PSA: Watch your DU account. Might want to change your password.

[Sapphocrat]

My Web site server logs show:

Research (details of which are boring) show me this person was at the DU login page; IP address xxxxxxxxx resolves to RIPE Network Coordination Centre, Amsterdam -- legit in itself, but a hacker gateway from the former USSR.

Caveat DUer.

Don't mean to be an alarmist -- it's probably just Jennifer Roback Morse trying to mindfuck me -- but you never know.


Edited by DU Admin to remove personally identifying information.

[hlthe2b]

1. EarlG... can you weigh in on the significance of this?

[lunatica]

2. Are you complaining or bragging?

I can't tell since I don't know what you're talking about.

[graywarrior]

3. Glad I'm not the only one

[Sapphocrat]

4. I'm *warning*.

Somebody's fucking around -- nosing around -- and I'm trying to save everyone grief. Clear enough, or would you rather I sit back and laugh when some 14-year-old Russian hacker fucks with you?

[lunatica]

5. Nope. Not clear enough.

If you explain what you mean and more importantly you give advice on what to do then you're warning can mean something. But you're free to laugh all you want in any case.

[nebenaube]

10. I think it's perfectly clear...

that page is in the admin section, there's probably only three people who are normally able to go there...

[Sapphocrat]

11. OK.

My Web site is http://www.lavenderliberal.com / . I monitor hits/traffic (people who come to my Web site) through my server logs (what keeps track of my traffic). The incoming link is extremely suspicious; while it shows "du admin.php," it comes from Europe, per the IP (Internet Protocol) address.

The page this person was trying to access was my DU login page.

My conclusion: Someone was trying to get into my DU account. I believe if someone was trying to get into my DU account, that same someone may be trying to get into your DU account.

[Hannah Bell]

13. so if you don't have a website linked to du, not to worry.

[Richardo]

15. Who knows? She's keeping the implications of this data a secret for some reason.

[hobbit709]

6. If some 14 year old Russian hacker tries to get on my computer

He's in for a rude surprise.

Let's just say that I had some pros set up a little goody for people like that.

[Richardo]

9. That's no warning.

It's not a PSA if you just copy-and-paste a bunch of code. That doesn't tell most of us anything.

Someone's nosing around? So what? What can they do? How? What does it mean? What grief? Is my DU password a gateway to my entire system?


Believe it or not, a lot of people need to be told WHAT THE DATA MEANS. What if a hurricane warning just said "Watch out, barometric pressure is dropping fast in your area." Not quite the same as saying "THERE'S A FUCKING HURRICANE COMING!!!"

So thanks for nothing.

[Sapphocrat]

12. Fine. Fuck it.

Try to do something decent, and get fucked up the ass.

Thank YOU for nothing.

[Richardo]

14. You're welcome.

[tazkcmo]

22. Do you have to practice at being rude?

Or does it just come naturally? Sheesh.

[foreigncorrespondent]

27. You know...

...I have met some real rude people in my life, but you really take the fucking cake.

Unfuckingbelievable. Someone issues a warning and just because you don't understand it you attack... real clever... NOT!

[zanne]

19. I agree with Sapphrocat. He/She was just trying to give us information.

What's the matter with you people?

[TransitJohn]

17. Code? What code? Where?

I saw some snippet of log, but no code? Maybe someone doesn't know what they're talking about?

[Richardo]

18. That's the point - we're not all computer nerd techies who know what that shit means

Or the difference between 'code' and 'logs' for that matter.

So if it's really a PSA, that crap should be explained.

[TransitJohn]

23. So you're upset because there's things in the world you don't know about.

I think it's called insecurity, and you are owe the OP an apology for acting like a complete ass when they were trying to help people out. It's not her fault that you don't know what you're talking about.

[corpseratemedia]

7. my site's not connected to this site but thanks for the warning

i get a lot of hits from RIPE - i made the mistake of having my email on my site and I assumed they got it because when I put it up and their bot got me again I got tons of spam.

[SidDithers]

8. Doesn't that IP resolve to London, England?...nt

Sid

[City of Mills]

16. I just reformatted my computer, not taking any chances

Anyone have an XP CD I can 'borrow'?

[tazkcmo]

20. Thank you

While some of the posters here are correct in that much of what you say makes very little sense to many of us I a appreciate the spirit of your post. Please do provide any additional info such as actions we can take to protect ourselves. Again, thank you for your warning.

[kdmorris]

21. Are you sure they didn't just click the link in your profile?

Why does any of that mean that they were on your login page?

az=general&saz=member_facts&command=view&id=175732 This part SEEMS to be saying "view member facts for member id 175732", which TO ME indicates someone looked at your profile and clicked the link you have in your profile to go to your website.

Not seeing the sinister part here.

[Statistical]

24. Exactly. Total non-issue. Maybe OP should learn how to read logs before scaring people.

Someone from London likely a mod used a page that lets them look at a user.
That page likely has the user's profile info.

What does the OP have on his/her profile page?
http://www.democraticunderground.com/discuss/duboard.ph...

Oh yeah a FRACKING link to their website!

http://www.hostip.info/index.html

So a mod living in London used the mod version of "view this user's profile" saw an interesting homepage link and followed it.

Somehow the OP got "OH NOES!!!!! RUSSIAN HACKERS!!!!!!" out of that.


UnRec

[HamdenRice]

25. OK, I'll try a translation even though I'm pretty clueless

All she's saying is that someone tried to log into her DU account as an administrator.

Then that same person immediately went to her discussion group, Lavender Newswire.

If you run a site, you get a "log". When anyone visits your site, your log tells you what site that person was looking at immediately before looking at your site.

So some person from a suspect, east European hacker site went to DU, tried to log in as Sapphocrat using administrator privileges, presumably was unsuccessful, and then immediately went to Lavender Newswire.

[Mari333]

26. God, you guys, lighten up

Sapph is merely trying to warn people...if you are confused, just ask her nicely, you dont have to be flaming dicks about it.

[Toasterlad]

28. +1

Jesus fucking christ, there are some serious assholes on DU.

[EarlG]

29. The IP address you posted

belongs to a DU moderator who followed a link to your site from a deleted message (a personal attack against you that had been removed.)

In future we would appreciate if you could check with us first before posting this kind of information publicly and suggesting to everyone that Russian hackers must be responsible.

Locking.