TSR: In Ur Accounts, Deletin Ur Stuffs!

[Paden]

Delphy, lil Tommy boy got Anutty a proxy program to use so others would not recognize her, so what's to prevent him from using the same kind of thing himself. He's proven himself to be dishonest before, so what's to say he's not trying to blow smoke up your ass to prevent you from being angry with him over all of this?

[Sarahsuke]

You're all incredibly nieve to think that I actually care what you think?

If you really didn't care about what we think, you wouldn't be here spewing your greed-based drivel at us. But hey, enjoy being used like a crusty old sock.

[Delphy]

As I said in my post, I'm not entirely convinced either way.

IF TSR had no such security problem, then this still points to them/

IF TSR had a security problem, this still points to them having serious issues with the security of thier data.

And the timings are way off.  Why choose *now* to do this attack if you've had the logins for *months*? It doesn't make any sense.  The timings are way off, and are very suspicious.

So, while I'm not convinced it was a TSR high-level sanctioned thing, I'm still wanting to know who and why.  It could have been a lower down or it could have been somebody else entirely.

Paden, who is this "Anutty"? 

[SoggyFox]

Anutty = Anita, Atwa.

[Anouk]

Delphy, could you check for yourself (if you don't want to share) from what countries besides Sweden this account was accesed before the deleting, and when? if this account was shared and/or accessed from different countries before, the "It wasn't me"- excuse doesnt fly that easily.

You're right about the weird timing.
The lack of reaction towards BuggyBooz's accusations aside from the deleting of all her stuff is very suspicious.
Also, Coconut has told us that they were aware of the theft, but it was decided to take entirely different action.

[neriana]

Paden, who is this "Anutty"? 

Anita/Atwa. She is a very unpopular person whom Thomas keeps around for some reason. My theory has always been that she's there to deflect attention and blame from him and from TSR's bad practices generally.

[Paden]

Delphy, she's also known as Anita, Atwa and Atwat. She's one of the most annoying pains in the ass that you could ever dream of. And if you did dream of her, she'd be a bloody nightmare.

[Light_Angel]

And the timings are way off.  Why choose *now* to do this attack if you've had the logins for *months*? It doesn't make any sense.  The timings are way off, and are very suspicious.
 

*delurks*

In my honest opinion, so everyone would forget about the "security breeches" and they'd be able to use that as their safety net down pat.  This whole thing seems played out even since the so called account hackings a few months back.

[Delphy]

Delphy, could you check for yourself (if you don't want to share) from what countries besides Sweden this account was accesed before the deleting, and when? if this account was shared and/or accessed from different countries before, the "It wasn't me"- excuse doesnt fly that easily.

You're right about the weird timing.
The lack of reaction towards BuggyBooz's accusations aside from the deleting of all her stuff is very suspicious.
Also, Coconut has told us that they were aware of the theft, but it was decided to take entirely different action.

Which account? Thomas's?  The only 2 recorded IPs are both in Sweden.  Both of which are in one of the screenshots.  I have no recorded login data prior to Jan 2009 for that account other than the intial registration, so I couldn't say anything about last year but the data you see in the screenshot is everything recorded on the account.  It hasn't been used much.

Paden, Ahh Atwa.  Okay, thanks.  Well, unless I know who that is on MTS2 I obviously cannot to any comparisons.

[Anouk]

Ok, to clarify, so the ip's used before the attack are from sweden? And the one used in the attack is not?

Delphy told me in msn that the ip used in the deleting thing is not from Sweden, but it is somekind of proxy setup. And to ask whatever the that means and any server details, to Pescado.

[Delphy]

Yes Nouk, but it's the same address used on both accounts.  Pescado can give you more info about the actual server hardware and stuff, but it appears to be some kind of weird proxy setup.

[Witchboy]

I have done an ip search & it comes back as being in Texas.

http://www.ip2location.com/free.asp

IP Address   Country (Short)   Country (Full)   Flag   Region   City   ISP   Map 
70.85.179.186 US UNITED STATES  TEXAS DALLAS THEPLANET.COM INTERNET SERVICES INC 

[Pescado]

It looks like the IP belongs to a professional proxy service. nmapping the server reveals that it is a Linux, probably CentOS 5, which is NOT consistent with the browser string given. This means the browser string is either faked entirely, or passed transparently. Nmap also reveals that only ports 80, 90, and 7007 are open, and all are running ssh. These are NOT standard ports for ssh. In fact, 80 is HTTP. The only clear reason someone would be running a SSH on port 80 is to intentionally bypass firewall blocks like those set by workplaces or schools, as most firewalls leave port 80 open so people can view websites. Again, supports "professional proxy service".

Of course, this means there is no actual way into the server that isn't secure. Therefore, there is no way a "hacker" could be randomly using this service. No true hacker would ever pay for a "secure" proxy service knowing it would leave a paper trail back to him, and so many free "open" proxies exist on the Internet. This sort of service is only paradoxically used by those who don't understand privacy at all AND have money to throw around. Who do we know that fits that profile?

Last but not least, unconfirmed, but isn't this the same IP address implicated in the SimSecret hackings? Someone doublecheck 70.85.179.186.

[Witchboy]

Last but not least, unconfirmed, but isn't this the same IP address implicated in the SimSecret hackings? Someone doublecheck 70.85.179.186.

The ip for the SimSecret hacking is 78.129.197.69

Details for that ip are...

IP Address   Country (Short)   Country (Full)   Flag   Region   City   ISP   Map 
78.129.197.69 UK UNITED KINGDOM  ENGLAND LONDON RAPIDSWITCH LTD 

[Henbane]

Check this out:http://forums.sims-community.com/showthread.php?p=1336560#post1336560

"Buggy, this is awful and I am so sorry that this happened to you. I'd like to say that TSR wouldn't stoop this low, but that's just a lie. They can, will, and do.

In November, my Livejournal was hacked and used to fuck with Simsecret (in fact, recent secrets are how I found out about this!)... and I think now I know how. My LJ and TSR passwords used to be the same. Also? The login info that LJ logs (browser, OS, IP address, etc) is almost identical to the info logged for Buggy's account. ASFDDFH, I just feel sick now!

I think we need make sure that as much of the Sims 2 community as possible knows about what happened to Buggy, and that TSR did it. Something good will come of this: more people will realize that TSR is a bunch of jerks who have nothing better to do than harass people."