Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today!

If you have any problems with the registration process or your account login, please contact us.

Post New Thread Reply

Register GFY Rules Calendar
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >
Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed.

 
Thread Tools
Old 12-21-2007, 08:14 PM   #1
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
Is your NATS hacked ?

are there any nats sponsors who havent been compromised ?

seems like every sponsor who has commented has been compromised, just curious as to if anyone who runs nats that didn't get compromised by a nats employee's user/pass
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:31 PM   #2
sicone
Retired
 
sicone's Avatar
 
Industry Role:
Join Date: Jan 2004
Location: Sac
Posts: 18,453
I find it odd that NATs insists on having admin access...


Doesn't NATs also own a pay site program (Teen Dolls)? Would seem to me that having a free list of verified emails of people who are willing to pull out their CC to join a site would be of great value to them.

Not accusing them of anything, just some food for thought
__________________
sicone is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:35 PM   #3
teksonline
So Fucking Banned
 
Join Date: Jan 2005
Location: At My Desk
Posts: 2,904
hrmph, im hungry
teksonline is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:36 PM   #4
iMind
Confirmed User
 
Join Date: Nov 2007
Posts: 937
Quote:
Originally Posted by sicone View Post
I find it odd that NATs insists on having admin access...


Doesn't NATs also own a pay site program (Teen Dolls)? Would seem to me that having a free list of verified emails of people who are willing to pull out their CC to join a site would be of great value to them.

Not accusing them of anything, just some food for thought
threats of lawsuit in 10, 9 , 8 , 7 ...
iMind is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:49 PM   #5
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
i find it odd they would allow an employee one user/pass to get into every nats sponsor.

i find it doubly odd that nobody from nats noticed this account had been compromised before it was posted on gfy.

I find it even more strange that there are not any security measures in place that would have spotted this ( i.e. hourly logins from the same employee on almost every nats sponsor so far ) in laymans terms how an employye could log into several nats sponsors at the same time using the same account.

shouldn't any of these things raised more than 1 red flag ?

as far as affiliates are concerned , should we be worried we will now become targets of identity theft ? what plans does nats have on informing affiliates who's information might have been disclosed.

what information can any sponsors provide that might shed some light on what information is available to the nats employee's account that was used to login ? ( i.e. ss#'s ? passwords ? )
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:49 PM   #6
sicone
Retired
 
sicone's Avatar
 
Industry Role:
Join Date: Jan 2004
Location: Sac
Posts: 18,453
sue for what.. pointing out the obvious conflicts of interest.

hope you didnt pay much for your law degree
__________________
sicone is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:52 PM   #7
OzMan
Confirmed User
 
OzMan's Avatar
 
Join Date: Sep 2003
Location: Los Begas
Posts: 9,162
shit waddeye miss? ... time to search
OzMan is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:54 PM   #8
dropped9
Registered User
 
dropped9's Avatar
 
Industry Role:
Join Date: Jan 2001
Location: Your moms box
Posts: 26,727
dropped9 is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:56 PM   #9
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
Quote:
Originally Posted by OzMan View Post
shit waddeye miss? ... time to search
a nats employee's username was used to login and most likely steal information from quite a few nats sponsors. infact theres only one sponsor i have heard of using nats that hasn't been compromised , and only because they manually disabled nats employees from logging onto their server
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:57 PM   #10
Gordon G
So Fucking Banned
 
Join Date: May 2006
Location: Seems To Be Here Now
Posts: 646
Quote:
Originally Posted by Headless View Post
My god you are such a fucking idiot.
Gordon G is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:58 PM   #11
spacedog
Yes that IS me. Bitch.
 
Industry Role:
Join Date: Nov 2001
Posts: 14,149
Quote:
Originally Posted by SmokeyTheBear View Post
a nats employee's username was used to login and most likely steal information from quite a few nats sponsors. infact theres only one sponsor i have heard of using nats that hasn't been compromised , and only because they manually disabled nats employees from logging onto their server

A nats employee who last posted on the Nats board in August but then started posting elsewhere looking for freelance jobs in September?????
spacedog is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 08:58 PM   #12
Gordon G
So Fucking Banned
 
Join Date: May 2006
Location: Seems To Be Here Now
Posts: 646
why anyone uses nats is beyond me
Gordon G is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:01 PM   #13
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
i wonder how many affiliates who used nats sponsors had their epassporte accounts stolen thru info obtained from this compromise ? it would explain the rash of epassporte thefts.
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:04 PM   #14
spacedog
Yes that IS me. Bitch.
 
Industry Role:
Join Date: Nov 2001
Posts: 14,149
Quote:
Originally Posted by SmokeyTheBear View Post
i wonder how many affiliates who used nats sponsors had their epassporte accounts stolen thru info obtained from this compromise ? it would explain the rash of epassporte thefts.
Not likely. Programs don't ask for your epass password.

Gotta be a real fucking idiot to be using same password everywhere in first place.
spacedog is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:07 PM   #15
wtfent
Confirmed User
 
wtfent's Avatar
 
Join Date: Nov 2003
Location: San Diego, Cali. baby!!!
Posts: 3,790
Quote:
Originally Posted by sicone View Post
I find it odd that NATs insists on having admin access...


Doesn't NATs also own a pay site program (Teen Dolls)? Would seem to me that having a free list of verified emails of people who are willing to pull out their CC to join a site would be of great value to them.

Not accusing them of anything, just some food for thought
Why the hell would they do that? So they can make a quick $10,000 and loose out on the millions they will make in the future with nats? I buy trials every now and then and if i saw them spamming me with their sites I think it would make for pretty huge drama that would spread within a week max. The Nats guys are all stand up guys.
__________________
ThisWillShockYou.com DVD Store - TWSY UNCENSORED
ICQ# 194020367 E-mail: shockingbucks(AT)gmail.com
Promote something different!! Shocking Bucks
wtfent is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:12 PM   #16
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
Quote:
Originally Posted by spacedog View Post
Not likely. Programs don't ask for your epass password.

Gotta be a real fucking idiot to be using same password everywhere in first place.
do you think it would be easier to hack an epassporte account knowing all their personal information ?

also take into account that many sponsors created the epassporte accounts for their affiliates ( perhaps with the affiliates current password )

now obviously using shared passwords is a big no-no but thats beside the point. ideally everyone should have a deadbolt on their door , but i would think if your locksmith's key was used to get in you first look at the locksmith
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:12 PM   #17
AlienQ - BANNED FOR LIFE
best designer on GFY
 
AlienQ - BANNED FOR LIFE's Avatar
 
Join Date: Mar 2003
Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384
Posts: 30,307
Stats and client information are the most coveted of things a program owner can have. Why people that use NATS chose NATS is pure stupidity.

I said it 3 years ago and I am still saying it.
People called me an idiot then, and will probably call me an idiot now for saying so...

And to this day I still say I told ya so.
No sympathy from me.

Dumb is dumb.
AlienQ - BANNED FOR LIFE is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:23 PM   #18
iMind
Confirmed User
 
Join Date: Nov 2007
Posts: 937
Quote:
Originally Posted by sicone View Post
sue for what.. pointing out the obvious conflicts of interest.

hope you didnt pay much for your law degree
I was referring to John from nats, How he starts threatening lawsuits and using legal jargon to try and shut people up.
iMind is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:25 PM   #19
Gordon G
So Fucking Banned
 
Join Date: May 2006
Location: Seems To Be Here Now
Posts: 646
Quote:
Originally Posted by iMind View Post
I was referring to John from nats, How he starts threatening lawsuits and using legal jargon to try and shut people up.
John and lawsuits have a ring to it lol

Gordon G is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:27 PM   #20
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
Quote:
Originally Posted by AlienQ View Post
Stats and client information are the most coveted of things a program owner can have. Why people that use NATS chose NATS is pure stupidity.

I said it 3 years ago and I am still saying it.
People called me an idiot then, and will probably call me an idiot now for saying so...

And to this day I still say I told ya so.
No sympathy from me.

Dumb is dumb.
yer freakin nostradamus

i think many sponsors use nats because

A) its pretty easy
B) alot of other sponsors use it so for affiliates its easy to navigate.

those arent of course very good reasons , but understandable anyways.

having a standard sponsor software will always lead to troubles when you have a compromise like this .
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:28 PM   #21
iMind
Confirmed User
 
Join Date: Nov 2007
Posts: 937
Quote:
Originally Posted by SmokeyTheBear View Post
yer freakin nostradamus

i think many sponsors use nats because

A) its pretty easy
B) alot of other sponsors use it so for affiliates its easy to navigate.

those arent of course very good reasons , but understandable anyways.

having a standard sponsor software will always lead to troubles when you have a compromise like this .
Alienq invented hacking nats
iMind is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 09:46 PM   #22
JOKER
Facit Omnia Voluntas
 
JOKER's Avatar
 
Industry Role:
Join Date: Apr 2003
Location: Offshore
Posts: 2,105
Quote:
Originally Posted by SmokeyTheBear View Post
do you think it would be easier to hack an epassporte account knowing all their personal information ?

also take into account that many sponsors created the epassporte accounts for their affiliates ( perhaps with the affiliates current password )

now obviously using shared passwords is a big no-no but thats beside the point. ideally everyone should have a deadbolt on their door , but i would think if your locksmith's key was used to get in you first look at the locksmith
Right on the fucking money.

Remember the TrafficHangar incident and how many have been affected?

Didnt see this thread at first, sorry...

Posted something similiar here as well:

http://www.gofuckyourself.com/showpo...&postcount=184
__________________
Facilitation - BizDev - Traffic - Consulting - Marketing
Skype: jokerempire | Silent Circle: joker

JOKER is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-21-2007, 10:34 PM   #23
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
seems like a few sponsors would be glad to pipe in that their nats wasnt hacked unless everyone was hacked except those that banned nats employees access.
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 12:02 AM   #24
V_RocKs
Damn Right I Kiss Ass!
 
Industry Role:
Join Date: Dec 2003
Location: Cowtown, USA
Posts: 32,409
Epassporte hacks are usually someone using their Epassporte account password as their affiliate account password. The affiliate Db gets hacked and the hacker just has to trial and error his way through the DB...

Instant cash.

Then see where you bank if you are one of the wires types and use your password there too. Again.. easy money. Especially if the hacker can gain access to an account as the same bank... Transfer all your money with a few clicks...

Of course, every time this happens the guy who got fucked in the ass says he didn't use the same password. Yeah... Way to save face pall.. We all know you did. No use lying about it!
V_RocKs is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 12:07 AM   #25
Brad Mitchell
Confirmed User
 
Brad Mitchell's Avatar
 
Industry Role:
Join Date: Nov 2001
Location: Southfield, MI
Posts: 9,812
Quote:
Originally Posted by JOKER | JOKEREMPIRE Inc. View Post
Right on the fucking money.

Remember the TrafficHangar incident and how many have been affected?

Didnt see this thread at first, sorry...

Posted something similiar here as well:

http://www.gofuckyourself.com/showpo...&postcount=184
oh jesus christ does NATS really store the affiliate passwords in plain text for an admin access user to view? Tell me that's not true. Please, really. Can anyone confirm?

Brad
__________________
President at MojoHost | brad at mojohost dot com | Skype MojoHostBrad
71 industry awards for hosting and professional excellence since 1999
Brad Mitchell is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 12:16 AM   #26
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
Quote:
Originally Posted by V_RocKs View Post
Epassporte hacks are usually someone using their Epassporte account password as their affiliate account password. The affiliate Db gets hacked and the hacker just has to trial and error his way through the DB...

Instant cash.
i dont know about usally but i'm sure it happens this way quite often , but prob just as often it is other things further down the line , like once they know your epass account name = (affilid+sponsorname) + users real email they have ALOT more to go on even if the passwords are different ( besides having all your personal info needed to steal your identity )

gotta wonder how the "head programmer" of nats lost his password

you would think that would be a pretty important password to lose when it means you can backdoor every nats sponsor and walk away with a kings ransom in data.

you would also think it would be a pretty hard thing to miss for so long , the head programmers master backdoor is compromised and nobody notices a thing .
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 12:25 AM   #27
rowan
Too lazy to set a custom title
 
Join Date: Mar 2002
Location: Australia
Posts: 17,393
Quote:
Originally Posted by Brad Mitchell View Post
oh jesus christ does NATS really store the affiliate passwords in plain text for an admin access user to view? Tell me that's not true. Please, really. Can anyone confirm?
Even if it's not plain text, it wouldn't take too long to brute force crack some common passwords such as 'coffee' or '12345'. As a bonus, they're probably the most likely people to use the same pass everywhere.
rowan is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 12:33 AM   #28
D
Confirmed User
 
D's Avatar
 
Join Date: Jan 2006
Location: The Valley
Posts: 7,412
So, what I'm hearing is anyone using NATS who didn't disable TMM's access to their servers has the personal information of their entire user-base and affiliate-base compromised?

__________________
-D.
ICQ: 202-96-31

Last edited by D; 12-22-2007 at 12:35 AM..
D is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 12:37 AM   #29
milan
Confirmed User
 
milan's Avatar
 
Join Date: May 2005
Location: Dee Dee Dee LAND!
Posts: 800
Quote:
Originally Posted by D View Post
So, what I'm hearing is anyone using NATS who didn't disable TMM's access to their servers has the personal information of their entire user-base and affiliate-base compromised?

Exactly!
__________________
QuadraNET - ICQ:2222 15312 - milan [nosp@m] QuadraNET.com
24/7 "REALLY ON-SITE" Support - Completely Premium Network
Public & Private Network, Remote Reboot, Private VLANs
99.99% Guaranteed Network Uptime / BGP4 Multihomed
24/7 LIVE CHAT, Phone and Ticket Support
1-888-5-QUADRA
milan is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 01:41 AM   #30
Nails
Confirmed User
 
Join Date: Jun 2007
Posts: 262
Sounds like someone should be sueing Nats right about now.
Nails is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 02:05 AM   #31
D
Confirmed User
 
D's Avatar
 
Join Date: Jan 2006
Location: The Valley
Posts: 7,412
Quote:
Originally Posted by Brad Mitchell View Post
oh jesus christ does NATS really store the affiliate passwords in plain text for an admin access user to view? Tell me that's not true. Please, really. Can anyone confirm?

Brad
Sorry I missed this before my first post in this thread... was kinda dumb-founded at the fact that I blew that thread off this morning as "another drama thread."

As of the last time we used NATS (a year ago), and as I can recall, all affiliate and user passwords, usernames, addresses, epass account names, etc. were stored in plain text.



Someone please correct me if that's not the status quo.
__________________
-D.
ICQ: 202-96-31
D is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 02:23 AM   #32
pocketkangaroo
Confirmed User
 
Join Date: Jan 2005
Location: Chicago, IL
Posts: 8,452
Quote:
Originally Posted by D View Post
Sorry I missed this before my first post in this thread... was kinda dumb-founded at the fact that I blew that thread off this morning as "another drama thread."

As of the last time we used NATS (a year ago), and as I can recall, all affiliate and user passwords, usernames, addresses, epass account names, etc. were stored in plain text.



Someone please correct me if that's not the status quo.
Would this include banks and account numbers for wires/ACH? I'm just a tad worried that my company's banking information is sitting in the hands of a hacker right now. I'm hoping it's somehow protected though.

Also, what about stuff like SSN? My company uses a FEIN but I'm guessing some still use their SSN.
pocketkangaroo is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 02:28 AM   #33
Doctor Dre
Too lazy to set a custom title
 
Doctor Dre's Avatar
 
Industry Role:
Join Date: Jan 2001
Posts: 51,692
Quote:
Originally Posted by wtfent View Post
Why the hell would they do that? So they can make a quick $10,000 and loose out on the millions they will make in the future with nats? I buy trials every now and then and if i saw them spamming me with their sites I think it would make for pretty huge drama that would spread within a week max. The Nats guys are all stand up guys.
I'm in NO WAY saying Nat's are the one emailing the members... not at all. I think (to myself) with the answers we've seen here, it's pretty clear that John might be arrogant, but I doubt he's guilty of this one.

But having access to emailing 50 % + of the surfers paying for porn will bring a lot more money then $10 000. It's totally targetted surfers, the perfect list.

I'm sure lots of people could be willing to spend a tons of cash developping a technology to hack into that kind of data.

The webmaster epass stolen could also be explained.
__________________
Quote:
Originally Posted by rayadp05 View Post
I rebooted, deleted temp files, history, cookies and everything...still cannot view the news clip. All I see is that fucking gay ass music video from "Rick Roll". Anyone else have a different link to the news clip?
Doctor Dre is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 02:32 AM   #34
SmokeyTheBear
►SouthOfHeaven
 
SmokeyTheBear's Avatar
 
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
Quote:
Originally Posted by pocketkangaroo View Post
Would this include banks and account numbers for wires/ACH? I'm just a tad worried that my company's banking information is sitting in the hands of a hacker right now. I'm hoping it's somehow protected though.

Also, what about stuff like SSN? My company uses a FEIN but I'm guessing some still use their SSN.
my guess would be yes, if the account passwords were not encrypted then i dont know why they would encrypt the banking info.

besides if the password is there the hacker can just login with your account and see the banking info if its available in your settings.
__________________
hatisblack at yahoo.com
SmokeyTheBear is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 02:34 AM   #35
kmanrox
aka K-Man
 
kmanrox's Avatar
 
Industry Role:
Join Date: Oct 2001
Location: The Gutter
Posts: 29,292
doh!!!!!!!
__________________
Crypto HODLr
Crypto mining
Angel investor
kmanrox is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 02:38 AM   #36
hateman
So Fucking Banned
 
Join Date: Jul 2003
Posts: 1,623
NATS is fucked

it has so many flaws

why sponsors use it is beyond me.
hateman is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 03:17 AM   #37
borked
Totally Borked
 
borked's Avatar
 
Industry Role:
Join Date: Feb 2005
Posts: 6,284
Quote:
Originally Posted by Brad Mitchell View Post
oh jesus christ does NATS really store the affiliate passwords in plain text for an admin access user to view? Tell me that's not true. Please, really. Can anyone confirm?

Brad
No, members passes are cleartext by default. Affiliate passwords are two-way encrypted. What I don't understand is why the need for two-way encryption? To reset an affiliates pass if they forgot it in the backend is nothing, so 1-way encryption would have been far better. John posted in another thread that this is to be included in NATS4. Shame it wasn't sooner IMPO.
__________________

For coding work - hit me up on andy // borkedcoder // com
(consider figuring out the email as test #1)



All models are wrong, but some are useful. George E.P. Box. p202
borked is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:01 AM   #38
c0py-BANNED FOR LIFE
So Fucking Banned
 
Join Date: Feb 2004
Location: UK
Posts: 195
All I can say is SQL Injection.
c0py-BANNED FOR LIFE is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:11 AM   #39
quantum-x
Confirmed User
 
quantum-x's Avatar
 
Join Date: Feb 2002
Location: ICQ: 251425 Fr/Au/Ca
Posts: 6,863
Quote:
Originally Posted by c0py View Post
All I can say is SQL Injection.
Bang on the money.
quantum-x is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:11 AM   #40
quantum-x
Confirmed User
 
quantum-x's Avatar
 
Join Date: Feb 2002
Location: ICQ: 251425 Fr/Au/Ca
Posts: 6,863
Quote:
Originally Posted by Nails View Post
Sounds like someone should be sueing Nats right about now.
They already have pending law suits.
quantum-x is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:11 AM   #41
k0nr4d
Confirmed User
 
k0nr4d's Avatar
 
Industry Role:
Join Date: Aug 2006
Location: Poland
Posts: 9,229
I've seen code by the tmm guys, i seriously doubt there are any sql injection issues in nats...
k0nr4d is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:15 AM   #42
uno
RIP Dodger. BEST.CAT.EVER
 
uno's Avatar
 
Industry Role:
Join Date: Dec 2002
Location: NYC Area
Posts: 18,450
Panchodog has had the admin locked down via specific full IPs for a very long time now.
__________________
-uno
icq: 111-914
CrazyBabe.com - porn art
MojoHost - For all your hosting needs, present and future. Tell them I sent ya!
uno is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:18 AM   #43
quantum-x
Confirmed User
 
quantum-x's Avatar
 
Join Date: Feb 2002
Location: ICQ: 251425 Fr/Au/Ca
Posts: 6,863
Quote:
Originally Posted by k0nr4d View Post
I've seen code by the tmm guys, i seriously doubt there are any sql injection issues in nats...
Then you're a bad coder.
It's just that simple.
quantum-x is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:22 AM   #44
jscott
So Fucking Banned
 
Industry Role:
Join Date: Feb 2001
Location: Taipei
Posts: 25,198
Any input from NATS on this matter? I find this very disturbing, need a little reassurance please John
jscott is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:24 AM   #45
k0nr4d
Confirmed User
 
k0nr4d's Avatar
 
Industry Role:
Join Date: Aug 2006
Location: Poland
Posts: 9,229
Quote:
Originally Posted by quantum-x View Post
Then you're a bad coder.
It's just that simple.
preventing sql injection is not rocket science, buddy.
k0nr4d is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:32 AM   #46
quantum-x
Confirmed User
 
quantum-x's Avatar
 
Join Date: Feb 2002
Location: ICQ: 251425 Fr/Au/Ca
Posts: 6,863
Quote:
Originally Posted by k0nr4d View Post
preventing sql injection is not rocket science, buddy.
Please don't patronize me. I've worked very closely w/ NATS and CARMA since they were in beta.
I have personally tested and proved SQL injections against NATS and CARMA [and dutifully reported them]. I have looked at the source of both, and literally just took a scroll through it again. There are exploitable areas. I haven't seen a mysql_real_escape_string anywhere in the code I saw, and 6 months ago, there were definite issues. HTML_special_chars / [and god forbid] addslashes and the ilk are not sql protection.

Check out - http://www.gofuckyourself.com/showpo...&postcount=218

I know programmers love to piss on each other, but the fact of the matter is that basically ANY script online is susceptible to attack, whether it be by the script itself, or the frameworks that support it.
quantum-x is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:37 AM   #47
borked
Totally Borked
 
borked's Avatar
 
Industry Role:
Join Date: Feb 2005
Posts: 6,284
Quote:
Originally Posted by jscott View Post
Any input from NATS on this matter? I find this very disturbing, need a little reassurance please John
John said in this thread that he's emailing all NATS customers. You haven't received that email by now?
__________________

For coding work - hit me up on andy // borkedcoder // com
(consider figuring out the email as test #1)



All models are wrong, but some are useful. George E.P. Box. p202
borked is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:40 AM   #48
borked
Totally Borked
 
borked's Avatar
 
Industry Role:
Join Date: Feb 2005
Posts: 6,284
Quote:
Originally Posted by quantum-x View Post
Please don't patronize me. I've worked very closely w/ NATS and CARMA since they were in beta.
I have personally tested and proved SQL injections against NATS and CARMA [and dutifully reported them]. I have looked at the source of both, and literally just took a scroll through it again. There are exploitable areas. I haven't seen a mysql_real_escape_string anywhere in the code I saw, and 6 months ago, there were definite issues. HTML_special_chars / [and god forbid] addslashes and the ilk are not sql protection.

Check out - http://www.gofuckyourself.com/showpo...&postcount=218

I know programmers love to piss on each other, but the fact of the matter is that basically ANY script online is susceptible to attack, whether it be by the script itself, or the frameworks that support it.
Interesting...
How many people have access to the open source of NATS? Surely the only way to know where these exploits are, if what you say is correct, is to have access to the source.

How come you have access to the source?
__________________

For coding work - hit me up on andy // borkedcoder // com
(consider figuring out the email as test #1)



All models are wrong, but some are useful. George E.P. Box. p202
borked is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:42 AM   #49
k0nr4d
Confirmed User
 
k0nr4d's Avatar
 
Industry Role:
Join Date: Aug 2006
Location: Poland
Posts: 9,229
Quote:
Originally Posted by quantum-x View Post
Please don't patronize me. I've worked very closely w/ NATS and CARMA since they were in beta.
I have personally tested and proved SQL injections against NATS and CARMA [and dutifully reported them]. I have looked at the source of both, and literally just took a scroll through it again. There are exploitable areas. I haven't seen a mysql_real_escape_string anywhere in the code I saw, and 6 months ago, there were definite issues. HTML_special_chars / [and god forbid] addslashes and the ilk are not sql protection.

Check out - http://www.gofuckyourself.com/showpo...&postcount=218

I know programmers love to piss on each other, but the fact of the matter is that basically ANY script online is susceptible to attack, whether it be by the script itself, or the frameworks that support it.
You may be right, or they may be doing their escaping in the nats_db_query function or relying on magic_quotes_gpc. I don't have access to the nats source, but I'm working on a project with TMM and from the cleanliness of their code, I doubt they would make some noobish mistakes like not sanitizing user input.
k0nr4d is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Old 12-22-2007, 04:44 AM   #50
quantum-x
Confirmed User
 
quantum-x's Avatar
 
Join Date: Feb 2002
Location: ICQ: 251425 Fr/Au/Ca
Posts: 6,863
Quote:
Originally Posted by borked View Post
Interesting...
How many people have access to the open source of NATS? Surely the only way to know where these exploits are, if what you say is correct, is to have access to the source.

How come you have access to the source?
A lot of exploits are found by brute forcing. Even public live distros like Backtrack have huge DBs of exploits you can just run over a site / server looking for penetration points.

I don't have the full source, I just have it for a few key files that were left on my server after a tech did an upgrade. TMM knows I have seen them, and I promised them to pass on any info I saw in there that might cause problems, and I have
quantum-x is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote
Post New Thread Reply
Go Back   GoFuckYourself.com - Adult Webmaster Forum > >

Bookmarks



Advertising inquiries - marketing at gfy dot com

Contact Admin - Advertise - GFY Rules - Top

©2000-, AI Media Network Inc



Powered by vBulletin
Copyright © 2000- Jelsoft Enterprises Limited.