TSR: In Ur Accounts, Deletin Ur Stuffs!

[Anouk]

Hi All,

I've spoken with TSR regarding this matter, and they informed me that they had a security breach about 3 months ago that may have left subscriber accounts vulnerable. If this information is indeed correct, it's possible that a third party could have logged into both buggybooz and Thomas accounts.

It's also entirely possible that other accounts have been compromised, which is why it's strongly advised to change your passwords anywhere where they are the same as at TSR. While the initial evidence indeed pointed to a TSR-owned account on MTS2 being used to initiate this attack, no actual hacking was done on MTS2 itself. The information supplied by TSR is worth thinking about, and indeed, I will be the first to admit that - at the time - I was annoyed about the whole thing and thought that this was a new low.

When this attack happened, my first concern was for how it happened, and then for restoring any damage done to buggys account. I worked with her for hours today in chat, as I mentioned in my first post, and we went through and restored everything. It was only after this was done that I decided to post up up this thread.

At the time, we believed that, given the evidence at hand, this was either a (very stupid) TSR sanctioned move, or one by a TSR staff member with access to the accounts. Given the lack of evidence to point elsewhere, I felt that, as this was a seemingly direct attack on a creator on *my* website, to get as much information out publically as possible. It is, however, with this new information about a possible security exploit, not 100% clear that, indeed, this was TSRs doing. Obviously neither I nor anybody else here knew about the alleged vulnerability, and the information to hand strongly pointed to a direct link.

I am willing to consider the possibily that this was not TSR sanctioned, but this raises other questions, particularly about the timing of the attacks and access to information that I simply don't have answers for right now. The evidence itself, however, remains unchanged. The IP addresses and screenshots are only edited to blur out any other users details and contain the real information as gotten from the MTS2 backend - and the validity of which is not disputed in any way by TSR. Regardless of the evidence at hand, there any many more questions that need addressing, and precious few answers right now.

The issue of the stolen content is still one that I, personally, would like to get cleared up and from comparing the downloads, there is some issue about the source textures, UV mapping and mesh for the Featured Artist to answer. I hope that TSR investigate this as an urgent matter.

For now, though, lets assume that this may not have been, indeed, a TSR sanctioned move - and I think we all agree that this would be a particularly stupid thing to do. I have to wonder as to the motivations and reasoning behind this apparent attack. What would somebody have to gain by deleting only a specific creators uploads, especially since any and all details would eventually come out publically? This entire thing has left a bad taste in my mouth, and while I don't like the idea of paysites, I also don't like the possibility of my being used and looking stupid.

Regards,
Delphy

So does TSR explain the timing and the fact that Buggybooz has had NO reaction from TSR on the issue of her stuff being stolen? Why BuggyBooz and why just when her stuff was reported as being stolen by Shakeshaft?
Ultimately, only someone with inside knowledge could have done it, so I think they're going to pin this one on the apparently allpowerfull and amazing HAX0R Coconut.

Another question: Howcome this third party has used the same ip as Thomas has regularly used for Thomas's account on MTS2? Even if you breached it, that should not be possible.

[neriana]

We should start a forum pool, complete with odds. Who will TSR try to pin it on? Will it be coconut? They want to discredit him/her badly. Atwa? I've always thought Thomas just keeps her around so they can throw her to the sharks when necessary. Pescado? Just because there are people who would believe it.

[SoggyFox]

Wait - three months ago was when the 'hacking' happened in off hours to Cyclone Sue and Windkeeper's pages, right?  Yeah......I buy it.

[siberiansunset]

Another question: Howcome this third party has used the same ip as Thomas has regularly used for Thomas's account on MTS2? Even if you breached it, that should not be possible.

Exactly. Obviously the hacker was using his internet access. *Cough* So who could that be?

Yeah, right.  I'm TOTALLY convinced these "hackers" (if they exist) held on to this information for 3 months, and only chose to use it now.  And I believe in Santa, the Tooth Fairy, and the goodness of EA, too.

EDIT TO ADD: Oh, and way to go TSR.  If you did have this alleged security breach, why didn't you advise your members at the time so that they could take protective steps if they were foolish enough to use the same password elsewhere?

Bingo. If there 'were' a security breach they should have notified all parties involved about possible info theft. It would have been slightly more logical (not saying they have any...) to say it happened the last time they tried to say someone hacked into TSR. (windkeeper bs etc...) That was what only a month or something ago....

[Paleoanth]

I am not buying it either.  I think Thomas is trying to cover his tracks. And I hope Delphy is not buying this either.

[SoggyFox]

And Manga used to be a featured creator on MTS2, until this evening in fact.

[BlueSoup]

LOL @ Paden... may I remind you that without the 'fucktards' this website wouldn't even exist. You think you look cool saying things like that? Seriously, people like you are the scum of this community, in fact, this whole website is.

Heh...that's sort of the point, isn't it?  We wouldn't NEED to exist without paysites, and the community would be a happier place.

[Anouk]

Nope, that fake hack was only a few weeks or a month ago.

[Paleoanth]

LOL @ Paden... may I remind you that without the 'fucktards' this website wouldn't even exist. You think you look cool saying things like that? Seriously, people like you are the scum of this community, in fact, this whole website is.

Heh...that's sort of the point, isn't it?  We wouldn't NEED to exist without paysites, and the community would be a happier place.

He doesn't understand complicated concepts like points, logic, or morals. 

[kenmtl]

Ya that all sounds plausible. riiiiiiight. Next he'll be blaming it on Dr. Evil.

[SoggyFox]

I'm pretty sure that it was before my surgery, which was beginning of february.

[Delphy]

Nouk, with regards to why buggy had only one download on her account wasn't becuase of access to the featured forum, per se, but more that it *wasn't her upload*.  It was an upload to a group she belongs to.  Group uploads show on the profile of each person that is in that group.

Also, the IP address on Thomas' account *only* used for this thing.  The 2 previous times back in January are totally different IPs (and countries, even).  Yesterday is the only time that that IP appears

[Anouk]

Wich country was this deleting thing done from, if I may ask? And can you check if it's a proxy?
Also, has it happened before yesterday that that account has been used from countries other than Sweden? If so, it doesn't prove alot for TSR.

I still think that TSR is trying to make out Coconut to be a hacker and trying to discredit their blog, because they have no possibility of reporting it anywhere anymore.

I'm pretty sure that it was before my surgery, which was beginning of february.

That long ago? Sheesh, shows how much I apparently care, lol.

[Kyna]

Yeah, right.  I'm TOTALLY convinced these "hackers" (if they exist) held on to this information for 3 months, and only chose to use it now.  And I believe in Santa, the Tooth Fairy, and the goodness of EA, too.

EDIT TO ADD: Oh, and way to go TSR.  If you did have this alleged security breach, why didn't you advise your members at the time so that they could take protective steps if they were foolish enough to use the same password elsewhere?

Bingo. If there 'were' a security breach they should have notified all parties involved about possible info theft. It would have been slightly more logical (not saying they have any...) to say it happened the last time they tried to say someone hacked into TSR. (windkeeper bs etc...) That was what only a month and something ago....

When you take into consideration that the account information that may have been stolen includes email, password, and possibly credit card details, then it would be highly irresponsible* for TSR to not have advised their membership of the alleged security breach at the time it allegedly happened.  It is difficult to believe their claim that their membership database was hacked 3 months back and they are only now revealing it.  And does anyone know if they have issued a warning today to their membership?  Or is it only TSR members who visit MTS2, PMBD, etc, who are permitted to know that their personal info may have been stolen?

^{*But OTOH, such irresponsibility from TSR wouldn't surprise me.}

[SoggyFox]

We were talking about Manga, not Buggy - I misremembered only seeing one download on his? info page.