GoFuckYourself.com - Adult Webmaster Forum

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)
-   Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)
-   -   AVN: NATS/TMM Breached for More Than a Year (https://gfy.com/showthread.php?t=796567)

commonsense 01-02-2008 11:40 PM

Quote:

Originally Posted by BoyAlley (Post 13595262)

I would say at this point it might very well be a question of "how many affiliates would they gain".
:2 cents:

They wouldn't gain a single affiliate that could make a sale by switching :2 cents:

SmokeyTheBear 01-03-2008 12:21 AM

Quote:

Originally Posted by Robbie (Post 13595653)
Smokey there was no "Master Nats password list"

There was ONE LOGIN that they used to do maintenance on everybodies NATS setup

so what , all that makes it is even more ridiculous, what does it matter if one password was compromised or all of them were.


Quote:

Originally Posted by Robbie (Post 13595653)
And since you are a former NATS employee I have no idea why I am having to explain this.

add that onto the list of lies/"exaggerations" you have made

Quote:

Originally Posted by Robbie (Post 13595653)
Having a single user/pass for them to log in and do upgrades etc. wasn't such a great idea.

understatement of the year

Quote:

Originally Posted by Robbie (Post 13595653)
A worse idea was all of us who didn't delete that user in the beginning, before anything happened.

and even worse you werent told to do so.

Quote:

Originally Posted by Robbie (Post 13595653)
THERE WAS NO MASTER PASSWORD LIST.

you are wrong , there is a master password list , there MAY have only been one username with access to sponsors and one used to hack the data , but this is a rather trivial point and such a silly thing to quibble about.. you rant on for pages and your only comeback is " there is no master password list" :1orglaugh , if your bank account was hacked would you care if one password was used or 2 ?

SmokeyTheBear 01-03-2008 12:28 AM

Quote:

Originally Posted by Robbie (Post 13595659)
:1orglaugh:1orglaugh:1orglaugh:1orglaugh:1orglaugh


shows how much you know :thumbsup , you should do some research before you scoff, many of us aren't young uns, there was lots of porn sites well before the internet :thumbsup

TheDoc 01-03-2008 12:44 AM

Quote:

Originally Posted by Jesus H Christ (Post 13595891)
This is the greatest fucking post I have read all year..and this is GFY.com TheDoc: I love you and and my Dad says John is a pimp!

I have gota start making more crazy posts like this.. I have never had more publicity or fun over a comment. Oh wait, that isn't true the post(s) about Review Sites is still my fav.

TheSenator 01-03-2008 12:50 AM

Quote:

Originally Posted by minusonebit (Post 13595539)
I'd worry more about the number of trees that are dying to print out GFY. Hell, I have already gone through a set of toner and six reams of paper on this mess.


I wonder how much the retainer fee is and if they already blew through it with printing out GFY threads.

"For June 1, 2006 to May 31, 2007 the rates are as follows: 20+ years of experience, $425 per hour; 11-19 years, $375; 8-10 years, $305; 4-7 years, $245; 1-3 years, $205; and Paralegals/law clerks $120"

buzzy 01-03-2008 12:52 AM

THe guys at MPA3 seem really nice and patient, where as John from nats seems like the evilchris type of guy, don't get me wrong this is just from observing the drama that goes on but from an honest opinion from the outside even though I agree minusonebit is a retard, John isn't handling this well at all.

:2 cents:

marketsmart 01-03-2008 01:05 AM

I am amazed at all the responses here. The "BRO CLUB" is deep...

all i can say is that if i lost any data, (email, personal, members, etc) due to a 3rd party application, i would be pretty pissed off...

buzzy 01-03-2008 01:07 AM

Quote:

Originally Posted by marketsmart (Post 13596092)
I am amazed at all the responses here. The "BRO CLUB" is deep...

all i can say is that if i lost any data, (email, personal, members, etc) due to a 3rd party application, i would be pretty pissed off...

Word, too much dick sucking going on here.

ServerGenius 01-03-2008 01:16 AM

i've posted raw apache access logs of 6 months ago which showed the issue
has been on much longer than initially was assumed

borked 01-03-2008 01:19 AM

Quote:

Originally Posted by Robbie (Post 13595653)
Smokey there was no "Master Nats password list" There was ONE LOGIN that they used to do maintenance on everybodies NATS setup. ...
YOU ARE INCORRECT....THERE WAS NO MASTER PASSWORD LIST.

You, sir, are so very very wrong on this point. JohnA even made a post to clarify this, but I can't be arsed to find it.

Paul Markham 01-03-2008 01:26 AM

Quote:

Originally Posted by Chimera1 (Post 13594648)
Are you really arguing for the sake of it?

Nats is struggling to survive and may not make it, especially with the backlash developing in spite of their best efforts. Perhaps you can start an argument over that.

The program owners with an investment are naturally struggling to find justifications in keeping the software and are more inclined towards belief.... Maybe that too is something to argue about.

They have much to lose and gain in this and their defenses and arguing are expected, though maybe not entirely logical.

From the affiliate level we don't actually have much to gain or lose except to take notes as to who is alert and who is burying their heads in the sand.

So why all the argument over tiny points when the main issue is clear and incontrovertible?

At last someone comes in with common sense. It does not matter if the servers were brought down, to their knees or slowed down. What matters is NATS, as we all know, were well aware of this issue. There had been numerous warnings that email addresses were being compromised. They failed to look at it properly. Even when they had it brought to the their attention in a way they could not ignore they did not fix the problem properly, did not warn other clients and tried to stop the information getting out. A C&D is a legal letter and a threat.

So the question is why did they take so long to look into it, not fix it and try to keep it quiet?

Incompetent and don't want people to know. Or. Dishonest?

There are no other answers.

Yes I feel for the companies that went the way of NATS. But you made a bad decision and did not keep a good enough control on who you were dealing with. As Chimera says you can keep burying your head in the sand and stick with a company that's incompetent or dishonest.

Heaven help us if they had put up a site with a few magic join links.

Paul Markham 01-03-2008 01:32 AM

Quote:

Originally Posted by Chimera1 (Post 13594750)
To be honest I do not know this person. I really don't care to know him.

I am curious why you are arguing with a person you deem mentally incompetent? That is not logical, nor is it productive.

Again, I say are you guys arguing for the sake of hearing your jaws work or your fingers type or is there some pathology involved?

I would certainly hope people could separate news from the bearer. AVN has my vote of confidence in this matter at least in so far as being legally and factually correct in quoting the statements they did.

I don't feel that arguing with a person you deem unstable is going to change that person's mind or their actions.
There is personal and there is business. So which is it?

Another great post. They are arguing with him because he's saying things they don't want to hear and the only attack they have is to attack the messenger. Because the message is best ignored.

Paul Markham 01-03-2008 01:47 AM

Quote:

Originally Posted by MicDoohan (Post 13595030)
there is not the slightest shred of evidence to suggest affiliate data was leaked. non.nada.NOTHING but heh don't let that stop you when you are getting 'mad views' :(

you are just a frustrated little faggot keith :1orglaugh

All those email addresses getting spammed is not proof?

Paul Markham 01-03-2008 01:53 AM

Quote:

Originally Posted by will76 (Post 13595283)
See thats the thing that doesn't make sense to me.

Fact: we know it was a password list that was obtained from TMM some kind of way, either a server hack, someone leaked the info, etc... some kind of way their admin account info for every client was released.

They say they noticed "this" problem months ago but thought it was isolated and they thought they fixed it.

Question: If you noticed that a few clients were having someone accessing their servers using your NATS admin account info, why the hell didn't you check all of your client's servers that you have access to.

Most likely answer: John probably blammed each of the people affected months ago and passed it off as their servers were hacked. I would bet he didn't think the problem was on his end so he didn't bother to take a couple mins to randomly start logging into clients servers to see if NATS admin accounts were accessing those servers 10x a day. He said this much in the first couple threads posted here a couple weeks ago. he siad the most likely answer was that the clients server was hacked.

If i am wrong please explain to me what I am missing here.

Another great post.

If we are to believe TheDoc then hacking is a real problem. Hackers are very devious, persistent and a threat. So why is he supporting someone who clearly does not think they are? Someone who ignores to look at the problem properly?

Now are TMM bright enough to program something like NATS and so dumb they do not understand that hackers are a problem? I come back to the same question every time, incompetent or dishonest. They have to be one or the other.

Paul Markham 01-03-2008 05:33 AM

Quote:

Originally Posted by ServerGenius (Post 13596114)
i've posted raw apache access logs of 6 months ago which showed the issue
has been on much longer than initially was assumed

I think the issue of the emails getting spammed was raised a long time ago.

ServerGenius 01-03-2008 05:39 AM

Quote:

Originally Posted by Paul Markham (Post 13596984)
I think the issue of the emails getting spammed was raised a long time ago.

Yes I know.....but I backed it up with logs.....it was raised something like
2 years ago if I remember correctly

Paul Markham 01-03-2008 07:15 AM

Quote:

Originally Posted by ServerGenius (Post 13597007)
Yes I know.....but I backed it up with logs.....it was raised something like
2 years ago if I remember correctly

With TheDoc telling us how so many big and secure programs get hacked, how easy the hackers get in and hew common it is. One has to wonder what TMM were doing ignoring it and not even thinking it might be more wide spread than the few who put the proof in front of them.

Why were they so convinced it was not a wide spread problem?

TheDoc 01-03-2008 08:00 AM

Paul and Will76, did both of you end up with the short ends of the stick?

Yeah, we know hacks/exploits targeted at NATS have taken place for years. Every host, program owner, and webmaster knows this. It's not some secret that you guys want to find out about.

NATS job is NOT to provide security. It’s to provide a program backend, only. YOUR job is to secure it, your hosts and yours, period.

So how did those accounts get breached before? That's very simple logic, let me help. When a NATS "Machine" is exploited they got your ass, your pw's, ect.. (Exploits targeted at NATS machines happen daily) Once they have the admin data they can start running the bot that pulls the data.

So get it through your heads, NATS thought the attacks were different. Different enough that even Admins at the same host didn’t know it was the same attackers.

Why don't you guys go bash the Program Owners who failed basic 101 security? Why not yell at the hosts they host with? NATS job is to provide us the software, not the security.

I put my trust into my host, and my own skills not in software that I have ask for support on and can’t modify myself.

Doctor Dre 01-03-2008 08:05 AM

Quote:

Originally Posted by BoyAlley (Post 13594354)
Wow, I'm not use to seeing that type of reporting from AVN.

John should definitly comment about the investigation and keep everybody that was affected (affiliates and sponsors) updated... At this point, keeping the investigation behind closed doors after having ignored the problem for so long will only make people logically there are some kind secrets they want to keep.

s9ann0 01-03-2008 08:06 AM

Quote:

Originally Posted by BoyAlley (Post 13594354)
Wow, I'm not use to seeing that type of reporting from AVN.

yea are they bringing out their own affil system or something?

TheDoc 01-03-2008 08:07 AM

Quote:

Originally Posted by Doctor Dre (Post 13597492)
John should definitly comment about the investigation and keep everybody that was affected (affiliates and sponsors) updated... At this point, keeping the investigation behind closed doors after having ignored the problem for so long will only make people logically there are some kind secrets they want to keep.

NATS/TMM works with the clients and the clients work with the Webmasters. And I don't think after a week NATS had much of an update for us.

Doctor Dre 01-03-2008 08:07 AM

Quote:

Originally Posted by Robbie (Post 13594405)
"When everything hit the boards, we went back to check [our server logs] and found the same admin account trying to access our servers every hour," he said Friday. "The IP [address] block was the same one that was blocked over a year ago, so [the person using the account] couldn't get in. It is slowing down the servers a little bit, but they're not actually getting in."

That is a quote from the story... So supposedly some big site had their servers brought down to their knees by ONE IP address attempting to log in and fail? Does anybody ever proof read or use common sense with these stories? This is almost as factual as a Bill OReilly story.

I *think* they meant that the activity in the nats admin account was slowing down the server.

buzzy 01-03-2008 08:09 AM

Quote:

Originally Posted by minusonebit (Post 13595451)
When NATS was sold to the industry, it was pitched as tool to keep the program owners honest by stopping shaving. TMM worked very hard to spin this on the boards and pretty soon affiliates started demanding NATS-based programs. The idea was that John's software, which could not be touched by the programs - would be unshaveable. Thats all good and well and had it actually functioned that way, it would have been a good thing for the industry. But these kind of things never work out this way.

Anyone who has taken college level (for that matter, probably high school level as well) courses in government, public service, democracy, world history and the like knows that concentration of power is a dangerous thing. We saw this in Nazi Germany, here in our own country and just about everywhere else throughout the world. The thing is that TMM was saying to affiliates: "Hey, trust US. We have YOUR best interests at heart. We wont let you bring in an independent third party to audit our code to prove this, but we do. You don't wanna get shaved, do you? What? You still don't believe us? You good for nothing board whore, if you publish that, We're, gonna sue you for libel!" and this has worked for a long time for TMM. They have made a good run of scaring their critics into silence and programs into using them. And this concentration of power led to the ultimate in lax, completely incompetent security: a list of passwords sitting on somebody's server.

Given the choice between NATS incompetently managing my personal data and the possibility that a dishonest sponsor *may* shave sales, at the end of the day I'll take the possibility of shaved sales. Its a small price to pay. First off, most program owners are honest, most of them are very generous with their affiliates and most of them would not consider - so its not even a really large risk. Second, dishonest people always get caught at their games eventually. iBill's greed eventually caught up to them. John's incompetence and/or crookedness has caught up to him. If you believe the story that PornGraph was actually sold before the trojans went on, then you can see it caught up with the new owners as PG is no more. Finally, program owners who fuck their affiliates through shaving probably fuck their employees, contractors, business partners and talent as well. By proxy, this means they likely already have a bad reputation and everyone knows who to stay away from anyway.

I know NATS fucked up big time, but comparing them to nazi germany? :1orglaugh:1orglaugh:1orglaugh:1orglaugh

Doctor Dre 01-03-2008 08:10 AM

Quote:

Originally Posted by Robbie (Post 13594719)
S And people who are really in the biz know that. It's always been so. And HELL NO they don't cost no 20 cents a piece! More like 20 cents per THOUSAND.
And members area email addresses? Golden? If you think so. Hell, maybe I will sell mine after all. How about that 20 cents each deal? That's a lot cheaper than that dollar quote in that story! Come on man! I'm gonna make you rich! I've got thousands and thousand of members emails! Just think of all the money you'll make!

You are totally clueless when it comes to Marketing...
Harvested emails are worth nothing.
Confirmed porn buyers (credit card + confirmed working email) are worth a TON.

Doctor Dre 01-03-2008 08:11 AM

Quote:

Originally Posted by TheDoc (Post 13597503)
NATS/TMM works with the clients and the clients work with the Webmasters. And I don't think after a week NATS had much of an update for us.

Are they investigating the money trail or not ? There was NO statement from what I have read that said anywhere that they will take the proper stepts to report this fraud to the authorities or investigate at all.

TheDoc 01-03-2008 08:13 AM

Quote:

Originally Posted by Doctor Dre (Post 13597535)
Are they investigating the money trail or not ?

I think the money trail has been exposed already.. Question is will people out who it is. Email lists are easy to pawn off as purchased from others too :/

I think TMM is on the hacker trail - but only being a week afterwards I haven't asked :)

Doctor Dre 01-03-2008 08:16 AM

Quote:

Originally Posted by TheDoc (Post 13597552)
I think the money trail has been exposed already.. Question is will people out who it is. Email lists are easy to pawn off as purchased from others too :/

I think TMM is on the hacker trail - but only being a week afterwards I haven't asked :)

The money trail has been exposed by webmasters teaming up and asking questions... that's beside the point.

Why are NATs not letting us know they are looking into things if they are ?

tony286 01-03-2008 08:21 AM

Quote:

Originally Posted by TheDoc (Post 13597466)
Paul and Will76, did both of you end up with the short ends of the stick?

Yeah, we know hacks/exploits targeted at NATS have taken place for years. Every host, program owner, and webmaster knows this. It's not some secret that you guys want to find out about.

NATS job is NOT to provide security. It’s to provide a program backend, only. YOUR job is to secure it, your hosts and yours, period.

So how did those accounts get breached before? That's very simple logic, let me help. When a NATS "Machine" is exploited they got your ass, your pw's, ect.. (Exploits targeted at NATS machines happen daily) Once they have the admin data they can start running the bot that pulls the data.

So get it through your heads, NATS thought the attacks were different. Different enough that even Admins at the same host didn’t know it was the same attackers.

Why don't you guys go bash the Program Owners who failed basic 101 security? Why not yell at the hosts they host with? NATS job is to provide us the software, not the security.

I put my trust into my host, and my own skills not in software that I have ask for support on and can’t modify myself.

I dont have a horse in this but just from reading all of this your trying way too hard.

notoldschool 01-03-2008 08:24 AM

Quote:

Originally Posted by fuckingfuck (Post 13595407)


notoldschool = IDIOT BRO


Wow, now im am complete. I feel so accomplished now. maybe we should all call minusonut a bro so maybe he will get off our industries nuts.

Not that it matters I will state again that I dont know one single person at nats other than when I need something done to my proggie. I do push quite a bit of traffic to all types of programs, and Im not talking the couple hundred clicks most of you part time affiliates push, and I know for a fact that most of the nats programs work a shit load better than some of the other garbage back ends some of these shady ass programs have. I work it from both ends so I know what proggies to stay away from because of their homemade backend. Nats is great software for sure. Atleast We know about what happened with nats and that its fixed. Im also sick of you bitches that call yourselfs adult webmasters trying to ruin a biz that in reality you are not even part of. Let me spell it out, if you have been in the biz more than a year and your not pushing atleast 10000 uniques a day somewhere, then you are NOT and adult webmaster and should keep your limited knowledge to yourselfs. You just sound like the idiots that you are.

TheDoc 01-03-2008 08:36 AM

Quote:

Originally Posted by tony404 (Post 13597626)
I dont have a horse in this but just from reading all of this your trying way too hard.

No worries Tony, I'm done with these two tools. They read past the answers and modify their own questions for personal benefit.

TheDoc 01-03-2008 08:38 AM

Quote:

Originally Posted by Doctor Dre (Post 13597568)
The money trail has been exposed by webmasters teaming up and asking questions... that's beside the point.

Why are NATs not letting us know they are looking into things if they are ?

How exactly would NATS follow the money trail? Wouldn't it take Webmasters to team up and expose it for them? And I know who they are, so what? NATS can't sue them.

NATS is looking into things, they have stated they are hunting down the hacker. Of course they can't comment more, I wouldn't either, nobody doing an investigation would.

Logic people, logic...

frank7799 01-03-2008 09:18 AM

Quote:

Originally Posted by TheDoc (Post 13597466)
NATS job is NOT to provide security. It?s to provide a program backend, only. YOUR job is to secure it, your hosts and yours, period.

Itīs not their job to provide security of their customers servers. But they - NATS - required a server access. So itīs their job to take care of it.:2 cents:

borked 01-03-2008 09:40 AM

Quote:

Originally Posted by TheDoc (Post 13597466)
So get it through your heads, NATS thought the attacks were different. Different enough that even Admins at the same host didn?t know it was the same attackers.

ORLy? which host would this be then???

TheDoc 01-03-2008 10:31 AM

Quote:

Originally Posted by borked (Post 13598357)
ORLy? which host would this be then???

Umm.. Well the old apache exploits/admin targets came in through VOIP IP exploits and not from the FL IP. So previous admin/attacks came through server level exploits first, once they had access they exploited the data the exact same way. This is why NATS made the admin/webmaster pw's one way, so they can't be pulled from the admin. A security step by NATS, mind blowing I know.

Hosts didn't know it was the same attacker each time doing the same thing in different ways. Not until recently at least and once people started posting on GFY, then people put two and two together, we saw it right here, live. Yes, I'm sure a couple of hosts knew something was going down, but they sure as hell didn't talk about it, fear, pfft..

If John ever threatened me for exposing an exploit I would have blasted his ass all of the boards. Anyone that wouldn't do the same is weak minded.

NATS has a ticket system. You have to post in for all support, ect. And icq history for those they talk to on ICQ. If all these clients really had these problems, threats, ect about the hacks/ips, exploits then why don't they just post the tickets? I'm sure people have tickets, I do, but they show NATS helping and not threating.

NATS isn't perfect, boy it's far from perfect. Clients already knew this - guess it was only time for Webmasters to find out. Support isn't the fastest, they don't always work on weekends, and you don't always get the right support person smart enough to help with your complex problem.

And since NATS doesn't monitor my NATS/server 24/7 - I take security into my own hands and my hosts, as it should be.

borked 01-03-2008 10:39 AM

so you're saying this recently exposed hack was done by the same guy that did the previous exploit?

ServerGenius 01-03-2008 10:44 AM

They better shut up about all this until they have concrete answer backed up
with facts and/or proof in a well written statement.....the guessing and
insinuations aren't doing any side good at this point.......well except for
entertainment of course........fuck it.....continue

TheDoc 01-03-2008 10:49 AM

Quote:

Originally Posted by borked (Post 13599029)
so you're saying this recently exposed hack was done by the same guy that did the previous exploit?

I think it's the same group attacking us for the last 10 years. That damn voip exploit to connect and pull data works the same, but it's a different way of doing it. Either way the same method of getting the data was done and back then it didn't have to done through a nats admin account.

So other than the login ip - no I don't have any real proof it's the same people. Other than over the last several months. But my point was more than they attack us in several ways - but they always appear to get the data the same exact way once they are in.

Do you have something that points that it's more than one group/person?

ServerGenius 01-03-2008 10:58 AM

Quote:

Originally Posted by TheDoc (Post 13599121)
I think it's the same group attacking us for the last 10 years. That damn voip exploit to connect and pull data works the same, but it's a different way of doing it. Either way the same method of getting the data was done and back then it didn't have to done through a nats admin account.

So other than the login ip - no I don't have any real proof it's the same people. Other than over the last several months. But my point was more than they attack us in several ways - but they always appear to get the data the same exact way once they are in.

Do you have something that points that it's more than one group/person?

Ok I'll bite this whole discussion about the hack, and how it was possible
to have happened....added with all the bullshit that every program could get
hacked just as the servers they're on.....that's all nice and dandy but it's
completely irrelevant to the argument........


Well ok....not completely it only serves the purpose to divert the negative
attention to a different subject in order to make it seem less bad as it already is.


So now you probably say.....well is that so? So what's the part then that DOES
matter about all this......

Brace yourselves here it comes.......The fact that it happened, TMM knowing
about it for a LONG time and didn't take proper action and informed their
clients about it.......making it appear...(I'll keep it polite tonight) that they
were trying to hide it hoping they'd be able to fix situation before it blew up
in their face like it did recently......

That's all.....continue the discussion please and show us what's your interest
in this by judging the arguments you come up with......


:2 cents:

TheDoc 01-03-2008 11:03 AM

Quote:

Originally Posted by ServerGenius (Post 13599217)
Brace yourselves here it comes.......The fact that it happened, TMM knowing about it for a LONG time and didn't take proper action and informed their clients about it.......making it appear...(I'll keep it polite tonight) that they were trying to hide it hoping they'd be able to fix situation before it blew up in their face like it did recently......

:2 cents:


Sad as it is, if this didn't come out on the boards it wouldn't have been fixed. They didn't know wtf to look for. It blew up in their faces because they aren't security admins and the true fact that John's ego blocks his brain waves sometimes doesn't help.

But we all already know this.. We all know nats fucked up, no reason to bring up the dead horse another 1000000 times. The lesson to be learned, again... Is security is YOUR responsibility and not NATS.

And I thought we were talking about previous hacks/exploits with NATS?
Do you even use NATS?

ServerGenius 01-03-2008 11:08 AM

Quote:

Originally Posted by TheDoc (Post 13599269)
Sad as it is, if this didn't come out on the boards it wouldn't have been fixed. They didn't know wtf to look for. It blew up in their faces because they aren't security admins and the true fact that John's ego blocks his brain waves sometimes doesn't help.

But we all already know this.. We all know nats fucked up, no reason to bring up the dead horse another 1000000 times. The lesson to be learned, again... Is security is YOUR responsibility and not NATS.

And I thought we were talking about previous hacks/exploits with NATS?
Do you even use NATS?

I don't I had clients who did and got insulted by TMM on numerous occasions
when the issue was raised in a few occasions which all were done directly and
very politely to them and kept non public.

And not only insulted but badmouthed behind my back to clients......


All times are GMT -7. The time now is 04:38 AM.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2025, vBulletin Solutions, Inc.
©2000-, AI Media Network Inc123