Suspects who could have been hacked

[Arminius]

If we could get a log of IP addresses used that might be helpful; I've only ever accessed the forum from two addresses, so if there was a third one then that would be it.

[Natmus]

Is it possible to get an identity approximation from the visible items on the browser?

I see a few links, and a lot of other open taps. He is online with DIGG, I can see. His google search has been looking for "php chomp". There's a Scuttle sidebar set on "ratS".

Anyone who can figure out anything from this?

[Harlequin]

I can't see how this could be a leak. Too much honesty and all that

[Natmus]

From what the screenshots show, Domhnall and Skulks are online at the time of the screenshots. Both should change their passwords, just to be safe. The rest of the posters are offline, so we can assmue their accounts are safe for now.

But we need to determine if the hack took place through an account, or it somehow found a backdoor into the forums that gives it unlimited access.

I hope it's a hacked account, because then we somehow can close it again. If it's a general hole we have to give up the forum alltogether.

[Clausewitz]

I just studied the tabs on the screenshots.

1. "IK Manag[er?]" - never heard of it
2. DIGG Alliance
3. "Forum Us[er]" - This is an Admin tab for woofcats, DIGG's tools site!
4. "View the..." - not familiar
5. "Sons of D[IGG?]" - This is DominicUH and Scoots o22 battle group!
6. Gmail
7. "Pants for..."
8. Morkin forums.

#3 is the most conclusive in my book. Aesir can back me up here - Patrick, it's the "edit users" tab for woofcats, where Admins can alter who has access, and at what level.

THOSE WHO HAVE ACCESS TO THAT PAGE:
1. Phil299
2. Scoots (presumably)
3. Starrynight (presumably)
4. Loafnut
5. Jackrats
6. Meatpopsicle

THOSE WHO HAVE ACCESS TO THAT PAGE AND KNOW HOW TO USE IT:
1. Phil299
2. Jackrats
3. Scoots?
4. Starrynight?

In other words, Loafnut and Meatpopsicle were self-confessed inept at it, and never bothered to learn it, nor show any ambition to do so in the future.

Patrick, do you recognize that toolbar as matching what Phil has posted in the past? Granted, it was a long freaking time ago, but what kind of IP-mask did he use for the various forums he always enjoyed getting his fingers into?

EDIT: Devil's Advocate - it appears they were merely viewing a screenshot of the forums, during that screenshot of the forums. The Morkin forum tab is not open, but rather some mysterious "http...islands" tab was being viewed at time of the screenshots. It does seem possible that the source of the screenshots was an intermediary.

[Arminius]

clausewitz said:

7. "Pants for..."

Anybody of them from Wales?
www.rhondda-cynon-taff.gov.uk/stellent/groups/public/documents/hcst/content.hcst?lang=en&textonly=true&dDocName=017230

Sorry, despite trying hard I can't seem to get this URL clickable.

[Clausewitz]

Scoots, Loafnut, Meatpopsicle, Starrynight, and Jackrats are all from the United States.

Phil is a bookstore-owner in England. Not sure what part...

[Clausewitz]

clausewitz said:

EDIT: Devil's Advocate - it appears they were merely viewing a screenshot of the forums, during that screenshot of the forums. The Morkin forum tab is not open, but rather some mysterious "http...islands" tab was being viewed at time of the screenshots. It does seem possible that the source of the screenshots was an intermediary.

Yes, I am quoting myself and double-posting...

But I need to either validate or invalidate this possibility.

The screenshot was taken of the screenshot, yes?

[Arminius]

There is the white 'X' on red on the tab, which suggests the tab is pointing at the actual site.

[Natmus]

clausewitz said:

EDIT: Devil's Advocate - it appears they were merely viewing a screenshot of the forums, during that screenshot of the forums. The Morkin forum tab is not open, but rather some mysterious "http...islands" tab was being viewed at time of the screenshots. It does seem possible that the source of the screenshots was an intermediary.

To me it seems that he has the Morkin forum open on all the screenshots. If you follow the outline beneath the tab it expands horisontally and closes off all the taps to the left of the Morkin tab.

[Arminius]

www.phildutchbookseller.co.uk/ ?

[Clausewitz]

Ah, you're right. I had to check my own firefox, and look closer. Good eye, Oliver.

I think I made the assumption that they were viewing the "http...isles" tab, since that one was the first along the list.

On closer inspection, it certainly looks like they have three distinct IK tabs open. Granted, I often run two or three (currently keeping an eye out for red on Calamity and kae)...

[Clausewitz]

arminius said:

www.phildutchbookseller.co.uk/ ?

You'll need to check with Patrick. I seem to recall him saying he sold books to college students at some point, but that's only with 75% certainty that I recall that.

Is "Phil Dutch" located in Wales?

[Warliter]

nope its in Bath, closeish to wales but not in wales

I searched for Pants for, I haven't got Mozilla to check, but if you go to
search.ebay.co.uk/pants-for_W0QQfkrZ1QQfnuZ1QQfsooZ2QQfsopZ32QQkeywordZpantsQ20for

I think you will get a tab that has the same heading. If someone with access could try

[Clausewitz]

If anybody has DIGG forum access, you'll want to run a search for an old thread.

It's in "General Discussion", most likely. It is around the time of the E|S war.

It is a "Get to know your fellow DIGGer", or something like that. It may have the word "Biography" in it.

Phil discloses his personal background in there. That is where I would have read the nature of his book dealing, and it probably has a precise location as well.