My ATS Account just got hacked

originally posted by: BernnieJGato
a reply to: AlroyFarms

I think your cat avatar is more chonky since last night!

it does look a little fatter don't it.

Yes!

Did you 'stretch' it or manipulate it? Or have I been awake too many hours at this point.

a reply to: UpIsNowDown2

No, I don't think that will work... I can't remember if you have to receive a confirmation email when it is changed. If so, then it won't work.

a reply to: Encia22

I'm on a roll now.

Thanks.

Go, go Godzilla!
😂

a reply to: Oldcarpy2

Looking good, Billy Ray!

a reply to: UpIsNowDown2

🙏. Thanks. Am no longer a dirty pinko commie.

a reply to: AlroyFarms

es! Did you 'stretch' it or manipulate it? Or have I been awake too many hours at this point.

didn't do a thing, they kept editing it last night if you didn't see that, putting something over the head.

a reply to: Encia22

Bless your heart ❤️

a reply to: FullHeathen

I have a wild theory about how this hack may have been done.

Some have noted that they had slowdowns opening the site in the days previous, and particularly with the Firefox browser on Windows.

The Firefox browser has a few debug logging modes, and possibly also some mechanisms to send those logs back to the devs for them to examine so they may resolve bugs (the default is Bugzilla).

My 'wild guess' (not entirely researched as yet) is that this debug mode could be triggered by some CSS or other invisible tag embedded in a post or in someone's profile, and that as Mozilla is an open source company, with numerous independent developers, that the upload target for those logs could probably be reset in the same code that enables the debug logging.

The other option is that the hacker could simply look up specific logs submitted under their login authorization on Bugzilla, and your data would not be noticeably much different to any of all the other stuff logged there.

I do know that setting a couple of environment settings in Windows will automatically enable debug logging when Firefox is started. Namely:

set MOZ_LOG=nsHttp:5
set MOZ_LOG_FILE=http.log

I don't imagine that setting the upload target for the logs would be openly documented as it is probably very proprietary information, and only for registered devs who have signed NDA's. However, as the code is open source, it wouldn't take a genius to find the 'keys to the kingdom' if they knew what they were looking for, even if they are somewhat obfuscated in the source code.

I propose that the debug logs contain both the user names and passwords typed, or stored in the browser, and therefore someone may use them to access ATS, logged on as their victim.

I don't use Firefox and so I can't just verify any of this easily, but if I am right, all those people whose ATS were compromised (and probably others who the hackers never got around to doing), and who use Firefox may have usernames and passwords to other sites (including Banking) compromised as well.

I would suggest that it may be advisable to use another browser and to go through resetting important passwords.

Of course, I could be wrong in this, but it is worth just checking your system for the environment settings (go to a command prompt and type "SET" and press the 'enter' key and it should list them all out). Also, just until someone can clear the reputation of Firefox, it would probably be a good idea to avoid a browser built on Firefox/Mozilla base code.



Using 'about:logging' in the URL bar within the browser will tell you the status.



If logging is on, and you have not explicitly set it on, then you are compromised. Please respond into this thread if such is the case, especially if your avatar got hacked.

a reply to: Encia22

Feeling good Louis.....


Also, there is someone actively changing the avatars and I have changed my password so that means nothing.

like i said earlier in the thread, i think it's one of two people doing a revenge hack. one has permissions the other has demonstrated once before they can hack the data base and change things, even took over the one who had permissions account.

originally posted by: BernnieJGato
like i said earlier in the thread, i think it's one of two people doing a revenge hack. one has permissions the other has demonstrated once before they can hack the data base and change things, even took over the one who had permissions account.

Hmmm a conundrum to be sure.

originally posted by: ArMaP

originally posted by: xuenchen
Needs clarification also.

Clarification of what?

Members wanted to be sure the Mod that removed the bad signature pictures was actually a Mod and not the rouge person editing the Member accounts. We now know it was legitimate, thanks.

a reply to: chr0naut

What about Firefox for Android? I haven't used Windows in years.

Did anyone get hacked using any other browser or an Apple device?

originally posted by: BeyondKnowledge3
a reply to: chr0naut

What about Firefox for Android? I haven't used Windows in years.

Did anyone get hacked using any other browser or an Apple device?

If it is built on the same code, it may have the same vulnerabilities regardless of platform.

I'd check with the about:logging just to be sure that logging is not somehow turned on.

I'd also imagine that logging on mobiles would have a bigger impact on system performance than on larger PC systems?

After consideration, I have started a new topic thread on this: Wild, but possibly very important, theory about recent hack! !!!!!!!

originally posted by: Encia22

originally posted by: Oldcarpy2
a reply to: Encia22

Not working.

Here it is even smaller.

Were you able to upload the images to your ATS gallery?

Don't bother copying and uploading the image. Just copy the address of the image into your account settings, your avitar, and submit it.

files.abovetopsecret.com...

Everyone uploading it is unnecessary.

a reply to: Encia22

Since we're on the subject of avatars, remind me where you got yours. I lost the link you shared a while back and mine is due for an upgrade.

originally posted by: BeyondKnowledge3

originally posted by: Encia22

originally posted by: Oldcarpy2
a reply to: Encia22

Not working.

Here it is even smaller.

Were you able to upload the images to your ATS gallery?

Don't bother copying and uploading the image. Just copy the address of the image into your account settings, your avitar, and submit it.

files.abovetopsecret.com...

Everyone uploading it is unnecessary.

Yep, you can do that, but beware, the link is to my image gallery. If I were to remove it, it will be lost across the bpard.

[snipped rude remark]

How long is going to take you to understand...this site is seriously compromised??

They have your profile...they have your passwords...they have your emal...they have...EVERY-THING!!

How can y'all not see this???

Everything you post (can be manipulated)...everything you are (avatar, signatures, etc) (can be manipulated).

Can y'all not understand???? Jeezus!!

Hey, ATS was fun (very), for many years. ATS was even very informative, for a long while. BUT...right now...ATS is STRAIGHT UP DANGEROUS!!

If you can't see it, well...then best of luck to you!

That is all

originally posted by: TzarChasm
a reply to: Encia22

Since we're on the subject of avatars, remind me where you got yours. I lost the link you shared a while back and mine is due for an upgrade.

Give me a day, it's on my work PC.

a reply to: Flyingclaydisk