Quote from: DumbFruit on November 17, 2013, 02:36:03 AM

Quote from: TradeFortress

Oct 23th PST time (24th Aus time). A second hack occurred on the Oct 26th (the other 160 BTC).

The compromise was done through compromising multiple of my old email addresses in a chain (compromise one which was the recovery email for another), which led them to lailai625@hotmail.com which received emails forwarded from admin@glados.cc. The attacker was able to reset Linode and Apis networks passwords. Email forwarding was disabled on the 26th (PST, 27th Aus).

I've already posted login logs for Linode on bitcointalk, I've attached logins for apisnetworks which were also reset.

5: Yes, to linode manager. The attacker on the Oct 26th used Lish to skip linode manager and directly shell into the Linode, bypassing 2FA on the manager.

4: The incomplete logs were obtained through lish logview's buffer. The attacker installed mc (midnight commander) and used it to transfer files containing credentials via FTP to 0;15Hd@mastersearching.com:mercedes49@69.85.88.31. From the midnight commander view, the remote server also has another bit.php file not from Inputs. I speculate that this is taken from another service.

3: I do not see where I have access linode password reset logs. I've sent a support ticket to linode requesting such, and authorizing them to provide it to anyone who asks. Ticket ID 2560514

It's a lot to digest... I'll update my opening post tomorrow.

Its still missing all the relevant information and that it took him 1 month to just give these informations is more then disappointing. To be honest if i had 200k+ invested into this at the moment i would demand to have his real-id just so i could get a hold of him.

Another thing is that you really wanna stop the class-action lawsuit in light of these response? What after all beside that the hacker installed mc wasnt known before? I seriously start believing you are just another sockpuppet if that happens.

wayner

Posts

Merits