Discussion Locked

$5000 reward for help with busting mean spirited cracker.

0 helpful
43 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This is sheer maliciousness, deliberately inflicted on countless undeserving victims.

The vandals should be drawn & quartered alive.

==================================================

Topics > Privacy & Security > Hackers >

Bulletin Board Service Hit by Hacker Attack

Hackers erased historical postings stored on several bulletin boards.

Cara Garretson, Network World
Thursday, June 09, 2005

Ezboard, which hosts service to hundreds of thousands of online bulletin boards, suffered a hacker attack on Memorial Day that permanently erased countless postings.

Unlike a typical attack that aims to bring down a service for boasting rights or steal sensitive information to be used in identity theft, the goal of the Ezboard breach appears to have solely been to erase historical postings stored on the company's servers.

"Someone decided to erase data from our users' boards and unfortunately really hurt a lot of innocent people," says Robert Labatt, CEO of Ezboard, which hosts a wide variety of sites including common-interest and support groups. "I have received e-mails from mothers, cancer patients, people upset with the impact this is having on their lives. With the loss of the posts, a lot of emotions went with them."

Suspicions

Ezboard has some ideas about who might be behind the attack, Labatt says, and is pursuing all possibilities with the help of the FBI. The company is also offering a $5000 reward to anyone with information that leads to the direct arrest and conviction of the hacker.

The company is not ruling out the possibility of the hacker being an insider. "There's a big different between script kiddies and malicious intent. It's more likely whoever came in here was not a script kiddie," Labatt says.

As part of its hosting service, Ezboard employs over 200 servers that store production and back-up data, and would not specify how many of them had postings erased in the attack. Labatt won't specify what security measures the company had in place. "Things you would imagine an organization like ours should have in place we have in place," he says. The company will undergo a security and back-up audit over the next few weeks, Labatt told Ezboard users in an e-mail.

Upon discovering the attack, Ezboard immediately began data restoration processes, although the company warns that it will be impossible to restore all data to all boards. As of yesterday, no one server that lost data in the attack had been completely restored.

The company does not believe financial or other sensitive information was taken in the breach, since Ezboard stores that data separately.

43 replies

by tagmarkman

I'm zoning in on data loss more than the hacker.

Did they have backups? If not, Why?

This is something that I see quite a bit. I used to be sensitive to it but there is just too much awareness not to back up data. I don't have the empathy for it anymore. Ezboard should be slapped on the hand if they didn't take precautions....

The cliche is true... "it's not if you will loose data but when."

What about recovery? If it was a simple delete there is a good chance to recover the data off the hard drives.

The following book is a must read for anyone interested in the data lost post: "Dark Ages II" It's a brilliant book that contrasts the burning of the Alexandria library to Modern digital data.

by apotheon

I know a guy who was running a board there that, among other things, had hurricane preparedness information collected on it. It was completely wiped out, and there's still no sign of any recovered data for that board. In the course of following this up with the service provider, we've discovered that, apparently, whoever the cracker was also accessed and deleted the backups.

Interestingly, this falls under the heading of "What types of backups should we use?" There's been some disagreement for some time now over what media should be used for storing backups. Increasingly, incremental tape backups are being phased out in favor of hard drive backups and, in some cases, optical media backups. While optical media backups would certainly be the least vulnerable of all the above, that's just not practical for anything bigger than a small office (say, less than twenty systems all told). Tape backups would be far more resistant to remote vandalism, however, as they are not connected and running with random access capability at all times. They're backing up, being used for a restoration, or not accessible, in a good backup solution. In order to affect them, then, one would have to alter all backup scheduling to trigger backups on all tapes immediately after live data had been wiped.

That, or you'd have to physically affect them in person.

Backup systems are generally designed to recover from accidents, and from attacks on systems rather than on data. Here's a case where those assumptions proved problematic, and it looks like a lot of people are paying for that. It's possible that everything was done right, and the cracker was simply thorough enough to get the job mostly done anyway. Until Labatt starts talking in more detail about his company's procedures, we don't know.

by tagmarkman

I've worked for companies with some extremely large data centers. They used Raid setups, for standard drive failures and full offsite redundancy through fiber plus two types of tape back up one for long term snap (stored offsite) and other for incremental changes (stored onsite). Although, a hacker, could possible destroy the data, even in the redundant servers, they would be hard presses to destroy the long term snapshot archives and if they were able to manage that, I would assume it would be apparent who that person was.

I understand that smaller systems can't afford such an elaborate setup but at the minimum, I would expect a tape backup (and not the same tape over and over). I would also expect snap shot tape backups to be stored offsite to recover data. Even if the data is "stale" at least it's a better starting point than no data at all.

An yes... until we have more detail, we really don't know...

by aceskaraoke

Backing up of data that doesn't change could've easily been done just taking care of whatever changes with incremental backup. True it would be more time-consuming to restore, but it would be there. It does seem amazing that the hacker was able to not only destroy the original data, but also all the backups. Must have been great planning for contingency. I'm just a student at ITT and I know one of the first rules of backups is storage in a remote facility. Sounds likely that it was someone on the inside to me though.

by deepsand

The anger that I feel towards the crackers is owing to the fact that, given the diversity of those impacted, it can hardly be the case that there was any connection between the perps & the victims, and therefore no possible justifications for causing them harm.

I see this as not unlike the case where someone sets fire to a barn, out of some animosity toward the owner of such, killing the animals trapped within.

Those without compassion deserve none.

by tagmarkman

I like that analogy...
Very visual...

Are we talking crackers or hackers?

Remember when hackers were just after information :)

by apotheon

The term "hacker" needn't have anything to do with computer security at all. I, for instance, am a Perl hack (I wouldn't be so arrogant as to call myself a hacker, yet, in that regard). This means I hack Perl code. It is done entirely on my own computer, though when I've written some code I often offer it to others, if it should come up.

A cracker, on the other hand, is one who "cracks" system or network security. That's an entirely separate animal. Let's not confuse the terms.

by jdclyde

the term hacker has been bastardised by the media and by hollywood so that in the minds of the mindless masses, hacker = cracker. Only difference is they don't even KNOW the word cracker.

Reality is preception and this word is ruined till the end of time.

Just like the Flintstones theme song is now a gay anthem instead of just being "happy".

by jmgarvin

I'm now using white hat, gray hat, and black hat. While I'd say most would fall into the gray hat category (oh look...and open door, let me peak in!) those black hats are sure getting out of hand. I've seen a lot more activity lately and it seems to be pretty focused on distruction. Now I know the typical stuff will be hit (PETA, fur sites, specific blogs, etc), but it seems (is it really...it doesn't seem to be showing up on the storm monitor) to be getting more frequent...

I also wish the media would latch on to this. There are good "hackers" (uh...hackers) and bad "hackers" (crackers). The media is pretty stupid when it comes to technology so their "experts" tell them the buzz words.

by tagmarkman

Fair enough.... I just see soooo many definitions thrown around in the past two decades I like people to define a little of what they mean.

For example... Cracker used to be know as someone that would crack programs by taking copy protection out of it. Hackers were people that "hacked" into systems even though it was also used to describe someone that hacked at code to get it to work. About a zillion other terms were used to describe differences of a similar strain... Pirates, Elite, Thugs, Phreakers, White Hat, Black Hat, etc... Some use improperly others not.

I suppose I was just tired when I asked that question an I didn't look at the content of the post too much.

by deepsand

experience; i.e., we sought to know & understand the inner workings & hidden mechanisms.

Would you call us "crackers?"

by apotheon

It depends on whose systems and what circumstances were. If the point was breaking into someone else's system without permission, then yeah, the person engaging in such activity is a "cracker", whether or not he or she is also a "hacker". It's not necessarily an either/or distinction.

"Hacker Good, Cracker Bad" is a little like "Automotive Mechanic Good, Car Thief Bad". Breaking into a car and driving it home so you can take its engine apart to learn about the internals makes you a car thief, whether you're an automotive mechanic or not. Testing out the workings of a slim jim on your own car, on the other hand, does not.

by tomsal

Ok...$5,000.00 ...well at least we know he or she is white. ;)

Sorry couldn't resist...

;)

by beads

Simple as this. EZ board though tremendously active and draws thousands if not millions of posts everyday is not a paid subscription service. Yes, you can donate money. Yes, you can pay for a "premium" account (no ads). Most folks don't. So, I wouldn't be surprised that if they were hacked, EZ board wouldn't have all the lastest and greatest technology available.

Don't get me wrong. I love EZ board as much as the next poster with over 5k in postings on one board alone. This has to be hard on the organization, itself. Personally, I applaud them even being able to come up with $5,000 as it is. For that matter, Sony Online Entertainment (Everquest I, II and Lords) should be throwing in some real money as most every "guild", class and subject matter related to EQ was bounced around on EZ Boards for years and still to this day! They alone have been the recipient of a much more lucretive windfall than EZ Board ever thought of because of those boards.

- beads

by deepsand

Since you seem to have more than a passing familiarity with both EZ & SOE, you might consider making a plea to SOE on EZ's behalf.

While it most likely will come to naught, other than a small amount of time it costs nothing to try.

by beads

Done! Actually, I created a bit of a 'stir' on EZ Board itself. Oddly, I haven't logged on EZ Board in probably 18+ months.

EZ Board is a good little company with too simple a plan to make money for too complex a task. Good idea but its probably a bit too free.

by deepsand

an insatiable curiosity re. the inner workings & hidden mechanisms of things.

Eventually, enough others learned how to use such knowledge to their own personal gain, forever tarnished a once proud moniker.

As an old timer, for me it's still "Hacker, good; Cracker, bad." Or, "HG" & "CB."

Cracker, of course, originated from "safe cracker."

by rojackson

There are also spanning programs that can write to CD/DVD. Given the inexpensive nature of this medium it is a distinct possibility for SMB's.

Can't believe the company did not have off site or at least off system (removable) backups.

This really smells like a vendetta. My guess is that it is either a disgruntled (ex-)employee that has something to prove...and real issues.

I realize that there are destructive crackers out there, but this seems real personal and thorough given they took time to wipe backup systems too.

The other disturbing thing is why no one saw suspicious activity...who was minding the store? I know that it was Memorial Day weekend but that's why God invented monitoring tools and pager interfaces for.

Sigh....

by deepsand

See beads' post below, at
[v]https://www.techrepublic.com.com/5208-6230-0.html?forumID=4&threadID=175947&messageID=1789373[/v]

by tagmarkman

Optical can be a solution as well but depending on its size, it might not be a viable option. In my professional environment the medium is simply too small even with multilayer DVDs. However, it works quite well with my home system (at least for system snapshots) and the cost is down to earth with both the burners and the medium.

by apotheon

For rapidly changing high-load large-scale databases, optical media backups are just not an option yet. Until solid-state holographic recording media are "perfected", I rather suspect optical media will "never" be an option in such circumstances. Thus, tape backups still seem to have a place in the world.

by tagmarkman

That is beautiful... If it weren't for unix and web cookies, I might have actually adopted that and used it in one of my conference speeches. :)

by deepsand

perhaps you can get some mileage out of that angle.

Better hurry, thought, while they're still around. At the present rate, we'll soon need to use a different method for providing persistency across a stateless process.

by deepsand

Early on, the only access was via the command console.

With the intro. of System 360, non-interactive access via batch jobs became possible; shortly thereafter, limited interactive access, via RJE (Remote Job Entry) terminals, generally co-located with the mainframe, appeared.

The issue then was not one of gaining unauthorized access to the system, but one of gaining access to those functions which were hidden from the users.

As an analogy, one had permission to use the car, but not look under the hood. Early programmers & operators were quite curious by nature, and hacking then consisted of trying to get under the hood, so as to figure how how everything worked. Bear in mind also that here was then no equivalent of, for example, the [i]Chilton's Manual[/i], so that learning was here very much a process of self-teaching through doing.

by deepsand

As an example, witness the dearth of restaurants offering "all you can eat" specials, relative to 20-30 years ago.

Of the few that still do, the choice of foods is either much more limited and/or the prices have increased substantialy above that born of inflation.

Anytime one offers to fulfill an unlimited demand, for a finite supply of goods or services, at a price below the market's equilibrium point, a buying frenzy will surely ensue.

by apotheon

There's nothing wrong with reverse-engineering, which consists essentially of doing what you're allowed to do (even if in unintended ways) and figuring out what's hidden from you based on the results, but actually doing things to someone else's property that you've been expressly forbidden to do is another story. If you're using someone else's computer, and you're given explicit instructions on what you are and are not authorized to do, deviating from those restrictions isn't strictly ethical. That's just the way it is.

If someone loans you her diary to use as a writing surface to take notes, but tells you you're not allowed to look inside, then the ethical thing to do is to avoid opening it. Period.

by aceskaraoke

It's just deplorable that these sociopaths have the power to ruin so many lives. Why waste your talents making the world a little bit worse, instead of better.

by tagmarkman

"It's just deplorable that these sociopaths have the power to ruin so many lives. Why waste your talents making the world a little bit worse, instead of better."

I agree... Why a little worse than a little better... I think it's horrible what was done.

On the flip side, I think we need a little bit of a slap in the face once in a while to give us a reality check. If an organized union of some type came out of nowhere... we'd be screwed... at least we have some slaps on the hand now and again to remind us that the world isn't always a nice place.

by jmgarvin

A hacker doesn't steal the car, but he hides in the car so the driver can still drive it. Sure it might be a little slower and it might lose a wheel or two, but in the end the hacker did nothing (on purpose) that was malicious.

A cracker would steal the car and not allow the driver to drive it...the cracker would then bring the car to a chop shop and part it out for his friends.

by apotheon

It's more like this:
A hacker would examine his own car in his own garage to figure out how it works. A cracker would break into your garage in the middle of the night to examine your car to figure out if it works, all without permission. It's not so much the examination of the car that's a problem. The problem is the breaking and entering.

by deepsand

mankind's body of knowledge would be but a small portion of what it now is.

And, the lot of most would be much the worse.

by deepsand

See below post, at
[v]https://www.techrepublic.com.com/5208-6230-0.html?forumID=4&threadID=175947&messageID=1789373[/v]

by apotheon

You just used the "ends justify the means" argument. I'm afraid there's no agreement possible between us at this point.

by deepsand

In the discussion re. IP, you maintained that you had the right to gain from the use of the discovery of another, even tough you lacked his [i]express permission[/i] to do so, on the grounds that one cannot claim title to knowledge.

Yet, here, you take the position that one [i]does require permission[/i] in order to acquire knowledge.

To hold that the acquisition of knowledge be held to a higher standard than the use of such strikes me as contradictory.

by apotheon

You're confusing ends and means here. One has no title to knowledge, but one has rightful possession of that on/in which it is recorded. To access that without permission, by force, is to violate rights. For ethical purposes, "force" in this case includes deceptive practice as well as violent.

by deepsand

By what logic is the presence or absence of "force" pivotal?

And, whose definition of "force" takes priority?

by apotheon

the logic: I'm operating on a system of ethics whose central principle is that initiations of force are wrong. Considering I've already justified such an ethical principle with a logical progression from [i]cogito ergo sum[/i], I'm not really keen on revisiting this just because you would rather filibuster than address the issue at hand.

This discussion is closed to new replies.