NICO GOT HACKED - Please read!

Post by **NISTECH** » Sat Jul 17, 2004 5:37 pm

for those of you that werent around during our bone head hackers romp through nico land, This was what came up when you clicked either "NICO Forums" link or the "forums" button.

I clipped it when it stated happening.

Post by **MainEvent212** » Sat Jul 17, 2004 5:37 pm

i thought it was funny that none of their links worked...i tried http://www.aldamar.com but when i cilcked it it just went to a nico page...same for the Enter link...

Post by **Hijacker** » Sat Jul 17, 2004 5:37 pm

NICO has grown up into an adult site now! wee should throw a barmitzva

Post by **MidwayParts** » Sat Jul 17, 2004 5:37 pm

Thanks for getting us going. Once again, the NICO team comes through with flying colors.

Post by **fuzion** » Sat Jul 17, 2004 5:37 pm

Email them.. [email protected]

YouTube · Post by **EZcheese15** » Sat Jul 17, 2004 5:37 pm

1809cc wrote:I'm still out:(

Sean

I just fixed you. You can log in now.

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

im usually not one for revenge but should we take this hack and just be happy we still have our forum? or would you like to return the favor to our rookie hacker friend???

YouTube · Post by **EZcheese15** » Sat Jul 17, 2004 5:37 pm

We are already working on returning the favor, don't worry

Post by **AZhitman** » Sat Jul 17, 2004 5:37 pm

NICE WORK SCOTT for getting a screenshot of the hack!!!

What a lame-a$$ message. Hell, it doesn't even say anything cool like, "Death to Capitalist American Infidel Pigs" or "Nissan Drivers are the Great Satan".

Kuwaiti hackers = weaksauce.

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

this kids name is a book in the bible and the passage i have typed below. my thought is that he is from USA. I will need all the information our NICO leaders have on the attack to our website to further any more investigation...thanks and i would just like to say its about time i helped NICO and im ready to roll......this mother fuc$%* will pay! [email protected]

1Be merciful to me, O God, for men htly purseue me; all day long they press their attack.2My slanderers pursue me all day long; many are attacking me in their pride.3When I am afraid, I will trust you.4In God,whose word I praise,inGod I trust;I will not be afraid. What can mortal man do to me?5All day long they twist my words'they are always plotting to harm me.6They conspire,they luck.they watch my steps eager to take my life.7On no account let them escape;in your anger, O God, bring down the nations.8Record my lament;list my tears on your scroll are they not in your record?9Then my enemies will turn back when I call for help. By this I wil know that God is for me.10In God, whose word I praise, in the Lord, whose word I praise11ingod I trust;I will not be afraid. What can man do to me?12I am under vows to you, O God; I will present my thank offerings to you.12For you have delivered me from death and my feet from stumbling that I may walk before God in the light of life.

Post by **jammer** » Sat Jul 17, 2004 5:37 pm

May the fleas of a thousand camels infest their arm pits! Keep up the good work guys.

YouTube · Post by **EZcheese15** » Sat Jul 17, 2004 5:37 pm

His IP address has already been traced to Kuwait....so he's not from the U.S. Don't worry....we're already a few steps ahead of you

Post by **NISTECH** » Sat Jul 17, 2004 5:37 pm

AZhitman wrote:NICE WORK SCOTT for getting a screenshot of the hack!!!

What a lame-a$$ message. Hell, it doesn't even say anything cool like, "Death to Capitalist American Infidel Pigs" or "Nissan Drivers are the Great Satan".

Kuwaiti hackers = weaksauce.

I tried to find a shot in my log of one of your posts I pulled up during that time that said you were a guest, couldnt find one though.

Post by **AZhitman** » Sat Jul 17, 2004 5:37 pm

Here is some of the information on the hacker.

It took him eight solid hours to hack into the 'nissanin' account. Once he got into an administrator account he had a field day. Here is some of the log file from vbulletin.

'nissanin' DELETED!!!

20332 nissanin08:56, 17th Jul 2004 template.php doupdate template id = 3518 195.69.143.46

20331 nissanin08:54, 17th Jul 2004 template.php edit template id = 3518 195.69.143.46

20330 nissanin08:54, 17th Jul 2004 template.php modify 195.69.143.46

20329 nissanin08:54, 17th Jul 2004 template.php modify 195.69.143.46

20328 nissanin08:54, 17th Jul 2004 index.php 195.69.143.46

20327 nissanin08:49, 17th Jul 2004 template.php modify 195.69.143.46

20326 nissanin08:48, 17th Jul 2004 index.php 195.69.143.46

20325 nissanin08:34, 17th Jul 2004 template.php modify 195.69.143.46

20324 nissanin08:34, 17th Jul 2004 template.php modify 195.69.143.46

20323 nissanin08:34, 17th Jul 2004 usergroup.php kill usergroup id = 7 195.69.143.46

20322 nissanin08:34, 17th Jul 2004 usergroup.php remove usergroup id = 7 195.69.143.46

20321 nissanin08:34, 17th Jul 2004 usergroup.php kill usergroup id = 9 195.69.143.46

20320 nissanin08:34, 17th Jul 2004 usergroup.php remove usergroup id = 9 195.69.143.46

20319 nissanin08:34, 17th Jul 2004 usergroup.php remove usergroup id = 9 195.69.143.46

The hacker was in KUWAIT. Here's the ISP provider information for his IP address:

inetnum: 195.69.140.0 - 195.69.143.255netname: ES-Kuwaitdescr: EasternSolutionsdescr: Satellite service provider, Kuwaitcountry: KWadmin-c: MA1650-RIPEtech-c: MA1650-RIPEstatus: ASSIGNED PImnt-by: RIPE-NCC-HM-PI-MNTmnt-by: AS6661-MNTmnt-by: AMS-MNTmnt-lower: RIPE-NCC-HM-PI-MNTmnt-routes: AMS-MNTnotify: [email protected]changed: [email protected] 20030305source: RIPE

I'm not sure who the ORIGINAL member was named "nissanin", but that username had been registered for quite some time....

Post by **AZhitman** » Sat Jul 17, 2004 5:37 pm

jammer wrote:May the fleas of a thousand camels infest their arm pits!

:Werd

Goat-sodomizing dial-uppers....

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

tracert is not good enough. whats the ip address? and did you just go by the one that our site logged???

Post by **NISTECH** » Sat Jul 17, 2004 5:37 pm

" I'm not sure who the ORIGINAL member was named "nissanin", but that username had been registered for quite some time...."

It was the first registered member by date and as an admin in the members list I remember seeing it and wondering who it was.

YouTube · Post by **EZcheese15** » Sat Jul 17, 2004 5:37 pm

The nissanin account was the original account name that Nancy set up so that me, her, and rex could log into the admin panel before we launched the site. Me and nancy both used it so we could adjust and modify the forums to get it looking good before we announced the launch of the current website. We kept the username around in case our admin names got deleted, then we'd have a backup user name to log into and check things out.

Post by **AZhitman** » Sat Jul 17, 2004 5:37 pm

cnickk wrote:tracert is not good enough. whats the ip address? and did you just go by the one that our site logged???

Sorry, that's what we got from our webmaster....

He may have more info, but that's all I've rec'd from him.

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

so he had access to all member names or he was actually a member in the begining.?

YouTube · Post by **EZcheese15** » Sat Jul 17, 2004 5:37 pm

cnickk wrote:so he had access to all member names or he was actually a member in the begining.?

He gained access to an admin account then used that power to delete portions of our user database. He basically gained all the power that any of our admins have.

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

i feel so....raped....

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

if you are 1 step ahead of me then i guess you already have this info...

person: Cliff Konsbruckaddress: Entreprise des P&Taddress: Division des Telecommunicationsaddress: Data Servicesaddress: 2, Rue Emile Bianaddress: L-2999 LUXEMBOURGaddress: LUXEMBOURGphone: +352 4991 5593fax-no: +352 491221e-mail: [email protected]remarks: **** Please send abuse notifications to [email protected] ****nic-hdl: CK2510-RIPEchanged: [email protected] 20030505source: RIPE

YouTube · Post by **EZcheese15** » Sat Jul 17, 2004 5:37 pm

cnickk wrote:if you are 1 step ahead of me then i guess you already have this info...

person: Cliff Konsbruckaddress: Entreprise des P&Taddress: Division des Telecommunicationsaddress: Data Servicesaddress: 2, Rue Emile Bianaddress: L-2999 LUXEMBOURGaddress: LUXEMBOURGphone: +352 4991 5593fax-no: +352 491221e-mail: [email protected]remarks: **** Please send abuse notifications to [email protected] ****nic-hdl: CK2510-RIPEchanged: [email protected] 20030505source: RIPE

I personally am not one step ahead of you....our webmaster is though. And like Greg said, we're not sure of all the info he has, because what we showed you was all we have received from him. I do know that our webmaster (Todd) is working hard to make this guys miserable life even less enjoyable.

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

me tooand its not just one of them its about 5, but they suck and they dont cover their tracks.

on a lighter note im gonig to savannah GA tonight. how you like GA?

YouTube · Post by **EZcheese15** » Sat Jul 17, 2004 5:37 pm

cnickk wrote:me tooand its not just one of them its about 5, but they suck and they dont cover their tracks.

on a lighter note im gonig to savannah GA tonight. how you like GA?

Um...it's ok, I guess. I'm like 4 hours from Savannah though.

Post by **fuzion** » Sat Jul 17, 2004 5:37 pm

Is this the latest version of vBulletin?? There are a couple security issues with previous ones, im pretty sure you can use the search feature and inject an SQL query that will return the password for an account.. so if he was finally able to get the account number he could have used the exploit and gotten the password..

also:inetnum: 195.69.140.0 - 195.69.143.255netname: ES-Kuwaitdescr: EasternSolutionsdescr: Satellite service provider, Kuwaitcountry: KWadmin-c: MA1650-RIPEtech-c: MA1650-RIPEstatus: ASSIGNED PImnt-by: RIPE-NCC-HM-PI-MNTmnt-by: AS6661-MNTmnt-by: AMS-MNTmnt-lower: RIPE-NCC-HM-PI-MNTmnt-routes: AMS-MNTnotify: [email protected]changed: [email protected] 20030305source: RIPE

... satellite or dialup ??

Anywho.. if it took him 8 hours the only thing I can think of is he was slowly going through and trying the sql injection.. you enter a # for the username and then it will return a password.. but you have no idea what account has what access so you'd have to go through them one at a time..

Post by **fuzion** » Sat Jul 17, 2004 5:37 pm

More info on the provider..

Registrant: Eastern Solutions Co. (EASTERNSOLUTIONSNET-COM-DOM) This Domain is owned to Eastern Solutions Co. Sharq Tower - 16th Floor - Sharq P.O.Box 64457b Shuwaikh B Kuwait, Kuwait 70455 Kuwait +965-670-0100 +965-240-7283 [email protected]

Domain Name: EASTERNSOLUTIONSNET.COM

Administrative Contact: Eastern Solutions Co. [email protected] Sharq Tower - 16th Floor - Sharq P.O.Box 64457b Shuwaikh B Kuwait, Kuwait 70455 Kuwait +965-670-0100 Fax- +965-240-7283

Technical Contact, Zone Contact: Eastern Solutions Co. [email protected] Sharq Tower - 16th Floor - Sharq P.O.Box 64457b Shuwaikh B kUWAIT, kUWAIT 70455 kUWAIT +965-670-0100 Fax- +965-240-7283

Record last updated on 15-Jul-2004. Record expires on 22-Jul-2005. Record created on 22-Jul-2002.

Post by **cnickk** » Sat Jul 17, 2004 5:37 pm

person: Mohamad Asadiaddress: Kuwaitphone: +965 2406945fax-no: +965 2406283e-mail: [email protected]DONE ADMINS CAN THANK ME LATER

Post by **MainEvent212** » Sat Jul 17, 2004 5:37 pm

so did he route his way through a couple different people's accounts?

i'm confused here...

NICO GOT HACKED - Please read!

Nissan Forums

Infiniti Forums

Datsun Forums

Technical Forums

Classifieds / Marketplace

Nissan Motorsports

General Forums