his 'trustworthy' kid play on his laptop. Information is quite easily available without the need to hack anywhere.
The e-mail itself doesnt seem to read as if anyone of mighty brain power worded it, it does find its way nicely to the junk folder and surely an uber l33t hax0r would at least comprehend how to avoid the junk mail filter, even with a little primitive research.

[pertti_pasanen]

Re: HOW they get ouer emails??????

For my part I am registered here,
I received the email at my actual BF2 associated email address,
Also bf2tracker.com.

I have
3 Addys used for bf2 profiles
1 addy here
0 on any trackers

got spam to the addy I've used here and bf2 , no spam on others ive used in bf2.

[slayerdog99]

Re: HOW they get ouer emails??????

1 addy bf2s
1 addy ea downloader site
1 addy here
0 elsewhere

[old sch00l]

Re: HOW they get ouer emails??????

What sort of a robber breaks in and takes only your address book?

Some one who wants to mass market their stuff to the BF2 masses, maybe they want to boost sales?

1 addy bf2s
1 addy ea downloader site
1 addy here
0 elsewhere

[CommanderD]

Re: HOW they get ouer emails??????

Very strange, lets reliate and Denial of service their site, and if they are hacking just get their hosts abuse email adress and file a complaint.

[WarGimp]

Re: HOW they get ouer emails??????

The most likely breach for this is EA's stats server.
I have two BF2 accounts linked to the same e-mail. I got 2 copies of the e-mail. I didn't use that e-mail adress to register on BF2s. A friend of mine hasn't registered on any BF2 community site, but he still got an e-mail.

A little application of Acum's Razor (the most obvious answer is usually correct) points us towards EA as being the weak point.