3 ms·
Yeah, it sounds like someone was aware of an old copy (2010-03-03) of a database backup sitting on some "personal" server? Was it the https://forum.linode.com
by downer85 13y ago
Yeah, it sounds like someone was aware of an old copy (2010-03-03) of a database backup sitting on some "personal" server?
Was it the https://forum.linode.com https://forum.linode.com forum? It looks like it does run on PHPBB...
In theory, it sounds like the goal of the SWAT was to clear the building of employees, and break into the target server, while no one would be sitting at an office workstation, and thus rendered incapable of disrupting the attack. It sounds like all that effort actually worked.
So then, after everyone returned to the office, staff discovered the intrusion, and they performed a password reset for anyone who hasn't changed their forum password since 2010.
But! Were the forum credentials valuable? Do people do things like mine bitcoins with their hosting? Is the PHPBB MySQL database isolated from all other user credentials, or is there overlap?
- akerl_ 13y agoThe only credentials that were accessible were hashed forum passwords from the time of the restore (all of which have been revoked), and forum accounts are not linked to any other Linode systems.
- wcummings 13y ago"SWATing" is a common "prank" skids pull. Good money says the attacker did it for the same reason they stole the db (they can), you guys are hugely over-thinking this.
- shitlord 13y agoYeah, I think Brian Krebs was also SWAT'd.