TSR: In Ur Accounts, Deletin Ur Stuffs!

[Moune]

Well, after reading the thread over at MATY, I find it most confusing. 

Pescado, you might have an answer to this:

Scotty says that he didn't use the same password for GSC as he did for his TSR account. Then how could it have been TSR or a TSR agent that hacked into GSC?

WB, I don't get this either. You say you don't remember what your Simvention password was. Yet in your MSN conversation with nei you say "I can't log into simvention". How do you log in to anything without your password?

[Witchboy]

Well, after reading the thread over at MATY, I find it most confusing.  

Pescado, you might have an answer to this:

Scotty says that he didn't use the same password for GSC as he did for his TSR account. Then how could it have been TSR or a TSR agent that hacked into GSC?

WB, I don't get this either. You say you don't remember what your Simvention password was. Yet in your MSN conversation with nei you say "I can't log into simvention". How do you log in to anything without your password?

My password was automatically stored & i would be automatically signed in just by clicking SV's link in my favs. On this particular occasion i clicked the link in my favs & found i was logged out. I tried what i thought would be my password but to no avail. It was useless for me to even try cause whoever got in changed it anyway.

[Moune]

Ok, got that.

But if it wasn't the same as the one used on TSR how could this be a TSR hacking?

I mean, the foundation for all the assumptions of TSR being behind a number of hackings is that they did it with passwords comming out of the unencrypted TSR database. Apparently that isn't the case here.

[Pescado]

Yes, that wrinkle interests me also. There are several possibilities I have considered.
1. The break occurred through a side-vector, such as an email password recovery. If the email from which passwords are recovered *WAS* the same as the TSR password, or a variation thereof, it would be trivial to retrieve and gain access to this for a destructive operation.
2. This incident is a fabrication created by either someone attention whoring, or a disgruntled administrator, and unrelated to TSR.
3. The password was a close enough variation that it could be guessed anyway.

I have not entirely discounted any of these possibilities, but in any event, the IP information is entirely worthless. Either it is fake, or it is real, and both outcomes produce information that is completely and utterly worthless as far as identifying anything goes. The fact remains, however, that the rogue operator within TSR has never been caught and likely remains at large.

[Moune]

Glad you're taking a detailed view on this, Pes.

[Scotty]

I just want to nip this one in the bud:

I would never hack my own site for attention. I would have nothing to gain. I am not the sort of person that would stab my friends in the back. Why would I delete almost the entire Artists Workshop? Yes, most of the downloads are gone for good. So whoever did this, got what they wanted.

I have no idea how they got into my site. And I'll probably never know. I wasn't even on that list, so I dont even know why they would target me.

[Quorneater]

Did you ever have a friend who had admin rights who you later fell out with?  Do you have younger brothers and sisters who might have sat down at your computer finding it already logged into your admin account?  Do you even have people round to your place who might sit down at your computer while you went to the bathroom and play a prank?   If you have any of your accounts set to log in automatically, as you say you tend to, it makes it very insecure if you have lively mischevous visitors.

And just what sort of coincidence could have led to you and your friend's sites being hacked on the same day - was that done via your account too?  Are you admins on each others' sites?

[Scotty]

No. I do not have any younger brothers and sisters living with me that would hack into my account. I did have one Admin that I had a falling out with a couple years ago, he went to TSR, but I banned him and deleted his account. He never had my password or login information.

And as for Sim Vention, I have no idea. Witchy was the only one that was hacked there. And I am not an Admin on that site, and no one from there is an Admin on mine.

[dstar]

As per what TSR would have against you- the same thing they and every other paysite  have against every free creator whether or not we support anti-paysite sites like  PMBD, Sims Cave, or FSF friendly sites like BPS and GOS. We create content for free- we don't create it for TSR or other paysites. Every thing that we create for absolutely nothing other than enjoyment of the game and our goodwill towards the community is money dribbling out of the pockets of paysite owners and creators like diarrhea. We have more creators overall in the Free Community and we have better and more innovative creators. In fact every innovation that has been developed for this game was done for free by free creators, programmers and modders (sorry I refuse to call the TS3 Workshop an innovation ). It's called greed and most of them can't think beyond their own wallets and egos. Any pay creator who is truly creative and innovative in terms of creating and modding did not start out working on a pay- most of them started on free sites like MTS and went pay later like Wintermute.

[Scotty]

But the GSC is such a small site. I've always tried to stay out of the drama as much as I could, because it has always given me a huge headache, and it's more trouble than it's worth.

I just want to know HOW they got in. I'm not a hacker, so I dont know how it all works. I have always been careful, but they slipped in somehow. I just dont get it.

[Moune]

Scotty, one important clue would be the password you used on GSC. Did you ever use that anywhere else? Ever? Or give it to someone else? Or even just one similar enough for the hacker to guess it? Or would somebody knowing you well be able to guess it?

[Scotty]

Yes, I have used my GSC password at other sites. I may have used it at TSR when I was there too, but I since changed it. I use the same email address at TSR that I do for the GSC. Shit. I never thought of that. I feel like an idiot.

[Quorneater]

Surely an email address wouldn't help without a password?

[Witchboy]

And just what sort of coincidence could have led to you and your friend's sites being hacked on the same day - was that done via your account too?  Are you admins on each others' sites?

I had no idea about SV being hacked into until yesterday when i tried to log in over there. I contacted Nei via MSN. She checked SV for me & found the info i posted earlier. I immediately told Scotty. SV is not mine or Scottys site. Destin owns SV, btw which will be gone after this month. The hacking into SV was done via my account as Nei stated in my earlier post.

I am a creator and moderator on both SV & GSC. Scotty is Admin on GSC & just a regular member on SV. It has been proven that the ip used to attack GSC is the same ip that went in on SV & changed all my info & soft deleted my creations.

As for the motive of both sites being hit. I am pro pirate/file share friendy. Scotty and GSC pro pirate/file share friendy. SV pro pirate/fileshare friendly. Plus the TWAT has had it in for me ever since she busted me on Sims File Vault for file sharing.

[No No No]

Hi Scotty,

I was wondering, does your website/forum software password recovery send you your old password, or lets you create a new one? Is that done through secret question, or through email solely? Were you able to login to your site with your old password?

Same question for your email service. Does it send you your old password, or makes you create a new one? Secret question?

Do you use some TSR tool? Do you? DO YOU??? (had to ask)

I'm asking, because...
- If your forum demands recreating a password without secret questions, that email adress was compromised. If you use that email for any other site, and God forbid, shit like Paypal, please check and change everything now. You would have noticed by not being able to login to your own admin panel because of a password change. I have the attention span of a trunk of wood so I don't remember if you already mentioned that, I'll have to reread.
- If your email was not compromised, and your forum software does not send you the old password after password recovery, the person must have known your password, (or guessed the secret question if it's in use.) This is really odd. If you used some TSR tool, it's a little less odd.
- (Edit: doesn't matter. Compromised is compromised. If the forum software sends you your old password, it sucks.)

That could narrow it down a bit. Maybe completely useless in proving anything, but still.